3

We have SharePoint 2013 Farm where we have most of the confidential data stored.We are managing the document sharing the with normal business users with proper access management.But as the FARM administrators are having full rights across the farm they can access any document.

So my question is Can we avoid the Farm administrators from accessing confidential data of SharePoint?or there is any auditing process we can place for FARM admins to avoid this access.

Improve this question
1
  • SP Farm administrators have better things to do than read random documents on your site. If yours don't, you need to find different administrators for your farm.
    – Michael McGriff
    Jun 8, 2017 at 14:42

2 Answers 2

Reset to default
3

it is near to impossible to stop them to access the any site in the farm. There are couple of things you can try.

  • Dont add them into the Policy of the Web Application, if Farm admins are not in the policy of Web Application then it is hard to get the site collection with their ID.
  • enable the auditing on the site collection level, so that you know who is accessing the data. this is the best bet.
  • try to monitor the SharePoint auditing logs from server and see if someone try to add into the Policy of web application or site collection admin.
Improve this answer
1
  • Using policies can block admins from accessing data via powershell or content DB directly? And what about backups?
    – ThinkB4Code
    Jun 8, 2017 at 13:59
0

Waqas Sarwar has answered this one well, I will add that you should ask the question of why are you trying to restrict Farm admin access. If you cannot trust your admins then you have other problems that you have to address, anyone with that level of access can always find a way around security blocks, through other domain accounts or other ways.

Improve this answer
1
  • Farm is handled by third party team....so we need to restrict them.
    – Saurabh Jawalekar
    Jun 8, 2017 at 13:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.