Re: ntfs file permissions, ownership


"Carsten Krueger" <use.net.cakruege@xxxxxxxxxxxxx> wrote in message
news:17xiydxapbvkf.dlg@xxxxxxxxxxxxxxxxxxxxxx
> Am 13 Jan 2006 20:57:16 -0800 schrieb Dan Lewis:
>
>> currently have any permissions to (as adminsitrator), without taking
>> ownership (or do it by taking ownership, and then restoring the
>> original owner).
>
> Why is this a problem?

Doesn't matter why it's a problem, this is just what he wants to do.

IMHO, if an administrator account does not have change permissions access to
NTFS objects, then, simply by definition, it cannot change permissions
without somehow acquiring this access. One of the attributes of an
administrator account is that it can take ownership, as a result of its
being the "owner" of the computer itself.

I see only two ways that the permissions can be changed:

a) take ownership. Unfortunately setting the ownership back afterwards is
not so straightforward to accomplish, at least natively. There may be third
party tools that can do this, but it appears that the OP does not want to do
it this way.

b) get the owner to make the changes by one of the following methods (which
may depend on your organization's security policies):

b.1) ask the person to do it, and show them how.

b.2) ask the person to login, and then watch you make the change.

b.3) ask the person to "run this script which will correct some security
settings...".

b.4) run a corrective script from the logon script.

b.5) reset the user's password, use the altered credentials to make the
necessary change, then reset the user's password and advise him by your
normal methods of what it has been changed to.

b.6) wait until the user has logon problems, and when asked to reset the
password, do it following the steps outlined in point "b.5".

In our environment, if it turned out that the only way to feasibly
accomplish this was for an admin to actually use the user's credentials, the
reasons would have to be well documented, and the process would have to be
specifically authorized, monitored, and audited.

It is easy to say, however, that an administrator account should be able to
do *anything*, whether interactively or through a script. Unfortunately, the
users of administrator accounts are generally human and not god-like, hence
administrators must also play by the rules. If they were weakened for
administrators then, well, the rules would be weakened, and that is not a
good thing.

Or think of it this way: is God so all-powerful that he could create a rock
so heavy that he would be unable to lift it, or the IT corollary: is the
administrator so all-powerful that he can create security boundaries that
are so secure he himself cannot get past them. Two interesting conundra.


/Al


.

Relevant Pages

  • Re: Control over creation of procs & views owned by dbo
    ... To add on to Jasper's response, you could also change object ownership to ... 'dbo' with sp_changeobjectowner. ... security context of the invoking user, not the object owner. ... need permissions on only directly referenced objects. ...
    (microsoft.public.sqlserver.security)
  • Re: Adding XP in another partition users into Vi$ta
    ... "The Owner tab shown in Figure 12.19 has no option for giving ownership to ... When logged in as a standard user, when you elevate you are logging in ... only be considered for deny permissions. ...
    (microsoft.public.windows.vista.security)
  • Re: Lets talk about ownership!
    ... They will have the same permissions but the permissions are meaningless as there is no user to match. ... According my previous example the user "Terry" has read/write permissions on folder NickData. ... Ownership doesn't really matter as long as you have permissions. ... XP can be configured in Local Security Policy to make the Admin group the owner for files created by admins. ...
    (microsoft.public.windowsxp.general)
  • Re: Cannot delete file - Unable to remove permissions
    ... As a local administrator you can take ownership. ... The file has NTFS permissions inherited and I am unable to modify/ ... does not have an owner.. ...
    (microsoft.public.windows.file_system)
  • Re: Re: Unable to delete/modify registry keys - XP SP2 installat
    ... I checked the ownership on the key and it ... was "unknown". ... I made my administrator account the owner of the key and then ...
    (microsoft.public.windowsxp.general)