Stopping admin accounts accessing another's documents

dmex said:

You can remove the Administrators Group from always being able to take ownership of objects via the Local Security Policy

That's a good trick, and funny, but if the other Admin is smart enough he can also edit the Local Security Policy.

I wonder if, besides using a Power User, there is a way to solve this using built-in encryption? I know EFS was a pretty weak system but have there been any improvements to this in Win7?

sup3rsprt said:

That's a good trick, and funny, but if the other Admin is smart enough he can also edit the Local Security Policy.

If you take ownership of mmc.exe and gpedit.msc then set the security to prevent access, other admins would be unable to edit policy's

I wonder if, besides using a Power User, there is a way to solve this using built-in encryption? I know EFS was a pretty weak system but have there been any improvements to this in Win7?

Unless an Admin configures a recovery key, other users cant access EFS protected files. I would keep regular backups of your EFS key encase your password is reset since it will also erase your EFS key as a security measure

Steven

Unfortunately I don't think EFS will protect the files from being deleted, unless of course something has changed in Windows 7.

Bear in mind that the folder you are trying to protect must have been created by the user who is trying to secure and own it; ie, if root creates it, then fred tries to secure it, he cannot.