Re: How can admin not have access to certain shares?

In article <#ICbOwMdIHA.2404@xxxxxxxxxxxxxxxxxxxx>, anthony@xxxxxxxxxxxx
says...
If you want data to be outside the scope of a domain administrator, it is
fairly obvious that you need to put the data outside the domain.
Auditing the data so that you are alerted when someone accesses it is
different. It is like putting the burglar in charge of setting the alarm.
Anthony
http://www.airdesk.com

Nope, and that would violate most auditing compliance programs out
there.

If you don't trust the administrator then you're screwed to start with.

No matter where you put the data you are doing to have to back it up,
maintain it, administer it, etc.... Someone has to do that, and you have
to trust that person(s).

--

Leythos
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@xxxxxxxxxx (remove 999 for proper email address)
.

Relevant Pages

  • Re: Monitor User Remotely.
    ... activity, auditing of process tracking on ... remotely via administrator share, and folder files have creation timestamps ... he can clear the security log. ... > Is there any way we can remotely monitor him, ...
    (microsoft.public.win2000.security)
  • Re: How can admin not have access to certain shares?
    ... Auditing the data so that you are alerted when someone accesses it is ... If you don't trust the administrator then you're screwed to start with. ... defining and managing a reasonably well tuned and managed network ... all access to these documents in any way for any purpose by our admin. ...
    (microsoft.public.windows.server.security)
  • Re: Secure logging of actions of Win2000 administrator?
    ... Windows NT/2000 auditing works a little differently than you think, ... want to monitor a folder, right-click on the folder, and in the Properties, ... select Security and Advanced. ... The administrator can clear the log, ...
    (comp.os.ms-windows.nt.admin.security)
  • Re: Log all changes to a server? Is it possible or what do I need?
    ... You can also turn on auditing via group policy for program execution. ... these employees are completing using the admin account and delegate control ... So although the administrator name would be used, ...
    (microsoft.public.windows.server.security)
  • Re: Access denied
    ... set the permissions so they can't. ... this won't actually stop an administrator from viewing these files ... Auditing will enable a small audit trail that can pin point any ... machines that are not covered by your corporate anti-virus policy. ...
    (microsoft.public.windows.server.active_directory)