Permissions Problem

[LittleFishy]

The company I work for has two sites (1 domain controller at each site) with about 6 domain admins. We have a number of sensitive directories that we want to allow only specific users access to along with the admin account and only one of the domain admins access to it. The idea is to prevent other domain admins gaining access to that folder and to force any changes of the permissions to be made physically on the server and not through terminal servers etc. Help, how do I do it and is the domain admins account going to overrule what ever permissions I set up?

 

[aftertaf]

you disable permission inheritance, and add both users to the folder NTFS permissions list... or better still, add both accounts to a new security group and give rights to this new group.

You cannot stop the other domain admins from taking possession of these files however, in order to change permissions...
being domain admins, they can have and grant themselves all the keys.

alternatively, create a security group and add all the domain admins you dont want to have rights, and give them the deny permissions...
that way they will be explicitly refused access.

Aftertaf
__________________
squiggle squiggle