RE: File and email Security

From: Cowan, Brian (bcowan@rational.com)
Date: 08/13/01 

Message-ID: <0F1FB548BF76E34ABCFC850E9007D34E228075@sus-ca3it26>
From: "Cowan, Brian" <bcowan@rational.com>
To: 'Paul Smith' <paul@pscs.co.uk>, Todd Schubert <tschubert@jorycapital.com>, focus-ms@securityfocus.com
Subject: RE: File and email Security
Date: Mon, 13 Aug 2001 10:03:24 -0700

Oddly enough, every time I "take ownership" of files as an administrator, it
changes the ownership of the files to the administrators group (either
MACHINE\Administrators or DOMAIN\Domain Admins). So, unless something really
wild is happening, the only way to find out exactly who grabbed ownership of
the files is to audit that event. Of course, a sneaky admin would use one of
the event log editor hacks out there...

Brian

-----Original Message-----
From: Paul Smith [mailto:paul@pscs.co.uk]
Sent: Wednesday, August 08, 2001 12:43 PM
To: Todd Schubert; focus-ms@securityfocus.com
Subject: Re: File and email Security

>I have an interesting problem that I am hoping someone out there can help
me
>with. Basically what it boils down to is that we need to store files on
our
>server and emails on our exchange server that only the CEO can access and
>that the network admins can't access without the CEO knowing. Permissions
>don't seem to be a solution because they can be changed by the admins and
>the logs can then be falsified to hide the changes. Has anyone encoutered
>something similiar to this or have any ideas on how to get around this??

You don't say what OS your file server is using... If you're using Windows
NT/2000 then the following applies:

I may be wrong here (but I don't think so) - if the CEO seizes 'ownership'
of the files and sets the permissions so that ONLY he can access them, the
only way an admin can access them is to seize ownership themselves, change
the permissions, access the files and change the permissions back again.
The admin can NOT (as far as I know) set the ownership back to a different
person (you can only 'take ownership' you can't 'give ownership'), so the
CEO will be able to tell that a particular admin has potentially looked at
the files.

This does not stop the admin accessing the files, but it does mean he's in
trouble afterwards... The only way to stop the admin accessing the files is
to keep the files off the server...

(If you think about it, an administrator SHOULD be able to access the files
somehow - what happens if the CEO gets run over by a bus and the files
contain critical information, the replacement CEO needs to have access to
them so an administrator needs to be able to transfer them to the new CEO)

Paul VPOP3 - Internet Email Server/Gateway
paul@pscs.co.uk http://www.pscs.co.uk/

Relevant Pages

  • Re: deleting users my document folders after disabling redirection
    ... Kinda like the modern day 'logon locally, or deny logon localy", eh. ... that changing ownership is a right that could be taken away from ... Logging in as administrator and following your directions I still ... Why would my system admin account be restricted? ...
    (microsoft.public.windows.server.sbs)
  • Re: deleting users my document folders after disabling redirection
    ... There used to be a question on the old NT FAQ site: I set the permissions ... changing ownership is a right that could be taken away from certain ... Logging in as administrator and following your directions I still ... Why would my system admin account be restricted? ...
    (microsoft.public.windows.server.sbs)
  • RE: File and email Security
    ... Subject: File and email Security ... Instruct the bank that only ... The admin can NOT set the ownership back to a different ...
    (Focus-Microsoft)
  • Re: deleting users my document folders after disabling redirection
    ... I suppose it would depend upon what the deny was (take ... changing ownership is a right that could be taken away from certain ... Logging in as administrator and following your directions I still ... Why would my system admin account be restricted? ...
    (microsoft.public.windows.server.sbs)
  • Re: Trouble Reseting Password
    ... Once logged in as admin, right click the file in question and 'take ... ownership' of it. ... When i try to log in with administrator ... > acount due to account restrictions. ...
    (microsoft.public.windowsxp.general)