Re: NTFS Security

From: Ansgar -59cobalt- Wiechers (bugtraq_at_planetcobalt.net)
Date: 01/12/05

  • Next message: Rasmus Rønlev: "RE: NTFS Security" 
    Date: Wed, 12 Jan 2005 21:35:13 +0100
To: focus-ms@securityfocus.com

    On 2005-01-11 Monrad.DC@forces.gc.ca wrote:
    > I am looking at securing some USB memory sticks, to allow all domain
    > users access on domain networked computers, but to restrict access
    > from non-domain computers (home/internet/etc).

    Not sure if I'm reading you correctly. Are you asking if you can
    restrict access to data on USB sticks to users of your domain by setting
    NTFS permissions? That's not possible at all, since filesystem
    permissions can be circumvented, e.g. by taking the ownership on any
    other windows box or by mounting the stick on a linux box.

    > Giving domain users full permission and removing everyone works to a
    > small degree.
    > Plugging the usb drive into an XP machine comes up with a message that
    > the drive is unaccessible, but you can access it by taking ownership.
    > As most home users are the local admin, this solves nothing.
    >
    > Going one step further and setting special permissions deny take
    > ownership/deny change permissions for everyone does not seem to stop
    > the local admin from another domain/workgroup from accessing the data.

    Any local admin is *always* able to take the ownership of a file or
    folder, except for when you remove that privilege from the
    administrators group on the *local* machine. You cannot restrict this
    through NTFS permissions.

    > Is there a Microsoft or third party solution to this, without
    > encrypting the data and restricting access to specified individuals?

    No. Using encryption is the only way to (more or less) achieve what you
    are asking for.

    Regards
    Ansgar Wiechers 

    -- 
"Those who would give up liberty for a little temporary safety
deserve neither liberty nor safety, and will lose both."
--Benjamin Franklin
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: Rasmus Rønlev: "RE: NTFS Security"

    Relevant Pages