Stopping admin accounts accessing another's documents

Hi, I have two administrator accounts setup, but they can access each other's documents (C:\Users\Example). I tried removing all but the owner in the security tab, but administrators can take ownership this way somehow, anyone know what I can do (besides making them non-administrator accounts)

yohan said:

Hi, I have two administrator accounts setup, but they can access each other's documents (C:\Users\Example). I tried removing all but the owner in the security tab, but administrators can take ownership this way somehow, anyone know what I can do (besides making them non-administrator accounts)

Hi Yohan,

You can remove the Administrators Group from always being able to take ownership of objects via the Local Security Policy

If you remove all users and groups from this setting then no one can universally take ownership of anything if they don't already have the permission for that file or folder

Just to be safe leave at least one account or group here so they can always take ownership of any object encase you accidentally get locked out of your own files



Hope it helps.

Steven

DarkNovaGundam said:

Correct me if I am wrong (which I likely am) but wouldn't creating a password for those two admin accounts prevent them from accessing each other without the other ones password?

Users in the administrative group can always take ownership of anything regardless of what user or permission they have set for that file or folder, it all depends on this local Sec policy setting as to what group has unrestricted security access

DarkNovaGundam said:

Well at least I tried. That kind of defeats the purpose of a password doesn't it though?

Also.. OMG we have the same name! lol had to say it.

Administrators are Administrators, they can just reset your password if they like (you can remove that privilege for admins via group policy too)

Hope it helps Steven

Steven

Thanks for your help, but it seems after setting the "Policy take-owner ability" to user "Bob", user "Dave" can still access Bob's area, after giving UAC permission to do so. After he does this, in the share tab, Bob is still owner, but Dave is now there, and has "Read/Write" access. How can I stop this?

Thanks so far by the way Steven & Steven.

The point of Administrators is to have full access. If you don't want full access, make each other power users.

happinessiseasy said:

The point of Administrators is to have full access. If you don't want full access, make each other power users.

I don't think Power Users exist anymore.

Edit:

I'm wrong.

This works.

yohan said:

I don't think Power Users exist anymore.

Edit:

I'm wrong.

This works.

Your welcome

Steven