Here is the problem encountered at my company:

  • We have set of very disorganized files on a Microsoft Sharepoint server
  • I have one person going through and reorganizing everything. In terms of permissions, this requires (a) read access and (b) access to move files
  • I would like to minimize the risk that that person working on this, with those permissions, could download my files locally (and, for example, distribute files to my competitors).

The solutions I see:

  • Limit permissions on the Sharepoint, but from what I see there isn’t a combination of pre-set permissions that accomplishes what I want.
  • Have person work in a virtual machine with the following settings: (a) Blocking all internet other than the Sharepoint web-site. (b) Keeping the password saved in the virtual machine instance (rather than giving it to the worker, who could then login from their own computer), (c) One connects to the virtual machine via remote desktop. I understand there is a feature where you can use that to connect the storage of the virtual machine as a networked drive on one’s local machine. This would serve as another workaround.

I’d appreciate if you could look into this and see if you can figure out a way to solve the problem I’ve outlined above, either by fixing the issues with the solutions I’ve suggested below or identifying an alternate workflow.


1 Answer 1


My general suspicion is that your desires are mutually exclusive. Effectively, you are trying to give someone access to your data while also not giving them access to your data.

If the data is so sensitive that someone could use this opportunity to steal your data and potentially sink your business, then I think there is really only one option: do it yourself. Or find someone you really trust. I mean, here is a basic flaw in your system:

  1. User opens up file marked "TOP SECRET CLASSIFIED DO NOT SHARE" in your virtual machine
  2. User takes a screenshot from their computer
  3. User shares your top secret data

That's just the first thought that I have off the top of my head. I'm sure that if the person you put in charge of this really wants to steal your stuff, they will find a way. You can't simultaneously give someone access to your data and not give them access to your data.

  1. Do it yourself.
  2. Find someone you trust.
  3. Have someone local do it and watch them the whole time

I don't really think you have any other options.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .