Even if file permissions are set on a document, other domain administrators will still have full access to that document. The same goes for Group Policy Objects (GPO) in Active Directory. GPOs can be set to restrict access to objects, like documents, to a fairly high degree of granularity. But, again, that won't stop a domain administrator.
There are a few workarounds. One option might be something old-fashioned: put confidential documents on a separate network or on a workstation. Another possibility is to create a separate group for the other three administrators that doesn't have full administrative rights. These users would have to use either "sudo" for Linux or "runas" for Windows. These commands restrict administrative access for particular users for particular functions.
Again, for only four domain administrators, your options are limited, and the best course might be just to keep your confidential documents off the network on an isolated workstation.
For more information:
Dig Deeper on Data security strategies and governance
Related Q&A from Joel Dubin
Learn about the purpose of CAPTCHA challenges that enable websites to differentiate bots from authentic users to stop spammers from hijacking forums ... Continue Reading
Proper planning is at the top of the list for single sign-on best practices, but it's important to get enterprise SSO implementations off to a good ... Continue Reading
After a server room door has been compromised, finding a more secure solution is of utmost importance. Learn how to choose a server room door that ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.