NTFS Permission restrict copy

  • Thread starter Thread starter Sascha
  • Start date Start date
S

Sascha

Is there a way with NTFS permissions to allow users to
have execute permissions to a file but restrict the
ability to copy the files they are accessing to their
local workstation? For example, a database file
containing accounting information is located on a Windows
2000 file server. Accounting users are trusted to have
full access to this database file, which includes
inventory information and payroll information. Sales users
need access to the same database file, however they must
not be allowed to copy the file to their local computers
to gain access to sensitive payroll information. Within
the accounting application itself you can restrict what
access user have to specific areas of accounting
information. However, if a user can copy the file to
their local computer, these restrictions can be removed.
The ideal scenario is one where all users have read write
execute permissions to the database file, but simply
cannot copy the file off the server to their local
workstation. Is it possible to secure the data using NTFS
permission or is a third party tool needed for this?
 
The ideal scenario is one where all users have read write
execute permissions to the database file, but simply
cannot copy the file off the server to their local
workstation. Is it possible to secure the data using NTFS
permission or is a third party tool needed for this?
Click to expand...

Fundamentally, at a file system level, if the user can read the file
they can get at the bytes it contains, so they could create a local
copy.

Are there other ways to solve the problem? Could you secure the
clients? Or use a different database? Or proxy the untrusted access,
eg through a web front end, or create separate database files?
 
One of the options we may have to entertain for this is to
use Terminal Server to run the accounting application. I
can then configure a GPO to restrict the ability to browse
via Windows explorer. It is strange to think that MS
operating systems do not have this fundamental ability
though, as I can see need to keep files on a network share
and not allow users to copy to local workstations in other
scenarios as well.
 
Back
Top