How to prevent Domain Admins from being denied access to network folders

active-directorynetwork-sharentfswindows-server-2003

As I understand it, if a user creates a folder they become the owner and can control NTFS permissions including removal of inherited permissions granted to Domain Admins.

What is the best approach to prevent Domain Admins from being denied access to network folders? These are some of the approaches I have read about:

You shouldn't be trying to prevent users from changing permissions on the folders they create.
Schedule a script that takes over ownership of any folders that Domain Admins cannot access (sidebar question: if you change owner does that replace [i.e. remove] the ACE that granted full control to the original owner?).
Use a combination of Share permissions change and read) and NTFS permissions (modify) to limit Authenticated Users' ability to change permissions as described by Helge Klein.

Best Answer

This seems more like a management issue than a technical one. Taking ownership with a script or trying to block the few people that would ever play with permissions is more trouble than I think it would be worth.

In the past, we've made personal folders completely inaccessible to domain admins, but there are inevitably times when people call up and ask "can you check something in my personal directory?"

So we follow a policy that admins have to be able to read everything (with a few exceptions). If we ever come across a folder where someone has blocked admin access, we find out why, explain why we think it's better that we have access, and we change the permissions back to our default. If it happened while we were tracking down a problem, that's why we have the policy: so we could simply take control at the time and sort it out later.

Related Solutions

Linux – NTFS and Linux Permissions

Did you check

getfacl /path/to/MyShare

to get all of the acl's set on that directory? The primary group of the user that opens the document is most likely "Domain Users", causing the permissions to change when they access the file.

Security groups not allowing domain admin to view files

You have the "Grant the user exclusive rights..." box ticked on the "Settings" tab of the folder redirection settings. Turn that off and the Folder Redirection client-side extension (CSE) will add "Administrators" to the permissions on the folders it creates.

Pesonally, I pre-create the subfolders for the users because the Folder Redirection CSE disables inheritance on the subfolders it creates (which I consider a Bad Thing^TM). If you pre-create the folders and add "The User / Full Control" to the subfolder the Folder Redirection CSE will be happy and will leave the inheritance hierarchy on your folders intact.

If you want to "repair" the folders you already have you can use something like the icacls utility in a script to clean up the permissions. Assuming the subfolders are all named for the users' samAccountNames you could do something like the following:

FOR /D %%d in (E:\Home Directories\*) DO (
  TAKEOWN /f "E:\Home Directories\%%d" /r /d y 
  ICACLS "E:\Home Directories\%%d" /reset /T 
  ICACLS "E:\Home Directories\%%d" /grant:r "MYDOMAIN\%userDir%":(OI)(CI)F 
  ICACLS "E:\Home Directories\%%d" /setowner "MYDOMAIN\%userDir%" /T 
)

That'll give you a nice, clean inheritance hierarchy again w/ the user specified w/ "Full Control" permission at each subfolder.

Best Answer

Related Solutions

Linux – NTFS and Linux Permissions

Security groups not allowing domain admin to view files

Related Topic