I have a client that is wondering if they can mange their own folder permissions on the network and inside I’m screaming “no”, but wanted to ask around to see if anyone has found a way to do this without granting unneeded access to AD and other server resources?
Thanks!
12 Spice ups
Sure - they can have delegated access to manage specific groups. There are also tools like AD Manage that can help with this.
https://www.techveze.com/delegating-the-management-of-group-membership/
tb33t
(TB33T)
3
Maybe just for their own folder. But with great power comes great responsibility.
1 Spice up
I’ve limited an AD group to one user once before and that worked pretty well, but have not had some request to manage folder permissions. Not just create/edit/delete security groups, but also define permissions for individual folders. I guess they would just need to have full control at the root level?
Never open this can of worms…Give the mouse a piece of cheese and he will want a glass of milk.
Shared folders are on file servers and servers should be maintained by Server administrators only.
Unless the user have very valid reasons which both the IP management and top management approves with Server administrators approval, then do proceed with a written confirmation and a written set of rules to the user (like no pirated software, no porn, no non-official matters and no discriminating data). Then certain share rules like backup operators must remain and “deny” must never be used.
As an administrator, you do not answer to the user nor your boss…you answer to the business.
2 Spice ups
If the client is asking to control their own data on their own network…I’m pretty sure you don’t have much of a choice but to allow it, however I would make sure that they understand what they are doing and the potential dangers involved with doing it improperly.
1 Spice up
Can’t you just give them full NTFS permissions on a folder by folder basis? Most folders shared on my network is managed via NTFS permissions rather than sharing permissions, and it’s a fairly flexible and versatile method, particularly when combined with Access-Based Enumeration. I have to admit my user base is much too techno-indifferent to want to learn how to do anything like this, but the benefit is that the user can be a full access or even owner of a folder without having any special rights or privileges to the file server or on AD.
Thing is if the client is paying to you provide support, your only real option is to give them what they’re asking for. However, you would be remiss if you didn’t advise them of the potential hazards of providing that access if they happen to incorrectly apply settings in the system and what it could potentially cost them on the bottom line if they break it.
Thanks all. I could easily make this person have full access over this one share so they could manage subfolders, but my concern was them having to do this with AD access to groups. I can’t imagine having to add 50 names to a folder for new access without a group, but maybe there’s another way?
