2

I have a good one for ya today. Let me give you a quick backstory so you may understand these needs better. We had an employee who was a system administrator at my current company. Since he was a system administrator, he had complete control over everything. Well, he decided he wanted to see what other employee's salaries were, so he gave himself permission to the folder containing everyone's salary in the shared drive. He was caught after an audit, and immediately let go.

My boss did not want this happening any more, so he signed up for a cloud storage service that only himself and HR new the password to. This has worked just fine, but now he wants to cancel the service to avoid paying the monthly cost associated with it.

We are moving everything we own away from local storage servers to SharePoint. An easy solution, if we were still going to use our own storage servers, would be to password encrypt a compressed folder on a share drive, that way only the person who knows the password could access it. Since we are going strictly SharePoint, I need a way to give him an area where he (and HR) can store private documents (like employee salaries), where not even I (system administrator) can access it.

I could create a SharePoint library which only gives him and HR permissions, and then remove my permissions completely from the library. The only problem is, I could theoretically grant myself permission again (as I am the administrator) and view anything I want, so this will not work. Does anybody have an idea of what can be done? Maybe even if there was a sure-fire way to make sure he gets emailed if anyone tries to change their permissions to view that SharePoint library?

Thank You For Your Time.

Improve this question

3 Answers 3

Reset to default
2

He can use onedrive if yall are using office 365. That should be his own personal space. If he wants to share it with HR, he should be able to do so per document.

Also I strongly recommend using Excel and password protecting Excel documents. That's a surefire way of restricting viewing of content that is only given out by the password holder.

Improve this answer
1
  • Although all three answers were great, I think this is going to be the easiest one to implement. I hadn't thought of using onedrive, to be honest. This is going to be the easiest for my boss and HR to understand as well. Cheers!
    – disturbedfuel15
    Commented Jan 18, 2018 at 18:48
3

I would follow your stated procedure of removing yourself from the library. Then advise them to password protect the word/excel files that contain sensitive information. Lastly encourage them to review the web analytics weekly to ensure you did not visit the site. Agree on strict and swift ramification if your name or admin account is found in the top viewers list.

At my employment, this was resolved with me signing a non-disclosure agreement. It is understood that I can view everything, but using or sharing anything I find on our network can have repercussions including termination and criminal proceedings, so I keep my eyes where they belong. I don't even want to know.

Improve this answer
2

This is not an easy task due to the way security options in SharePoint. most of the options we are seeing in this scenario are after the damage has been done.

Here are couple of things you can do:

  • Remove Everybody from that site collection and make your Boss as primary site collection admin, Enable the auditing on the site collection. Get the permission report everyday (write some piece of code for it).
  • Dont let any body add yourself into the Policy of Web application from Central admin or via powershell. if anybody (most probably you SharePoint farm admin) add a user into it, you have to audit it( again write a script which will check the logs and generate report). this is for on prem SharePoint servers.
  • Put strict control on SharePoint farm admin account and other services account's password. because if someone get that password then easily mange the permission. may be use some kind of vault for password. this is also for onprem.
  • SharePoint online, you have to make sure tenants administrator dont do the same thing
  • Use the IRM to protect the document inside the SharePoint. check this article
  • Also use the password for office files.
  • lastly, you can use 3rd party tool to manage the permission and secure document inside SharePoint. check this one https://berkeley.solutions/products/#range

side note: you have to trust your farm admin.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.