1

In Sharepoint 2013, I want to avoid that users could download or copy the full content of a library or a site he has access. The goal is to avoid that before leaving the compagny an employee download all documents he has access before working for a competitor.

I've investigated IRM to keep the document only valid within our domain and it works. However, it can't be apply to document which are due to be sent outside our organisation (supplier) and where, by definition, IRM can't be applied.

Finally, I'm ok if a user 'steal' 40 documents but not ok if he steal 1000.

Does it exists somekind of a webpart that would dynamically use the log files and block the account if he reach 150 documents / hours.

Or maybe another solution to reach my goal ?

3
  • It is like giving someone a key to your offices and then wanting to restrict they can only carry 40 items out of the building..you can only put up hurdles... Let them sign a contract, no need for an IT solution. Nov 24, 2015 at 20:50
  • That's what we are doing now but in china and several other countries contract has no meaning. If i had to choose an image of what I want, I would rather take the image of the library were I can come as often as I want but only borrow 5 books at a time.
    – Vincent
    Nov 25, 2015 at 8:11
  • Then you have to build a Librarian on top of SharePoint Your biggest challenge will be to control the WebDAV connection any user with Read rights can make... Your Librarian will also have to frisk everyone All the time..(I did once steal a book from a library...) Nov 25, 2015 at 9:06

1 Answer 1

0

I found a way to answer my question. The solution is to write a little VB.NET software to parse IIS log on a regular basis. If the number of request for one user exceed a certain amount within a time frame. It means that user is stealing files. Then the user name is added to a group which is prevented to access to the web server via the authorisation configuration of IIS.

I've also secured my file in another way. I'm not using IRM anymore but since most of the files are 'for information' and people are just reading them. I just prevented them to download them. I wrote a URL rewirte rules within IIS which drops any GET request ending with "NoDwl" for files type of .pdf .doc or .xls. Each library that I want to protect has been rename to ....NoDwl in is URI.

Of course I had to block a few other pages (Download.aspx) but that works pretty well. I also had to create I bypass via the user Agent (just in case) and also a way to control the "Open In explorer"

For those we need here is the code and a picture of the rules

enter image description here

   <rewrite>
        <rules>
            <clear />
            <rule name="ByPassAllOtherRulesIfNotInDesignCenter" enabled="true" patternSyntax="Wildcard" stopProcessing="true">
                <match url="*wet/DC*" negate="true" />
                <conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
                <action type="None" />
            </rule>
            <rule name="ByPassAllOtherRulesIfAgentIDIsDesignCenter" enabled="true" patternSyntax="Wildcard" stopProcessing="true">
                <match url="*" />
                <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
                    <add input="{HTTP_USER_AGENT}" pattern="DesignCenter" />
                </conditions>
                <action type="None" />
            </rule>
            <rule name="BlockDownloadAspxPage" enabled="true" patternSyntax="Wildcard" stopProcessing="true">
                <match url="*" />
                <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
                    <add input="{QUERY_STRING}" matchType="Pattern" pattern="*SourceUrl=*NoDwl*&amp;FldUrl=&amp;Source=*" ignoreCase="true" negate="false" />
                </conditions>
                <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You do not have permission to view this directory or page using the credentials that you supplied." />
            </rule>
            <rule name="BlockOpenViaExplorer" patternSyntax="Wildcard" stopProcessing="true">
                <match url="*" />
                <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
                    <add input="{HTTP_USER_AGENT}" pattern="*WebDav*" />
                </conditions>
                <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You do not have permission to view this directory or page using the credentials that you supplied." />
            </rule>
            <rule name="AllowSomeEditionViaExplorer" enabled="false" patternSyntax="Wildcard" stopProcessing="true">
                <match url="*" />
                <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
                    <add input="{REQUEST_METHOD}" pattern="GET" negate="true" />
                </conditions>
                <action type="None" />
            </rule>
            <rule name="BlockFileTypes" enabled="true" patternSyntax="Wildcard" stopProcessing="true">
                <match url="*NoDwl*" />
                <conditions logicalGrouping="MatchAny" trackAllCaptures="false">
                    <add input="{URL}" pattern="*.pdf" />
                    <add input="{URL}" pattern="*.doc" />
                    <add input="{URL}" pattern="*.docx" />
                    <add input="{URL}" pattern="*.docm" />
                    <add input="{URL}" pattern="*.dot" />
                    <add input="{URL}" pattern="*.dotx" />
                    <add input="{URL}" pattern="*.xls" />
                    <add input="{URL}" pattern="*.xlsm" />
                    <add input="{URL}" pattern="*.xlb" />
                    <add input="{URL}" pattern="*.xlt" />
                    <add input="{URL}" pattern="*.ppt" />
                    <add input="{URL}" pattern="*.pptx" />
                    <add input="{URL}" pattern="*.pot" />
                    <add input="{URL}" pattern="*.potx" />
                </conditions>
                <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You do not have permission to view this directory or page using the credentials that you supplied." />
            </rule>
        </rules>
    </rewrite>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.