I am an IT auditor for an internal audit department. Our company uses Active
Directory with Winows 2000 and 2003 servers and XP Pro workstations.
Currently our IT support personnel have admin access to servers and
workstations. My question is: Is there a way to allow the IT support
personnel to do their job while restricting access to user data? The IT
support
people need to apply upgrades, install software, etc. We want to allow them
to do this but restrict their access to user data in the Docs & Settings
folder on the workstations, user directories on the servers, etc. Currently
the IT support people have admin rights on the workstations. Can they do
their job as a Limited user with proper permissions?

I know this is a long post but i would appreciate any help.

Thanks.
--
wweldin

--
wweldin

Re: Internal Audit question by Phillip

Phillip
Thu Sep 22 12:20:30 CDT 2005

"WWII" <WWII@discussions.microsoft.com> wrote in message
news:989C9D23-0F18-4F7F-BAEC-7323F4C61459@microsoft.com...
> I am an IT auditor for an internal audit department. Our company uses
Active
> Directory with Winows 2000 and 2003 servers and XP Pro workstations.
> Currently our IT support personnel have admin access to servers and
> workstations. My question is: Is there a way to allow the IT support
> personnel to do their job while restricting access to user data? The IT
> support
> people need to apply upgrades, install software, etc. We want to allow
them
> to do this but restrict their access to user data in the Docs & Settings

Not possible. Thay have to be, at a minimum, Local Administrators to
install software,...it is not posssible to restrict those Administrator
Level accounts in the way you are asking. You can limit them to Local
Administrators (as oppoed to Domain Administrators) by creating a new Group
in AD adding them to that group and then adding that Group to all the Local
Administrators Group on the workstations.

Technology is never going to be the answer to all security issues,...you
have to hire employees you can trust. Doing good background checks on new
employees will go much farther toward security then trying to fannagle a
computer's OS into doing something it isn't designed to do.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/techinfo/Guidance/2004.asp
http://www.microsoft.com/isaserver/techinfo/Guidance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp
-----------------------------------------------------




Re: Internal Audit question by Steven

Steven
Thu Sep 22 12:28:30 CDT 2005

They probably need to be local administrators though installation of Windows
security updates can be automated and software installation can be automated
via Group Policy Software Installation for .msi applications that use
Windows Installer. For Windows XP computers users can be added to the
network configuration operators group to allow a user to change networking
and tcp/ip settings without being local administrators.

It is difficult to prevent an administrator from accessing any data on the
computer they are an administrator on. Even if they do not have the proper
ntfs permissions they can always take ownership of a folder to give
themselves the necessary permissions. To avoid that from being easily
detected they could use backup and restore to access the data which would
avoid detection unless auditing had been configured so that the backup and
restore would show in the security log but then an administrator can also
clear the security logs.

The only way to make sure that they do not access files that they should not
is to encrypt the files and enforce the use of strong/complex passwords in
the domain and disable storage of lm hashes on domain computers so that a
local administrator [legitimate or not] is not successful in cracking the
users password. Windows XP Pro workstations can use EFS to encrypt files.
EFS is something that should not be done however without thorough planning
and education of the users and a domain Recovery Agent must be configured.
That would allow "domain" administrators to recover a domain users data and
to prevent a local administrator from configuring his account to be the
local Recovery Agent in order to access EFS files on that computer. There is
no need to make support staff for domain computers to be domain level
administrators. Domain level administrators should never logon to a domain
workstation with their domain administrator credentials other than known
secure admin workstations due to risks of keyboards loggers and such. See
the links below if you are interested in using EFS. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;EN-US;223316
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/default.mspx

"WWII" <WWII@discussions.microsoft.com> wrote in message
news:989C9D23-0F18-4F7F-BAEC-7323F4C61459@microsoft.com...
>I am an IT auditor for an internal audit department. Our company uses
>Active
> Directory with Winows 2000 and 2003 servers and XP Pro workstations.
> Currently our IT support personnel have admin access to servers and
> workstations. My question is: Is there a way to allow the IT support
> personnel to do their job while restricting access to user data? The IT
> support
> people need to apply upgrades, install software, etc. We want to allow
> them
> to do this but restrict their access to user data in the Docs & Settings
> folder on the workstations, user directories on the servers, etc.
> Currently
> the IT support people have admin rights on the workstations. Can they do
> their job as a Limited user with proper permissions?
>
> I know this is a long post but i would appreciate any help.
>
> Thanks.
> --
> wweldin
>
> --
> wweldin



Re: Internal Audit question by Byron

Byron
Fri Sep 23 21:27:53 CDT 2005

> I am an IT auditor for an internal audit department. Our company uses
> Active Directory with Winows 2000 and 2003 servers and XP Pro
> workstations. Currently our IT support personnel have admin access to
> servers and workstations. My question is: Is there a way to allow
> the IT support personnel to do their job while restricting access to
> user data? The IT support people need to apply upgrades, install
> software, etc. We want to allow them to do this but restrict their
> access to user data in the Docs & Settings folder on the workstations,
> user directories on the servers, etc. Currently the IT support people
> have admin rights on the workstations. Can they do their job as a
> Limited user with proper permissions?
>

One alternative is to store the sensitive information on a share on a file
server, and secure (ACL) the directories appropriately. That way, the user(s)
who own the sensitive information could be granted access, while the helpdesk
people would not.

The server administrators would likely be able to gain access to the sensitive
information, so if the workstation admins and the server admins are the same
people, then the best option is to hire trustworthy administrators.

- Byron Hynes
Windows Server
Microsof