Windows Permissions? (multiple admins)

[Nothinman]

but the real challenge is getting third-party developers to create applications that follow the principle of least-privilege.

When you say it, it's MS working with developers to produce better apps, but when I say it I'm asking them to "bow to my obvious brilliance"?

 

[stash]

When you say it, it's MS working with developers to produce better apps, but when I say it I'm asking them to "bow to my obvious brilliance"?

Well I originally thought you were referring to Microsoft developers, now I think you were referring to people who develop for Windows. Either way, I like to take a more diplomatic approach than "they are stupid" 😉

 

[Nothinman]

Either way, I like to take a more diplomatic approach than "they are stupid"

Alright, then how about lazy? It's just really frustrating to have to use some of this so-called "enterprise class" commercial software that could be reproduced with 2 perl scripts and be more reliable and customizable. I absolutely love when software doesn't give you an option to change the installation destination, they just assume that everyone will have a C: and that's where they want to put their software. And it's not just Windows software, we've got our share of commercial unix crap too.

 

[Zugzwang152]

Originally posted by: Nothinman

Either way, I like to take a more diplomatic approach than "they are stupid"

Alright, then how about lazy? It's just really frustrating to have to use some of this so-called "enterprise class" commercial software that could be reproduced with 2 perl scripts and be more reliable and customizable. I absolutely love when software doesn't give you an option to change the installation destination, they just assume that everyone will have a C: and that's where they want to put their software. And it's not just Windows software, we've got our share of commercial unix crap too.

explain to me how being able to create and choose your install partition during the initial install setup doesn't let you do that?

 

[Nothinman]

Explain to me wtf you're talking about?

 

[stash]

I absolutely love when software doesn't give you an option to change the installation destination, they just assume that everyone will have a C: and that's where they want to put their software. And it's not just Windows software, we've got our share of commercial unix crap too

Couldn't agree more. I personally cannot stand when an installer throws icons everywhere, without giving me an option to install without those icons. AIM and MS Money are two examples of this off the top of my head. I really don't need a half-dozen icons to sign up for AOL strewn about my box, or icons to sign up for various banking services.

I think slowly, this is starting to change, but there is a lot of work to be done.

 

[VirtualLarry]

This thread was a fun read. 🙂

Someone wants to implement a security policy, to restrict the access of someone ... that has the authority... to set security policy. *scratches head*. Kind of circular, isn't it? Reminds me of those old black & white "Spy vs. Spy" comics in MAD Magazine. "Admin vs. Admin", indeed.

 

[Apathetic]

In a single domain, there is NOTHING you can do to prevent someone from accessing a specific share on a server once they have Domain Admin privileges. All you can do is slow them down or prevent them from accidentally accessing the files in question.

You're only effective solution is to set up a second domain and make sure your second admin is not part of the domain admin group of the box/boxes in question. That will stop him dead.

Oh, as several others pointed out in this thread, don't rely on share premissions. Set the actual permissions on the files and directories in question. That way, no matter how I get to them I am forced to deal with the permissions on the files themselves.

Dave