Re: Keep domain admin from being able to take ownership

From: Lanwench [MVP - Exchange] (lanwench_at_heybuddy.donotsendme.unsolicitedmail.atyahoo.com)
Date: 03/31/04 

Date: Wed, 31 Mar 2004 11:04:53 -0500

Domain admins can change whatever they want. It won't be invisible, and you
can turn up auditing, but you can't stop them from being able to do it if
they have permissions to do it. Hire only admins you can trust.

Russell White wrote:
> Greetings.
>
> "Is it possible to make it impossible for a domain admin to take
> ownership of a folder and it's contents?"
>
> this question can also be phrased as...
>
> "is it possible to make something accessible only to one user and no
> one else (including domain admin) can either change permissions, take
> ownership, etc."? It seems to me this is not possible - that domain
> admin can always take ownership of these files.
>
> The powers that be want one directory on our win2ksbs server to be
> accessible only by a user, "fred". The domain admin should not have
> access to this file nor should he be able to change permissions nor
> should he be able to take ownership (thus allowing him to change
> permissions).
>
> So it would appear to me that it is impossible (and for good reason I
> would think) to make it impossible for domain admin to access a
> certain directory because he could always take ownership of this
> directory and then change permissions and then access the file.
>
> Is this true? Is it possible to make it impossible for a domain
> admin to take ownership of a folder and it's contents?
>
>
> Thanks in advance,
>
> Russ White

Relevant Pages