An executive at the company I work for has asked me to set the permissions on a specific network folder so only they can access it. I don't usually do this, but in this case I need advice on the best practice for this?
I was thinking along these lines:
Thoughts?
Thanks.
You're on the right track for the most part, though I disagree about the Domain Admins.
Since you mention best practice, I'll start off with stating that you should only use security groups in assigning permissions and privileges, even if there is only one member in the security group. Think role based rather than individual user based. In a smaller organization this is less important...but best practices and all.
Administrators might mean local, Domain Admins, Enterprise, or whatever is applicable to your environment...
In most cases, it would be appropriate to break inheritance as you suggest and grant access only to the user/group needing access and SYSTEM. Depending on the content and environment, many admins would also leave Administrators. The user(s) should be informed that they can lock themselves out, etc. since they are the sole owner, etc.
Special consideration should be given to backup and restore. Should this directory/share be backed up? Does your backup protect ACLs on backup/restore? Does your backup solution use the SeBackupPrivilege, which allows backups in spite of ACLs (most do, but some simple ones do not)? Security should be maintained not only in production, but through backup and restore also... This is particularly important in an environment under regulatory compliance such as SOX, HIPAA, or PCI.
Keep in mind that as an Administrator you can change ownership of the file or directory object and then change permissions to fix anything if need be. This is why Administrators is often removed from the ACL. This is generally appropriate because such activity would be logged or audited. If you only gain access by changing ownership you can't be accused of accessing sensitive data without proof ;-)
