Hi,
We have this scenario (Windows Server 2008 R2 Enterprise):
1) Certain staff are in a local group "BCA Power Admin". This local group is in the local Administrators group, as these staff need full admin access on the server.
2) The Administrators group also contains a mix of other local and domain userids. These are generally IT staff and service accounts for maintenance, backups, etc.
3) Under drive T:\, we have a folder that needs to be locked down, with only those users given explicit access having access. Everything in this folder and below contains sensitive, need-to-know data.
4) For certain sub-folders, we also want to prevent Write access even from the "BCA Power Admin" group (who are of course Administrators). These folders should only be updated by a service account which runs our nightly ETL process. This
is done to prevent those staff from accidentally corrupting data during development. Only production jobs should update these folders.
5) I'm also happy if these sub-folders were locked down from all administrators. However, I don't want the "Click Continue to permanently get access to this folder" to explicitly add their userid the the NTFS permissions for that folder. (This last bit is optional).
I've setup some sample folders. Here are the ACL's:
PS T:\> Get-Item T:\, T:\prod, T:\prod\Folder1, T:\prod\Folder2 | Get-Acl | Format-List Path, AccessToString
Path : Microsoft.PowerShell.Core\FileSystem::T:\
AccessToString : Everyone Allow ReadAndExecute, Synchronize
CREATOR OWNER Allow FullControl
NT AUTHORITY\SYSTEM Allow FullControl
BUILTIN\Administrators Allow FullControl
BUILTIN\Users Allow ReadAndExecute, Synchronize
Path : Microsoft.PowerShell.Core\FileSystem::T:\prod
AccessToString : MYSERVER\BCA Power Admin Allow FullControl
Path : Microsoft.PowerShell.Core\FileSystem::T:\prod\Folder1
AccessToString : MYSERVER\BCA Power Admin Allow FullControl
Path : Microsoft.PowerShell.Core\FileSystem::T:\prod\Folder2
AccessToString : MYSERVER\BCA Power Admin Allow FullControlSo, the default ACL's for T:\ (which I don't want to change) includes Everyone - Read and BUILTIN\Users - Read.
For T:\prod, I've removed all inherited permissions, then explicitly added "BCA Power Admin" - Full Control.
Folders T:\prod\Folder1 & Folder2 inherit from T:\prod.
Questions:
1A) If I login (RDP) with an administrator account, that's not in "BCA Power Admin", I get the "Click Continue to permanently get access to this folder" dialog. How do I prevent that? I believe I need to change the UAC settings? What are the repercussions if I do so?
1B) Ok, one way I've prevented the "Click Continue ..." dialog is to add Administrators to the NTFS permissions. Even Read access prevents the dialog. Again, #5 is optional; perhaps best practice is to add Administrators with Full Control, so IT and backups won't have problems with these folders?
2) But, how do I prevent "BCA Power Admin" having Full Control? Do I need to add an explicit Deny for "BCA Power Admin" for those folders where only the service account should have Write access?
3) Finally, since I've removed BUILTIN\Users, Everyone, etc. from the T:\prod folder, I assume this folder and all sub-folders would be locked down (no access at all) for any users not an Administrator. Is this correct?
Regards,
Scott