Re: Folder permissions and take ownership

Yeh i thought you might say that. Partly political partly just a US company
and US mentality that "we" must be in control of all things...



"Shenan Stanley" wrote:

Gunna wrote:
I have a need to put an Active Directory group into the
Administrators group on a number of machines for various reasons
which cannot be stopped. The problem is there is an application on
these machines that I do no want them to be able to access and the
aaplication has no ability to request crednetials etc. It's just a
dumb application.

I considered using FOlder permissions to lock out the local
administrator group from the folder. This stopped them from
running the application until I when in as one of the users and
simple took ownership of the folder and gave myself access. Then I
tried adding a deny take ownership of the folder to the local admin
group. Again it just allowed me to take ownership assuming becuase
local admins can do that regardless of the deny rule I just created.

Can anyone suggest how to stop them taking ownsership and from
being able to run the application?

If someone is an administrator on a computer - other than encryption and
other password-based limitations - you are not going to 'stop' them from
doing just about anything they please.

In other words - "administrators" is the default name of the group for a
reason. They can administer everything on the computer as they see fit.

What is this unstoppable reason to make these users administrators?
Political I assume?

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html



.

Relevant Pages

  • Re: Multiple Domain Administrators with different Roles
    ... Rghtclick the folder with your admin user, security tab, advanced, Ownership tab and choose take ownership, then you are the owner of the folder. ... Under a shared folder, i then removed the Administrators group, and ...
    (microsoft.public.windows.server.active_directory)
  • Re: Effective NTFS permissions do not reflect the ACL on folders a
    ... {Replace "S:\Some Folder" with the name of a real folder with restricted ... All permissions are inherited from parent folder. ... Administrators and SYSTEM: FC ... Administrators group from the ACL. ...
    (microsoft.public.windows.file_system)
  • Re: EMERGENCY: Files lost
    ... under Advanced Settings of the Folder Options. ... You now need to edit the permissions of every file (step 6 on my page. ... Highlight the Group or user name you wish to modify (Administrators ... Administrator or Administrators Group. ...
    (microsoft.public.windowsxp.configuration_manage)
  • Re: Effective NTFS permissions do not reflect the ACL on folders a
    ... the ACL of the new folder is the following: ... Administrators and SYSTEM: FC ... Administrators group from the ACL. ...
    (microsoft.public.windows.file_system)
  • Re: Multiple Domain Administrators with different Roles
    ... I can still give myself back access to the folder.. ... If I remove myself from the Domain Administrators group though, ... I created a new Group called Admin, I then added them to the Administrators ...
    (microsoft.public.windows.server.active_directory)