How do you handle concerns from HR & Accounting about Domain Admin rights?

Posted by dan-theman@reddit | sysadmin | View on Reddit | 308 comments

I work at a small company where the owner was previously the entire IT team. Our HR/Accounting people are concerned about giving me Domain Admin rights because I would then technically have access to all the secure employee private information and company financials and they aren’t sure how to handle the legality. How do other companies handle this? Do Admins have to sign NDAs or something? I worked at my previous job for 10+ years and don’t remember what I may have signed when I started.

Reply to Post

Reply

308 Comments

[-]

Hyperbolic_Mess@reddit

There's usually a computer use policy that you sign so that if you do anything untoward then you're on the hook. If HR & accounting can be trusted with accessing this data then so can IT.

Reply

[-]

dan-theman@reddit (OP)

HR and Accounting is a single person here. There is a Computer Use policy in the Employee Handbook but most of that document is just copy pasta and I didn’t have it sign anything.

Reply

[-]

lordjedi@reddit

> HR and Accounting is a single person here. LOL. That's not a problem waiting to happen. Seriously, this alone could cause them some SERIOUS legal problems. If anything, they need to outsource their HR to an agency. > There is a Computer Use policy in the Employee Handbook but most of that document is just copy pasta and I didn’t have it sign anything. This is another liability problem waiting to happen. If you didn't have to sign anything, then you can't be held responsible for breaking any of the policies. > but most of that document is just copy pasta This is the biggest problem with small businesses. They just grab stuff from online and don't even bother reading it. Most of the stuff you find online even says "this should be used as a guide, it's not a one size fits all policy".

Reply

[-]

Melodic_Duck1406@reddit

I would suggest keeping legal advice to r/legaladvice. You totally can be liable for not following policy without having signed anything. It just has to say, probably in the job description, that following policy and policy changes is part of the job. And if in the uk, the contract is assumed even If not signed from day one, until you've had a decent chance to read it. (for the first three month I think). It would be difficult to argue you hadn't read a job description.

Reply

[-]

lordjedi@reddit

> I would suggest keeping legal advice to r/legaladvice. Sure, but something as obvious as having your accounting people doing HR work is incredibly stupid. Both sets of laws are incredibly complex. No one from either dept should be trying to do the other. I wouldn't ask a EE to do marketing work and this is no different. Except there's a lot more legal ramifications to screwing it up. > It just has to say, probably in the job description, that following policy and policy changes is part of the job. I don't think I've seen a single job description that referred to "following all company policies". At least in California, that's usually left in the Employee handbook with a page for the employee to sign. It's possible that they're there and I just haven't noticed them, but most job descriptions refer to what you'll be doing on the job. I've heard of companies that did not make employees sign the agreement. California is a pretty liberal state. Unless you do something malicious, the policy isn't going to hold up if you haven't signed it. This is also why HR needs to do their duty and make sure everything necessary is filled out.

Reply

[-]

dekyos@reddit

in addition to the other replies on this comment, I'd like to add that Domain Admin doesn't have to mean carte blanche access to all the stuff. You can mark folders to not be readable by domain admins (make sure you have a global admin account or a generic Administrator account in classic AD domains). Go over the design with HR, show them how you can "break the glass" to get in if needed, but that in everyday use you will be restricted, and that there is an audit trail if you get in there. In my organization I can't get into any of the non-public sharepoints besides the IT one. It's like 3 clicks for me to give myself access to those, but there's an audit trail when that happens. This way I technically have the access I need to do my job, but the transparency is there to satisfy the company's confidentiality needs.

Reply

[-]

Got2InfoSec4MoneyLOL@reddit

Seems they dont like competition.

Reply

[-]

meest@reddit

Sounds like HR needs to update their policies to account for the changes. Like others have said. This is something that is covered in the Acceptable use policy for us. If HR is worried about it they can write up an admin right policy as well and have you sign it. If they're worried about it, they already have some concerns/bullet points they can put into the document by the sounds of it.

Reply

[-]

lordjedi@reddit

They can (and should) also turn all logging way up. That way they can see everything that people are looking at. Even if they don't look at it, they can store the logs so that they can always go back and look at things when necessary.

Reply

[-]

lonewanderer812@reddit

Exactly. The use policies should state that even if you have access to things, you only view them if you need them to do your job. Abuse of that would qualify for termination. There may need to be a separate admin one like you said if it makes them feel better. I've had to sign a separate policy before when I started at a company that dealt with HIPAA data and I had access to that information. Never had to view any of it for my job obviously, but I had access to the data.

Reply

[-]

skimfl925@reddit

Look for or have them develop an IT Ethical Use Policy. This is what most larger corporations have.

Reply

[-]

randomuser135443@reddit

Sounds like HR and accounting may be up to something

Reply

[-]

mkosmo@reddit

> If HR & accounting can be trusted with accessing this data then so can IT. It's not about trust, it's about need to know.

Reply

[-]

dasbullett@reddit

@OP doesn't need to "know", as such, but they do need to have access to fulfill their role. If HR is uncomfortable with this, like others have said it should be managed via policy and a signed agreement.

Reply

[-]

mkosmo@reddit

I'm not saying the access isn't necessary to do the job, just pointing out that trust of a party has nothing to do with it. Need to know and job duties are what dictate what you should and shouldn't have access to. Even a sysadmin shouldn't be daily driving credentials with that access. Privileged accounts are for privileged actions, not checking email.

Reply

[-]

Hyperbolic_Mess@reddit

Yes obviously don't be logging in with your admin account unless you need to but here HR are objecting to OP ever being able to log in as admin so that's not really the issue at hand. They currently don't trust OP to be given that level of access at all

Reply

[-]

mkosmo@reddit

And is it such a bad thing they're raising an objection to protect their data? I wish more users would do this. HR isn't the final say, so in the end it may not matter, but a *desire* to protect data (even if misguided) is a good thing we should encourage.

Reply

[-]

Hyperbolic_Mess@reddit

Kind of although it just seems like they don't know what they're doing which is a bit of a concern, this is a very common "problem" that isn't an issue for most organisations

Reply

[-]

mkosmo@reddit

Why would you expect them to understand the implications of the admin-in-the-sky account, or why such privileges are necessary for the job? It's not their area of expertise.

Reply

[-]

Hyperbolic_Mess@reddit

Because I'd assume that storing data on computers and having people manage that is a somewhat common arrangement for accountants and HR people that have been working at any point in the last 20 years. If they don't know about this then why can't the head of the company/head of IT be consulted? They should know and understand what a domain admin account is and be able to explain the impact and risks. This is a non problem that shouldn't need input from OP

Reply

[-]

mkosmo@reddit

You're looking at this through the lens of an IT guy... step back and look at it as if you were anybody else.

Reply

[-]

Hyperbolic_Mess@reddit

But the head of the company is an IT guy apparently

Reply

[-]

mkosmo@reddit

So they think. But what's that have to do with the HR guy's concerns? Not everybody inherits the knowledge of another.

Reply

[-]

Hyperbolic_Mess@reddit

It's 2 people and one of them is the boss of OP and the boss of the second person (aka the HR person). They don't need to inherit any knowledge

Reply

[-]

jacls0608@reddit

Exactly. When hiring IT part of your due dilligence is making sure the people you hire for important roles like IT are trustworthy. Being able to access global admin is important for a sysadmin and even sometimes support staff. Some places make it more complicated than others but you'll likely see this stuff in your day to day anyway.

Reply

[-]

notes_of_nothing@reddit

If a company doesnt trust the SysAdmin enough to do their own job, find another. You cant do your job effectively without that level of access. If they dont like it they can hire an MSP and give domain admin to some random guy, thatll be better /s

Reply

[-]

TK-CL1PPY@reddit

This is it. Yes, IT needs to be trusted. But trust and verify. Auditing of access is key. IT almost has ZERO reason to see things like company financials or employee SSNs.

Reply

[-]

UCFknight2016@reddit

wrong, If IT cant access that data nobody else can

Reply

[-]

thortgot@reddit

You need access to SSNs? Why? You need to see HR files? Of course not. Are you running your backup tools as your own user?

Reply

[-]

UCFknight2016@reddit

HR pretty much has me on their speed dial to fix their file issues. Most of my requests are $user cant access the $employeefoldershare so I am always fixing permissions because we have everything locked down tight. These folders have sensitive info but its not like I am just sitting there reading through this data.

Reply

[-]

thortgot@reddit

Why do you need access to the share to give someone access? Surely you just add them to the correct group. The real solution is to secure the documents (Purview, IRM etc.) so you can't access them anyway. Your role's ability to read the data means that it will happen at some point, whether or not you will not is irrelevant.

Reply

[-]

UCFknight2016@reddit

Because not all shares use security groups. Sometimes only one or two people have access to a folder. Sometimes only access to a file is needed. We are trying to move away from this as it take up way too much of our time. If you know of a solution let me know.

Reply

[-]

Sparcrypt@reddit

> If you know of a solution let me know. At least in the interm, replace every per user permission with a group one. Even if you're making groups with single users in them. It makes management a LOT easier. Say for example someone leaves and you need to replace them, you can copy their account permissions and things will just work.

Reply

[-]

UCFknight2016@reddit

Right now we have a lot of files with just the SID of the deleted user.

Reply

[-]

Sparcrypt@reddit

Ouch. Another good policy to implement is never delete a user! Just disable them so you have a history of them/their actions. I know that doesn't help with the old ones but yeah, it really helps to avoid such situations down the line.

Reply

[-]

UCFknight2016@reddit

They get deleted after 6 months

Reply

[-]

ABlankwindow@reddit

This doesn't scale up though. will work for a small organization with low turn over but a big organization or any size but with high turn over the disabled users will quickly stack up to the point they are wayyyyy more annoying than helpful.

Reply

[-]

Sparcrypt@reddit

Yeah but if you're at that level just move them to their own OU so they're out of the way. Either create one for all, or make a "Disabled" OU in each user OU you currently have.

Reply

[-]

hoboninja@reddit

I'm not sure how many groups they have, but my last job we had issues with AD token size getting too large and users not being able to log in anymore because they needed access to so many different folders and the groups for permission they had set up were very granular...

Reply

[-]

Sparcrypt@reddit

That's a little nuts. You can increase it but still...

Reply

[-]

Sparcrypt@reddit

> Why do you need access to the share to give someone access? Surely you just add them to the correct group. Which means I have access to the share, if indirectly, because I control access to that group. Not to mention that if something goes wrong and I'm fixing it, I need access to test it. I just don't read it. It's part of the job and same as it is for HR etc. They aren't special people or whatever, they sign confidentiality agreements and policies to not access things they don't need to or discuss them with others. If I can't be trusted to do the same I'll work elsewhere. I require access to do my job, give me access or I'll do it elsewhere.

Reply

[-]

thortgot@reddit

You have the ability to grant yourself access to arbitrary mailboxes does that mean you have access to all email? No, you have the ability to grant yourself access. There is a significant difference. It's audited and logged when you do that. The principal of least privilege applies to IT the same as it does to everyone else. If you don't have a need to read a file, you shouldn't have access to it.

Reply

[-]

Sparcrypt@reddit

> There is a significant difference. Not from a data security point of view there isn't. > It's audited and logged when you do that. It *can* be, just like all actions on all accounts can be audited and logged all the time. And they should, nobody is disputing that. Nothing you are saying is wrong but you are failing entirely when it comes to applying it to the situation being discussed. Of course I don't run around with full privileges to everything. But I have global admin/god accounts for every single service I maintain **because it is necessary that I do**. If I need to manage a domain, I need the appropriate account privileges. This does not mean I expect my day to day account to be a domain admin, this isn't 2005. It also doesn't mean my access to everything should not be logged, it should. You're acting as if I'm saying "I need unfettered, unrestricted, untraceable access to everything to do my job!". Like.. I don't see anyone saying that. I need accounts with the required permissions to do as needed and justified **and** I need the trust of the company to access anything needed to do my job. This can include HR files, this can include other peoples mailboxes, this can include anything! 99.999% of the time the most I'd ever need to do is open said files or mailbox and verify that they work or whatever but that's irrelevant - I require that access. Log and audit as much as you like. It absolutely should be done like that and if I open files in HR you can and should come and ask me why (to which you'll get "check ticket xxxxx where I documented all my actions because I'm not an idiot").

Reply

[-]

dasbullett@reddit

Let's presume not, but they still need enough privileges to grant the backup user access. Which logically means they can grant their own user account that same access, too.

Reply

[-]

shouldbeworkingbutn0@reddit

It's pretty easy to set up access policies that only give access to specific departments and deny access for admin-users included.

Reply

[-]

Chemical-Historian38@reddit

I agree BUT, I'm expected, as the sysadmin, to support the accounts package and therefore, I regularly see financials, that's why I signed an NDA

Reply

[-]

jcpham@reddit

We don’t share SSNs obviously but the entire company meets monthly to review the goals and financials or an abbreviated version of it. TPS reports drive the business geeez

Reply

[-]

CoolNefariousness668@reddit

If you could get me those TPS reports as soon as possible that would be great.

Reply

[-]

dekyos@reddit

Part of CYA is **don't** let them give you access to anything sensitive like that WITHOUT an audit trail. If someone gets their identity stolen, a leak happens, or whatever, I don't want anyone to falsely accuse me because I happen to be in the group that can access that information.

Reply

[-]

Plantatious@reddit

What's hilarious is at my old job, just before I left, HR just gave up caring and when I received requests for new users, she would forward me the sheet she would get, which contained a lot of PIIs I didn't need to see. I emailed her and told them we only need X, y and z, we don't want to see nor handle the other data they're forwarding. They did it anyway because "what's the big deal". They also had a few unreported GDPR breaches going on which I documented, but where never reported by the data protection officer. Makes me shiver at the thought if I stuck around and we got audited.

Reply

[-]

Schly@reddit

Exactly this. As an IT Professional. Trust is number one. And there have been a few cases where my integrity was called into question and logs proved that I never accessed any information without explicit permission and/or prior notification to the appropriate leaders. In one case, another employee was promptly fired when they looked at logs and found that it wasn’t me.

Reply

[-]

anm767@reddit

> IT almost has ZERO reason to see things Until they delete a file, you mount a backup, and have no rights to access that file.

Reply

[-]

thortgot@reddit

A well designed system can segment the availability of data away from sysadmins. Back in the early 2000's we didn't have these options but today you don't need trust anyone, including yourself to act ethically. Per user file and email encryption (Purview, IRM etc.) solves this problems quite easily. Could the sysadmin impersonate a user? Yes. But the admin has to set the password to something else, leaving an audit record and knowledge of compromise to the user since the password has changed without their knowledge. Could they keylog the password? Yes but if your EDR doesn't pick up keyloggers you don't care about security and you'd have to bypass MFA which should set off a series of alarm bells. Designing your systems to be resilient to insider attack is an important component of modern cybersecurity.

Reply

[-]

illarionds@reddit

What's the point of any of that though, really? If you can't trust your sysadmin, you're fucked, simple as that.

Reply

[-]

thortgot@reddit

I disagree. I've been burned before by a rogue admin relatively early on in my career who had DA. Ever since then I build systems with the assumption that every DA (and myself) are a security risk. You can't make it 100% but you can absolutely make it very resistant to compromise.

Reply

[-]

illarionds@reddit

I think it depends massively on org size and sophistication. In my case, I'm literally the only one in the company who knows anything whatsoever about any of this stuff. Not that I have the time anyway, but I could theoretically design a system as you say - but only I would have the knowledge to read the audit trail, understand the alerts, etc etc. Hell, if any other user actually paid attention to an alert, it would only be to forward it to me! And crucially, if I *were* a bad actor (I'm not!), I could dismantle or bypass any system that I built. At some level, *someone* has to have the keys to the kingdom, as it were - and that would be me.

Reply

[-]

thortgot@reddit

I suppose. SMBs with a single admin don't have the same security requirements.

Reply

[-]

sirbzb@reddit

I think I would phrase that differently, laws and risks are essentially the same. The difference is that each individual in a small business inevitably covers multiple roles. The problem that causes is that technical and physical security tends to be role based and so are highly vulnerable to collusion/conspiracy between roles. So not having enough individuals to divide roles across is not the same as having a lesser security requirement. It is just a lesser ability to implement best practice since that has been designed around a larger number of individuals being available. Which then gets scary since by count most businesses are small.

Reply

[-]

illarionds@reddit

>I suppose. SMBs with a single admin don't have the same security requirements. Indeed. But (it very much sounds like) that's the situation OP is in.

Reply

[-]

mobz84@reddit

We are talking about a one sysadm and a small Company here without even dedicated HR. And who is going to implement everything if not the only sysadm? With what security permissions is he going to do that?

Reply

[-]

thortgot@reddit

If they have Business Premium, they can easily introduce Purview ( [Apply encryption using sensitivity labels - Microsoft Purview (compliance) | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/compliance/encryption-sensitivity-labels?view=o365-worldwide) ) to restrict access to files based on group labels. And email encryption ( [Email encryption in Microsoft 365 - Microsoft Purview (compliance) | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/compliance/email-encryption?view=o365-worldwide) ) that protects those documents from the admin. You can implement the security systems that lock yourself out. Even with complete knowledge of the security systems that I put in place, I can't bypass them without tripping pile of alarms.

Reply

[-]

mobz84@reddit

And then you setup warnings if someone makes any changes of the security settings? This will help you with file access, but what do you do about databases, where for example personal information usually are stored. Yes you can lock yourself out, and make it air tight, but there has to be some middle ground. If you can not trust your only sysadm who are you going to trust? Who will have access to setup edr? Password for disable it, when testing why Adobe does not work? Sure you can make it so it is in a safe, who have access? Wait for the ceo? One file will not open for user x, she should have permission, do you have an account that has access to all files? Where, in the safe? This is a simple matter of nda, and that you are only to access what you have to, to do your job. Security, is needed and should be in place where it makes sence. But there is a thing of too much.

Reply

[-]

thortgot@reddit

Databases have a pretty easy solution, the encryption password is owned by multiple parties. The easiest way to do this (and I've been doing it since 2001) is to have 2 or more people actually sit down at the keyboard and enter a component of the password. Then A, B, C etc. all write down their element and store it securely (safety deposit boxes etc.). That way the DB isn't accessible without a copy of each of the parts. EDR can be deployed by a single person, it is quite obvious to the end user when it is disabled. Sentinel1, Defender for Endpoint and others I'm sure, all can't whitelist a keylogger. I know, I've tested it. If your EDR can't handle Adobe, you should probably get a better one. A domain admin can give themselves file access to any file but IRM or Purview encryption means they can't open it unless they are accessing as the correct user. So accessing that file only the CEO can open? Yes you need them to open it. That's the whole point. The same as if you needed to troubleshoot something in their profile. Trusting no-one is the goal because it gives you the admin the knowledge that you can't have accessed that file and you aren't relying on your good graces to prove that. NDAs in private business are largely unenforceable in most cases outside of a very narrow range.

Reply

[-]

lefthanded_engineer@reddit

so much this, wtf kind of crazy am i reading.

Reply

[-]

geegol@reddit

+1 for mentioning hiring an MSP. Let the company have a nightmare.

Reply

[-]

Rare_Pizza_743@reddit

> If they dont like it they can hire an MSP and give domain admin to some random guy, thatll be better /s Or, call me crazy, the MSP can just hire OP, pay him 10% more, and charge the company 250% more, to get the same services.

Reply

[-]

sometechloser@reddit

What uh... where would you get started on this so called extensive auditing?  I'm also an 'almost' one man shop

Reply

[-]

obviouslybait@reddit

There is software that audits AD/file accesses etc.

Reply

[-]

davidm2232@reddit

Very easy to bypass that by just reading the data from backups, especially the offline backups

Reply

[-]

Sparcrypt@reddit

How did you access the offline backups though? That should also be audited.

Reply

[-]

obviouslybait@reddit

The backups can be audited as well

Reply

[-]

illarionds@reddit

Speaking as a one man IT department myself - I would be amazed if there is budget for much of anything, much less the kind of solution I think you're referring to.

Reply

[-]

davidm2232@reddit

Exactly

Reply

[-]

davidm2232@reddit

How? Offline backups are just on magnetic tape.

Reply

[-]

Skusci@reddit

Generally speaking you would hand them to a third party to be easy. Otherwise various encryption schemes can work. Hardware based so the hardware can enforce the auditing, or say multi key encryption so you need like 2 out of 6 people or whatever to recover. If you are at the point where infrastructure is so borked you need to be digging into the archives a little inconvenience is a fairly minor problem.

Reply

[-]

alainchiasson@reddit

Yes you CAN bypass it, but if you do there must be an unalterable, auditable record of it. There are two reasons for this: - If there is an unlawful access to data, IT can trace it - if there is unlawful access to data, you can prove its not YOU. Blame and CYA !! A 24.

Reply

[-]

SpecificOk7021@reddit

I am a one man shop, and need to develop an internal auditing process 😂

Reply

[-]

lost_signal@reddit

Some audit standards require immutable logging sent to a 3rd party but there are limits of what that can catch when admin can disable logs

Reply

[-]

notes_of_nothing@reddit

If you disable the logs, that should be logged though. I see your point, at the end of the day it requires trusting your employee because you are right, there is no perfect solution.

Reply

[-]

lost_signal@reddit

It’s not uncommon in solo IT shops to also have an MSP who has a relationship with the owner directly as well as the IT people and exists more on a peer level in co-management. This prevents issues with the IT person finding a new job and the biz unable to hire and train a replacement in 2 weeks

Reply

[-]

Zaphod1620@reddit

You can't even back up anything without at least an account with read access to *everything*.

Reply

[-]

vrtigo1@reddit

>Thats like saying the CFO cant see the companys financials or access the company bank accounts Not exactly, since the CFO is expected to use that data to effectively do their job, whereas a sysadmin should have access to everything, but shouldn't ever look at anything unless they have a specific reason to do so.

Reply

[-]

notes_of_nothing@reddit

I never said anything about using the data, I specifically said accessing it.

Reply

[-]

woodsbw@reddit

The answer to this nearly everywhere is, "you trust your admins." Especially in a "one man show" kind of environment. The counterpoint to that trust is that you get insta-fired if you get caught breaking it. In a large environment, you can do some things with separation of duties, immutable audit logs, etc. But, in a one man environment, the person who would have to implement those and pull data from them is....you. Which makes the whole thing moot.

Reply

[-]

dan-theman@reddit (OP)

That was my thought. I can setup auditing but then I would also have access to modify those audit reports so it defeats the purpose.

Reply

[-]

HYRHDF3332@reddit

I got into that at my last job and had to explain separation of duties and what it would take to achieve that with a one man IT show.

Reply

[-]

Silent331@reddit

Pretty much, they are at some point going to have to assume the guy assigning permissions, has defacto god permissions and is thus acting in good faith.

Reply

[-]

mobz84@reddit

How are you doing your Job now? You ask the owner to enter the password if you need to create a group policy? Or did he give you create permissions for that (example)?

Reply

[-]

HYRHDF3332@reddit

They hired an HR director at my last job who wanted to encrypt everything in her folder with a password only she, the ED, and a board member knew. I warned them that if the they lost that password, there would be nothing I could do to get their data back. They acknowledged that and I told them to put a hard copy of the password in a safe, just in case, and they did that. I was about a month later that one of them changed the password, didn't tell the others, didn't update the hard copy in the safe, then promptly forgot it. Whoops...

Reply

[-]

perthguppy@reddit

From a technical perspective, you want all systems reporting all event and audit logs into a Siem system that can’t have records deleted from. Then you’d just point at that should anyone suspect anyone’s acted improperly.

Reply

[-]

210Matt@reddit

Accounting should have accounting software with its own permission set that you would not have admin access to. If you need to do admin stuff then you would coordinate with them. HR the same thing. There will be some files that are held outside that they will just have to trust you with. You already have access to their email so you can see confidential stuff if you wanted.  If they are really concerned then there is a bunch of SaaS options in the cloud they could look at.

Reply

[-]

1z1z2x2x3c3c4v4v@reddit

> Do Admins have to sign NDAs or something? Sometimes, yes. Problem solved.

Reply

[-]

barneyrubble43@reddit

We simply get anyone who has elevated rights to sign an agreement that if they are found to have accessed confidential information they will be dismissed.

Reply

[-]

IxI_DUCK_IxI@reddit

NDA for sure. It should be in the onboarding papers. There’s also a level of accepted risk for the job you need to do. They can lock you out of whatever apps they want. But then you can’t help them when it breaks. So if they have an SME who will take care of the app while you maintain the server (patching, disk space, etc) this is more than ok. There isn’t a cookie cutter answer to your question. Orgs work in security layers with segregation of duties to specific teams or SMEs. Depends how they want to roll. They can, and should, lock unauthorized users from accessing payroll, HR systems, etc and leave you and your team to manage the infrastructure while being locked out of the App (or using it as a standard user who need to update their 401K or address information if you move). NDA and Code of Business Conduct are forms you should be signing on your first day when you join the company. It’s standard practice and there should be some boilerplates online they can use and run past their legal team. Best answer to your question: you manage the infrastructure their apps run on, not their apps. If they want you to do it all, you need access to do it

Reply

[-]

Beanzii@reddit

I work at an MSP, have access to the keys to the kingdom for dozens of companies... Being in IT means being trusted with all the confidential stuff, if they cant trust you with the data you will never have the access to keep the data protected, backed up, etc

Reply

[-]

jas75249@reddit

My feeling is accounting and HR should not have domain admin rights nor should have any say in who should either.

Reply

[-]

jnkangel@reddit

Generally speaking there’s two layers - layer 1 - the sysadmin has a specific account that they log in with to work on any privileged information and the usage is logged and tracked - layer 2 - the person who may get into contact with privileged information needs to sign privileged information handling clauses and receive some sort of training in regards to it

Reply

[-]

TheMagecite@reddit

IT in able to help everything needs access to everything. It is actually a good separation of powers in quite a lot of instances. Say for example the people who post transactions aren't admin users and so on.  I mean the downside is obvious but you have to trust someone.

Reply

[-]

jwalker107@reddit

What did HR / Accounting sign, in order to get access to confidential employee data, themselves? Sign that thing. I've been working in much larger organizations for thirty years now. Along with elevated privileges, comes signing additional agreements (and additional yearly trainings, to be fair). Protecting PII, Trade Secrets, Export Compliance, Insider Trading, ITAR... all sorts of things that aren't issues in my day-to-day, but are necessary because of things I *could* do with my privileges.

Reply

[-]

dan-theman@reddit (OP)

Probably nothing, the single HR/accounting person has been working here since the company started.

Reply

[-]

jwalker107@reddit

I suggest you give a listing of these kinds of trainings & agreements to your HR and ask them to consider which apply to your business areas. Add on HIPPA (even if you don't do medical things you'll need to know the rules of dealing with employee medical insurance) and PCI-DSS if you take credit card payments.

Reply

[-]

realityking89@reddit

Unless you work for a covered entity\[0\] or you have a contractual obligation trough a vendor or customer, HIPAA does not apply. It specifically does not apply to employers who are not otherwise covered entities\[1\]. It‘s a common misconception that HIPAA applies to all health care data. 0:[https://privacyruleandresearch.nih.gov/pr\_06.asp#:\~:text=Covered%20entities%20are%20defined%20in,which%20HHS%20has%20adopted%20standards](https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Covered%20entities%20are%20defined%20in,which%20HHS%20has%20adopted%20standards) 1:[https://www.hhs.gov/hipaa/for-individuals/employers-health-information-workplace/index.html](https://www.hhs.gov/hipaa/for-individuals/employers-health-information-workplace/index.html)

Reply

[-]

jwalker107@reddit

Oof. Developing that kind of policy ... kinda sounds like an HR function, actually.

Reply

[-]

pertymoose@reddit

"Okay, you run the domain then."

Reply

[-]

HandyGold75@reddit

IT, me and one other person have domain admin, no one else does, we manage it, period. We both signed NDA's and make sure it's managed properly with internal audits from a select set of people from differing departments.

Reply

[-]

ShiningSquirrel@reddit

We just flat out told or HR and the finance people, domain admins have full access to EVERYTHING, it's required for the job. If they do not trust us with domain admin rights as the domain admins, then we should not be working for them at all.

Reply

[-]

dcdiagfix@reddit

That’s just not correct, domain admins do not require access to everything. Never have and never will.

Reply

[-]

ShiningSquirrel@reddit

LOL, if you say so but I would really like to see you do the job without access to all files and folders, backups should be fun!

Reply

[-]

dcdiagfix@reddit

It’s not if I say so, it’s literally the correct way to do it, implementing a proper tier model is core to any security model. Any organisation to IT professional worthy their salt know they there is no way or need that domain admin rights are required to manage a file, print or application server.

Reply

[-]

Skusci@reddit

But how did you give your tier 1 account permission to manage the server. With your tier 0 domain account. Someone has to have the keys to give others the keys.

Reply

[-]

dcdiagfix@reddit

Via gpo on a domain controller logged on a domain admin is not the same as logging onto a lower tier asset with a domain admin account adding an account to the local admin group.

Reply

[-]

Skusci@reddit

Yeah that second is bad. Completely missed the point of tiering if you let your Domain admins log onto workstations. But the point is tiering protects against propagation of credentials from an external threat. It doesn't protect against your Tier 0 deciding that today is a good day implement a proper 1-2-3 + the hard drive in his pocket backup strategy.

Reply

[-]

ShiningSquirrel@reddit

Who Said they were? If you have access to the domain admin account, you literally have access to everything in the domain, anyone who has worked in IT knows this. It does not matter what account you log in with, just the fact you know the admin login and password gives you access to everything or the ability to grant yourself access. So are you trying to say the domain admin account cannot gain access? or having access to the domain admin credentials does not give you that same access? I don’t use the domain admin account, I use a regular user account with a few extra permissions, but I know the domain admin accounts credentials. Just the fact I know that, which I do require to perform my job functions means I could gain access to everything so if they do not trust me being able to access anything at will, I would not be working there, it’s that simple.

Reply

[-]

Peace-D@reddit

Yup, NDAs here as well as strict policies about confidentiality. Every new employee has to read and sign them. Us IT admins of course COULD look into everything, but we don't. This is the codex. Plus, everything we might encounter during troubleshooting stays private.

Reply

[-]

welcome2devnull@reddit

If your job is handling the IT, you are responsible for backup too. Had the same issue long time ago where the HR department wanted that nobody from IT has access to their file-server share, i just asked the HR manager if he takes over the responsibility for every permanent data-loss in case anybody in his department deletes a file and we cannot recover due to missing backups - you can't imagine how fast we were officially allowed to have permission ;)

Reply

[-]

Verukins@reddit

HR are weird like that.... they think that people want to look at their data.... when most people just want to avoid dealing with HR at all costs. anyhoo... there is no "standard", but there are two avenues that I most commonly see/have implemented: 1) Create a share with appropriate permissions for HR. Enable file auditing - and give them access to the file audit logs (or some places purchase a tool that allows HR to view these logs). You may also wish to use SCOM (or similar) to alert if/when someone is added or removed from the "HR" groups. The key here (along with the issue) is transparently giving them control... the issue is, they are not IT people, so will screw stuff up. This unfortunately also comes with the option of explaining to them that if you don't have access, you cannot support them. They will say "yes" and the first time something goes wrong, try to crucify you for it - because that's how people in HR work - so if you do go down this path, make sure you get it in writing. To get around this, you need to agree on a framework for support purposes, where you will be granted access on an as-needs basis for support. 2) As other have suggested, the non-technical route of legal paperwork/NDA's etc. As someone that works across a range of industries, including defence, both are used... but auditing of access (and alerts on that auditing) and JIT elevation for admin access are the key components here. Given your company size, the tools may be out of range for your budget - google "windows file auditing and alerting" and you will find a number of options - which will enable you to put forward a costed suggestion.

Reply

[-]

phoenixlives65@reddit

No NDA. Honestly, if you don't trust me, hire someone you do. That said, all departmental data - sensitive or otherwise - is in departmental folders with access assigned based on job requirements. Access is logged, so even if Administrator were to do something, there would be a record of it.

Reply

[-]

RaidZ3ro@reddit

It is not just a matter of trust. But there is a solution. Simply explain how everything that is being done through that account gets logged and is therefore auditable. Also, all activities on systems containing that sensitive data should be logged, including their activities.

Reply

[-]

NoyzMaker@reddit

Acceptable use policy and domain admin is a separate account with strong audit controls to track the rare times I should be using it. 99% of my work should be on my standard account that doesn't have regular access to that data. That being said did they sign an NDA to have access to the same material? Typically it should be the same agreements the financial team would sign since they would see the same data and pose just as much a risk as you.

Reply

[-]

DarKuntu@reddit

It is like hiring a truck driver but don't give the driver a truck, because he could drive away with the goods he should deliver... stupid

Reply

[-]

geegol@reddit

Love this

Reply

[-]

geegol@reddit

Well tell them as an IT admin you need to have admin rights (not one as a daily driver obviously). But remember “with great power comes great responsibility”. When I started working at MSP, they made us sign NDAs in order to get admin rights on accounts that we created for the entire company to use. Note only one account per machine or one domain admin account per domain per client unless more are approved by an approver in the clients company. Not going to lie here is what I would do in your situation: do everything you can without the rights and when something comes up that requires admin rights assign it to HR and if they ask you why you assigned the task to HR, explain to them that you don’t have the rights to perform the task. Sooner or later they should give you an admin account. Remember (and everyone here already knows this but I’m going to state it anyway) never use an admin account as a daily driver. Only elevate when needed. I would also have a meeting between your manager and HR if possible about this.

Reply

[-]

Bodycount9@reddit

If we access any data we should not be accessing, an alert email is generated to the IT director. So he knows if we are looking at things we shouldn't be looking at. He setup the alert system. And it works. We even tested it.

Reply

[-]

TCIE@reddit

My director just gives EVERY it employee domain admin so they can "manage the domain" even though we all use the administrator account with a shared password to sign in.

Reply

[-]

lordjedi@reddit

ROFL takes a deep breath ROFL NDA or not aside, are they expecting you to manage AD without Domain Admin rights? They need to have at least one (preferably two, one is a backup) people to manage the thing. They either trust you or they don't. The NDA is irrelevant to having Domain Admin. NDAs are usually given to people to protect trade secrets, not for managing the domain. If you steal something, you can still be held legally accountable for it, whether you had Domain Admin or not.

Reply

[-]

h8br33der85@reddit

I always sign an NDA and/or an agreement of sorts. Basically saying I understand what I will have access to, I will not misuse my access, I understand I will be fired if I do, and I understand I will be sued and will accept all legal and financial responsibility.

Reply

[-]

h8br33der85@reddit

I do whatever my boss tells me to do and, most importantly, I GET IT IN WRITING. No matter what, get it in writing. Once I have it in writing? I do whatever my boss tells me to do.

Reply

[-]

bad_syntax@reddit

Funny, I've been a domain admin/global admin since, well, I started in IT like in 97. Minus a single 6 month stint at the worst company I ever worked for where they didn't let you be an admin for the first 6 months (so i sat on my ass, occasionally hacking their security to fix things as nobody else there knew how to do anything, but damn the place was full of beautiful women). Not once have I had any desire whatsoever to go look at that kinda stuff. Nor have I ever signed an NDA or anything like that. You \*have\* to be a domain admin to do your job, and sorry, but domain admins \*can\* access \*everything\*. To put their mind at ease, you can take their file shares and add rights so you can't access it without taking control. Doing so would at least let them know you did it, and kinda hold you accountable, though there are ways around that (they may not know them). You could implement a PAM solution that tracked and logged all your sessions as a domain admin (your regular user account shouldn't be a DA anyway). That may put them at ease, as they can audit what you can do. But at the core, they have to trust you, because you are literally their technology god. I can make a typo, and 14,000 people tomorrow flip out that their email doesn't work or all their domain accounts got deleted. I could, though I would never, ruin any company I've ever worked for quite easily, even backups. Therefore you \*MUST\* trust IT, more than you trust even HR or accounting. Without that trust, you don't want to be there. Heck, I was given domain admin rights to billion dollar companies as a consultant on day 1 without question. This isn't even something that should be debated, you get DA, they accept it, full stop.

Reply

[-]

sregor0280@reddit

i mean... tell them you can not do your job at least without an admin account (leaving your account as least privileged) and if they want to tie your hands like that then they shouldnt have an IT person.

Reply

[-]

Rare_Pizza_743@reddit

Firstly yes, you should sign NDA's. Secondly there should be logging anyways with someone else having the ability to review those logs, along with logs of you deleting logs. This effectively makes it where someone is always watching someone else. Think of it like a casino, everyone is watching everyone, doesn't matter who you are there is someone tasked with watching you to make sure you aren't trying to cheat or steal from anyone, this goes from the casino owner to the players, n one is exempt.

Reply

[-]

fixITman1911@reddit

I signed an NDA/Confidentiality agreement when I transitioned into the IT department at my company. I am half of a two man team who covers everything, so of course we have access to... everything... Ethics of our position dictate that we wouldn't abuse our power, but people outside the IT world tend to prefer that legal cover.

Reply

[-]

davsank@reddit

AFAIK NDA does not cover personal information but rather Trade secrets and such, so that might not apply at all.  However, in almost every company I worked for there was a document that I had to sign which was as legally binding as a NDA which explained that due to my access to various pieces of information and some might be Personal Information about other employees, I'm prohibited to share that information unless I'm presented with a court order bla bla bla.. AFAIK that's the only way they have to legally do this. Another way, don't save personnel information as DOCX documents on your FS - there are several specially designed HR & Accounting programs (some are even SAAS) in the wild that will do that for you, eliminating the risk of an IT guy being a source of a leak.

Reply

[-]

mrmugabi@reddit

Surprised no one suggested having them come to your desk and enter the domain admin creds every time you need to do any 'domain admin' work! That NDA will materialize really quickly!

Reply

[-]

Effective_Peanut_730@reddit

Just give HR something you can't access. Like a trucrypt drive only they have access to.

Reply

[-]

PaulRicoeurJr@reddit

They have it backwards, we do not have the right to access to the information in the files, we have access to manage the files. If HR & Finance is concerned about access to said data, they can protect data with passwords or they can request data/file encryption. I've been asked this question before and told them exactly that. I also told them that we have separate accounts if we need to manage the files and that file access is audited.

Reply

[-]

Humble-Pop-3775@reddit

In every company I’ve worked at, it’s just a given that once you’re an IT admin, you have the keys to the kingdom. If you break trust, then you’re out.

Reply

[-]

GhostPartical@reddit

Identity Access Management here. Domain Admin accounts are for Domain purposes and shouldn't have any actual access to applications that has secured information. Other than saved data in a file system Domain accounts shouldn't even be apart of any access to really anything other than Domain activities and purposes. My company doesn't do any NDAs for access to domain accounts. But our Domain accounts are highly restricted and all actions of those accounts are logged. I could understand needing a NDA if their domain accounts have access to everything in the environment, but that goes against basic security practices and should be mitigated at some point if that is the case. How do you handle your situation, tell them their security practices for domain accounts are extremely bad if you need to sign a NDA because of the access it has in the environment.

Reply

[-]

furiouspotato24@reddit

I'm not sure of any legal precedents that apply, but there is a certain amount of access that is inherent in a job. There is also an expectation of discretion inherent in your job. Some companies won't make a HR person sign an NDA because a responsibility to protect the personal information of employees is literally in the job description. Some of that same thing applies to IT. If you need access to something to do your job, no court would hold a company responsible for giving you that access. On the flip side of that, as an IT person, it's your responsibility to protect your company's information (digital and otherwise) just by nature of the job. All of that being said, it can make things a lot easier on everyone involved to have paperwork that puts those expectations in writing. I have worked for both types. Some that don't have you sign anything and a couple that did. If they want an example they can just Google "IT employee confidentiality agreement" or something like that.

Reply

[-]

kagato87@reddit

Legality of it? What? You're the administrator. You have the keys to the kingdom. Just like the janitor. The company needs to trust you to hold those keys. That's it. Protecting company secrets and PII is implicit in our role, but if they want an nda then sure, go for it. Some require it, many do not. Sometimes the hris and accounting systems are completely separate or with an extra layer of passwords (the accounting data password, for example, is almost never known by IT). They'd be able to sue you for disclosing privileged information anyway so the nda really would be just to make them feel better about it. So to answer your question, turn it around on HR. "This is about trust, not the law. What would be required for you to trust me with this kind of access? An NDA, while redundant, is an easy way to help remind everyone of my obligations to keep information confidential." Often times just saying you're cool with an nda is enough for them to realize they're over thinking things. The unspoken bit is "if you can't trust me then the owner will have to be IT forever then. I'll go find work at another company that isn't going to buckle under an owner with misdirected priorities."

Reply

[-]

1nspectorMamba@reddit

Thats funny, we just went through an audit and had to remove such access from Finance and HR, and make sure ONLY IT had that access.

Reply

[-]

bigfoot_76@reddit

Just as always, HR is trying to solve a HR problem with IT. Set a policy, make you sign it. If you violate it, get shitcanned. It's like this at any other corporation size 1-1,000,000 employees.

Reply

[-]

mattshwink@reddit

I agree with a lot of what has been said here. So for me NDAs have been standard. The organization usually has an IT use policy which covers data protection, records retention, and disclosure. Rarer still (but should be done more) is privileged user acceptable use and policies. Generally agree with they're going to need to trust their admin. That being said, you should lay out for them what you need to do with domain admin, how you plan to protect authenticators, and how privileged access will be audited. You should not be logging in regularly with domain admin, only when you need to do a function that requires it. I've run into this mentality with HR and Finance (though in a larger org). Usually don't have the heart to tell them that there are multiple ways for me to get access even if they don't explicitly grant it. On a Win 10 upgrade/deployment which also rolled out O365 had several HR users tell us they weren't allowed to store things in the cloud and didn't want us migrating any of their data to OneDrive, as it was "sensitive", so they stored it on their desktops. I had to inform them (and the HR Director) that this violated the Acceptable Use Policy and the Records Management Policy. And then tell the IT Director what they were doing.

Reply

[-]

Sefflaw@reddit

We have a SuperUser agreement that must be signed before granted elevated rights. That is essentially the NDA. Big company btw (2000+ IT)

Reply

[-]

Dafoxx1@reddit

Limiting access right to those sensitive files. IT typically doesn't need domain administrator rights to do their job. Auditing and reporting can help ease those worries as well. I suppose its dependent on the roles and responsibilities they would assign to IT. For administratoring AD and the likes, delegating access and lower roles have access to these. I assume someone would be over you and they could have those domain rights. As far as the companies ive worked at. I have always had domain rights or had an elevated account to do my job. There was only one time I questioned my access which I felt was unwarrented. I access the an accounting share to troubelshoot user permissions and was spoken to about it. If Im unable to be trusted in my role then it isnt the place for me. Not saying everyone in IT is to be trusted, but there are proceedures to deal with sensitive data.

Reply

[-]

daven1985@reddit

Firstly I remind them they hired me to manage the system. Then I setup rules that if someone either deletes the rule or accesses content like user data or Sharepoint sites that are secure it alerts key people. That way if you have a valid reason for the access you can show it, and if you don't your screwed.

Reply

[-]

Site_Efficient@reddit

Is your role to reset passwords? Then you can already assume anyone's access. The real answer is that you walk them through this logic: 1. Only people with a legitimate business purpose should have access 2. Managing the systems and granting access is a legitimate business purpose 3. The best use of the CEO's time is not granting access to folders, so who do they suggest manages the IT systems?

Reply

[-]

thortgot@reddit

The difference is there is a record of you changing the password and the user will notice that the password isn't the same one that they set.

Reply

[-]

Site_Efficient@reddit

Larry from Legal forgot his password again; it happens at least once a quarter. It's not like a small business is calling the forensic investigators to find the log of the password reset, nor are they likely to have the tooling to search for it easily. The point is that you either trust your administrator to not do dodgy stuff like reset Larry's password, in which case they need the access. Or you don't trust your administrator, in which case you have a big problem.

Reply

[-]

thortgot@reddit

If you reset a credential on request, there is a log of that request. If you reset it for yourself to take access for yourself there is a pair of password changes instead of one. It's trivial to use Netwrix or any other audit tool to look for this and alerting multiple parties including outside of IT is the standard practice. Admins can dodgy stuff the same as everyone else. Trust but verify.

Reply

[-]

Site_Efficient@reddit

I think we're drifting from the context of the question now. My point is that the IT administrator has a legitimate business purpose to administrate those folders, and through nefarious actions could likely take control of them already. The context is that the CEO is the lone IT guy until now. Chances that he deployed tooling to audit his own actions is nil, and that context is important. How do you recommend "trust but verify" should work in the context of the question? Are you saying OP's highest priority should be to deploy auditing tools?

Reply

[-]

serverhorror@reddit

That's usually part of the standard contract work for admins. There's no separate NDA or agreement for specifically elevated permissions but only attachment and training (with a digital signature) that you will not do stupid stuff. For smaller orgs a dedicated agreement might be a good starting point. You can't do your job without the technical permissions. Just like HR.

Reply

[-]

netsysllc@reddit

An NDA is reasonable. Bit the brutal reality is if they dont trust you move on

Reply

[-]

percenseo@reddit

To give insight, I used to be the sole IT admin for a local police service. There was a fairly lengthy NDA that follows me to this day.

Reply

[-]

Patchewski@reddit

It just is. Here are no legal concerns other than the fact that you’re an employee of the company. What does the org do? They hire someone with the commensurate combination of education, experience, skill, and knowledge or as close as they can. Then they get out of the way and let their chosen admin - well - administer. NDA? No, nothing like that, and for what, exactly? Employer holds all the cards if there is direct actionable evidence of impropriety on your part.

Reply

[-]

Jonkinch@reddit

I’ve had this issue before too. They were shocked one time when they realized I had access and I’m like “How do you think I fix the issues you call about with the accounting software and maintain it?” The one I fought for for a while and gave up because I knew it was a matter of time… They wouldn’t give me a key to the server room lol. Fucking thing went down one weekend and I couldn’t get in. So come Monday people were pissed and couldn’t access the server till HR came in at 10am… Within an hour they brought me a master key to the whole building and the owner chewed HR out about why they wouldn’t give me an obvious tool needed for my job.

Reply

[-]

emmjaybeeyoukay@reddit

Firstly its a matter of trust. Your HR & Finance teams at the most senior level should trust you to not go rummaging around. Secondly audits; you should ensure that auditable access logs are being generated and that HR & Finance Directors or a senior manager have access to those logs to ensure that what you access is being logged. Call Management / Ticketing. For all work, but especially those relating to file access within HR & Finance areas there should be a ticket created by the member of the team that spells out what is requested and what your actions were. i.e *We need the previous copy on <date/time> of file <foldername / filename> restored overwriting the existing file.* This way you have proof on file of what tasking you are requested to action that ties to the auditable logs that exist showing you accessing restricted data.

Reply

[-]

Geech6@reddit

I'm not a Domain Admin but I have access to everything except the domain controllers and ITSEC servers (I mean everything). The only thing I signed is the document saying I work there and they will pay me. I have access to the payroll servers and the pay drive because I need to give access to those systems. Accounting specifically is handled by a different division which works in another state with their own IT guy. (20,000 person company for reference)

Reply

[-]

mspax@reddit

Auditing and logging. They should be able to track what you're logging into as long as you have named credentials. Make the system as transparent as reasonably possible.

Reply

[-]

JudgeCastle@reddit

I had this access in both my last and current org. They know that IT comes with the power of being “all knowing”. I didn’t sign any paperwork outside of the basics. Ultimately it is known that I want to know as little as possible and that I am to only go into sensitive , non-critical files that don’t directly affect my job, with the permission of HR/Accounting. Meaning, if HR asks me to find missing W4 for John Doe, I explain what I will have to do to find/restore it, and they consent me to do it. If they don’t consent me to do it then the buck stops there. I’ve told them I have no interest in snooping in files as I have more interesting and important things to do. Potentially adding software to keep a log of what files are opened and by what account could be useful if they ever want to question you. Hope that helps.

Reply

[-]

kenhk117@reddit

We have a boilerplate Acceptable Use policy. We also have monitoring in place for logging file access. So if someone is abusing admin they will get it with naughty stick.

Reply

[-]

Squid_At_Work@reddit

From a business safety standpoint, this is what makes admins so dangerous. Companies should have an acceptable use policy. Any administrator who is a professional knows how to be content unaware when working. HR/Accounting/Sales etc may not like it but the administrators over they systems they use are in a more privileged/trusted position than they are.

Reply

[-]

Skusci@reddit

It very very much depends if there are legal requirements. For HIPAA for example there is a legal requirement and standard. Start here: https://csrc.nist.gov/publications/detail/sp/800-66/rev-1/final It's gonna suck. For others like ITAR or just general sensitive info like financials without a legal requirement to confirm to a standard it's do whatever you want. You want a handshake and a pinky promise not to dig through stuff that's fine. At minimum though you should have clear policies on what you are/are not allowed to do with whatever info you have access to so you can claim due diligence if things go south. If you want to claim compliance to actual standards like AS9100 or CMMC 2.0 or whatever for either publicity, or because you are required to by a client contract, well then you are gonna be doing a lot of paperwork and infrastructure changes. Policy and auditing requirements are going to be part of that.

Reply

[-]

ImightHaveMissed@reddit

If you’ve done it right domain admin and enterprise admin won’t have access to anything. It’s possible to deny access to “sensitive data” via a group policy

Reply

[-]

Oktober@reddit

Either they trust you to do your job or they don't. If you're a sole admin it doesn't make a ton of sense to implement role based access, but I'd still run separate day-to-day and admin accounts, but that's more for security than anything else.

Reply

[-]

Zatetics@reddit

HR doesnt get to decide who gets domain admin. Is it needed for the job? If yes, its awarded and that person is onboarded into IT. If no, the request is rejected. If HR wants to block a domain admin provision where it is required for the job, simply dont do that portion of the job. The business has accepted that they will hire an employee and not give them the tools or permissions to complete a portion of the job and thats fine.

Reply

[-]

IdleWanderlust@reddit

This is the correct answer.

Reply

[-]

vectravl400@reddit

We signed confidentiality agreements and looked trustworthy enough I guess. That and don't abuse the power.

Reply

[-]

UCFknight2016@reddit

Here is how I treat it: You can give me access to everything and the systems will run smoothly, but if you try to block my access to certain things, I can't guarantee the security or integrity of those systems and I will not take responsibility. Something happens like you accidently delete that folder or a server gets hacked, you are on your own since I didn't have responsibly over that. I work at a medium sized company. I have full access to almost all systems minus a few that are handled by a 3rd party, but I also have access to all data. I therefore had to sign an NDA and the company trusts me to do what I need to do in order to keep everything running. I have access to HR, customer and financial data but my job usually is to make sure only the people who need it can get into it. With that being said, the domain admin account should be a "break glass" kind of account in case you get hacked. Keep that thing away from your daily regular old sysadmin account.

Reply

[-]

vabello@reddit

I have a domain admin account, but in no way does it give me access to our HR or Accounting Systems which have their own account management not tied to the domain. I have no account in those and no way to leverage my domain admin rights to add myself.

Reply

[-]

mexicanpunisher619@reddit

There's not a single universal approach, but many organizations implement various measures to address these kinds of concerns. I'm work for a publicly traded company so our approach is very complex, therefore, here are some common ways companies I've worked for handle such situations: 1. **Non-Disclosure Agreements (NDAs)**: These are used widely and you might indeed be asked to sign an NDA. An NDA is a legal contract that would prohibit you from sharing any confidential information you come across in your work. 2. **Limited Access/Principle of Least Privilege**: Some organizations restrict admin access to sensitive information unless it's necessary for a specific task. This principle suggests that a user should be given the minimum levels of access necessary to complete their job functions. 3. **Segregation of Duties**: In this case, responsibilities are divided among multiple roles to ensure no single individual has too much control or access. 4. **Monitoring & Auditing**: Admin activity is often tracked and audited regularly. This serves as a deterrent for misuse of access rights and helps to detect any potential breaches. 5. **Training & Policies**: Companies often have policies and training in place to emphasize the importance of data privacy and secure handling of information. 6. **Access Control Software**: There are software solutions that can grant temporary elevated privileges, which automatically expire after a certain period of time or when the specific task is complete. 7. **Encryption**: In some cases, sensitive data may be encrypted in such a way that even a system admin cannot access the plaintext information without an additional key. I think if you specifically implement approach #4, you are basically giving assurances to the department questioning your access that you will access such data only when asked properly; Ticketing system or proper approval channels...

Reply

[-]

TrippTrappTrinn@reddit

DA for a global enterprise. Never digned anything to get DA sccess. HR does not even know what it is. The company actually have to trust their employres.

Reply

[-]

Khulod@reddit

I don't know where you are OP, but where I am in Europe theft of private information, intellectual property and company secrets is covered by various laws so a seperate agreement with the company is not required. Just because you gave theoretical access to more of the above doesn't change your position in that regard from any other employee.

Reply

[-]

anachronic@reddit

In general, if you can't prevent something (like domain admin access to sensitive data), next best thing is usually to monitor & detect it, and then have the security team (or HR... or anyone who isn't YOU) follow-up on any anomalies if/when the data is actually accessed.

Reply

[-]

cmgrayson@reddit

Everyone signed an NDA upon hire. There were areas that even domain admins didn’t have (Managing Director salaries, the bonus list, etc). It’s not hard.

Reply

[-]

zodiac200213@reddit

Uncle Ben said it best. "With great power comes great responsibility" I feel like it is known by both management and the IT staff. You don't go snooping around and looking at stuff you shouldn't. Management should trust you on this and you should trust that they trust you. The company I have worked at for 10 years knows I have access to everything but also knows I need that to do my job. They trust that I am not snooping through their files or reading their emails. Which I am not. Once trust is gone it is very hard to get back. Trust takes forever to build but seconds to destroy.

Reply

[-]

sparkyflashy@reddit

Maintaining confidential information and the trust of the company is part of my job description.

Reply

[-]

Turbulent-Pea-8826@reddit

We remove domain admin permissions for those objects in AD. Of course as a DA you can just add them back. So our security people have some sort of system in place that will send alerts if DA access is granted to those objects or if you access those folders. At least that is what I was told. I never set that system up and seeing as how I set up most of our working systems I doubt this. The systems I don’t set up are usually the non working ones and our security people can never seem to get anything to work. I have inherited a few systems they bought and couldn’t make work that I fixed. This involves money though so your org probably won’t shell out the cash.

Reply

[-]

anachronic@reddit

Our security team also has monitoring reports showing folks who are accessing certain restricted folders (eg- employee HIPAA data), and someone would absolutely come knocking if a person who wasn't in HR accessed that folder. If you can't prevent something (eg- domain admin access to data), next best thing is to detect it, and follow-up on any anomalies.

Reply

[-]

deathybankai@reddit

NDA is best for them. If you are the new IT then they also should make sure your job description has the scoop of what you are doing, your access, and what that access is for with penalty for miss use in some policy or other.

Reply

[-]

Ashkir@reddit

We restricted access for lower-tier techs by giving them more restrictive group policies. But our senior techs / operations manager had domain admins. This is covered by their standard NDA. When HR has projects etc we assign it to the senior techs only.

Reply

[-]

ExitMusic_@reddit

Brush up the AUP, audit access. If you’re that small of a shop you should be able to enable some pretty detailed auditing and logging without worrying too much about log overhead / retention issues. HR and financial teams shouldn’t even have to worry about what a domain admin is.

Reply

[-]

milo896@reddit

My org has one set of paperwork for normal user accounts and another set of paperwork for privileged accounts. I'm sure you could find plenty of templates by searching "privileged access agreement." Purely as references, [here](https://armypubs.army.mil/pub/eforms/DR_a/ARN37534-DA_FORM_7789-000-EFILE-1.pdf) is the PAA the Army uses.

Reply

[-]

yoyogigibaba@reddit

I’m not sure the exact policy but at my previous company HR, Accounting, and IT all had to sign additional policy and perform yearly drug tests because those departments had access to sensitive employee data.

Reply

[-]

theknyte@reddit

Do they also forbid their mechanic from opening the hood of the car, while expecting them to still be able to fix it?

Reply

[-]

TrumpetTiger@reddit

HR and Accounting make you sign an NDA and don't worry about it. There are no legalities involved--any lawyer will expect your IT personnel to have access to sensitive information. The legalities are exactly the same as those the HR and Accounting personnel themselves have to deal with.

Reply

[-]

AbleAmazing@reddit

I've signed two NDAs in the past--but they were to gain access to specific information--not to gain administrator privileges in any system. Privileged access is typically covered in an Acceptable Use policy in my experience.

Reply

[-]

Zaphod1620@reddit

This came up once by an idiot, also in HR in my case. I told them if they wanted backups AND my ability to restore them (including when they drag folder into another folder and now it's fine) I have to have access. If they want to lock me out, that is their prerogative, but they are responsible for backups and the auditing behind it. They gave me full access.

Reply

[-]

uritau@reddit

As far as HR & accounting have access to this kind of private documents too, sign the same as they have signed.

Reply

[-]

JohnnyDaRockett@reddit

I am god of everything. They have no choice.

Reply

[-]

BecomeABenefit@reddit

If you don't trust your sysadmins, you should fire them.

Reply

[-]

RaNdomMSPPro@reddit

At some point, the companies have to trust their IT people to not do anything stupid and/or illegal. Acceptable usage policy would cover most of this. Some firms may want a NDA. While a domain admin may have rights to everything and all the shares (or give themselves rights) if the applications, say quickbooks, are properly setup, the IT guy wouldn't have an account in quickbooks or whatever accounting application you all use. Example: Our techs have admin rights on lots of domains, almost all of which have accounting packages in use - we don't have a logon in those accounting systems, the accountants do. Make sense? For documents and whatnot of a sensitive nature, they could secure it w/ proper permissions and occasionally review the rights, or even access attempts if you wanted to go down that rabbit trail. At some point trust is involved.

Reply

[-]

dinosaurkiller@reddit

Your HR staff are expressing legal concerns that are really outside their scope. If they truly believe it’s an issue that is so critical they must do all of their work without IT resources and support, then it’s time to bring in a lawyer and sort through it. The practical reality is that it’s actually a training issue. If there are financial considerations like SOX compliance or HIPPAA concerns regarding identified data then the HR folks can create training materials indicating that you have been notified of what those requirements are and what data or systems are impacted. They need to track what was covered and most of those types of requirements repeat annually. If there are no specifics to this, no federal laws, state and local laws, etc, then the choice here is a lot simpler. Trust the person hired to do the job with the ability to do the job. On a side note, having a domain admin credential should not automatically grant access to all sensitive data. Consider reviewing the security structure and making sure not every sys admin also has read access to sensitive data.

Reply

[-]

redworm@reddit

A lot of people keep saying that you do need an NDA but that's incorrect. NDAs don't say anything about wiping all the servers or looking through payroll documents. What you need is a privileged access agreement https://www.dcsa.mil/Portals/128/Documents/CTP/tools/IS_Privileged_Access_Authorization_and_Briefing_Form_(February2020).pdf https://security.berkeley.edu/model-privileged-access-agreement For all its other faults the one thing the DoD gets right about IT is designing useful policy frameworks that the private sector should have adopted a decade ago. Take those forms and modify them for your company. Then you and everyone else who has anything more than a regular user account must sign this form to retain access. This gives the company paperwork that can be used to fire or sue you if you decide to destroy the network or steal all their data.

Reply

[-]

DeadFyre@reddit

>I work at a small company where the owner was previously the entire IT team. Our HR/Accounting people are concerned about giving me Domain Admin rights because I would then technically have access to all the secure employee private information and company financials and they aren’t sure how to handle the legality. It's legal. There are exceptions written into all privacy laws which permit authorized staff to access privileged information in the normal course of doing your job. If you're required to sign a NDA or something, that's going to be a requirement of company policy, not the law.

Reply

[-]

secret_configuration@reddit

Being a systems administrator generally implies access to sensitive data. In the past I was required to sign an NDA or NDAs. Also typically payroll systems etc are externally hosted and as an admin I never had access to any payroll data.

Reply

[-]

Iron-Dragon@reddit

If as you say he and accounting is one person there then how do they handle it - sounds flippant but if only one person has access to those details then who is holding them to account in a small business it’s important to trust those that have access to data not to do anything with it - there are ways of auditing access to certain folders anyway but having the right policies and trust is the key when there are few employees - I mean they trust the hr and accounts guy not to run off with everyone’s pay at the end of the day….

Reply

[-]

Xibby@reddit

Well you don’t need Domain Admin for day to day tasks. So leave Domain Admin as the group that is used for Domain Admin tasks like promoting/demoting Domain Controllers. Get the other permissions delegated out, and put Domain Admin behind lock and key. For example, get a YubiKey and configure it with a static password. Set domain admin password and put the YubiKey in a safe that requires someone other than you to open, so you have to have a valid reason for getting out the Domain Admin account. If you have a budget, vault your privileged accounts in an PAM product such as Secret Server and require having a ticket number for why you’re checking out the account. Lastly auditing. If it’s sensitive information audit access to it and log it into an appropriate SIEM product (Splunk, Greylog, whatever) and let interested parties review the reports.

Reply

[-]

SevereAtmosphere8605@reddit

This all day long! This answer should easily have the most upvotes. So many reasons domain admin accounts should only be used when absolutely necessary for tasks that can ONLY be done by domain admin accounts. 15 years in IT Sec, 7 of those in DFIR. Can’t tell you the number of investigations that involved sys admin misconduct (most of it actual, but way too many false suspicions and accusations directed at sys admins). Also, very high incidence of security incidents that became full fledged breaches because a sys admin used one user account with domain admin privileges for day to day tasks like email, research on the web, and other basic things that should have been done with a regular user account. The practice of logging in to different account levels for different tasks is cumbersome for sys admins, especially when best practices like MFA add extra steps. But this is ESSENTIAL to protect yourself from false allegations or accidentally being the root cause of a massive security incident. Do exactly what Xibby suggests. You can then show HR what detective controls exist to prove (or disprove) activities performed as domain admin for specific files, folders, applications, systems, networks, etc. Non IT people watch CSI and think sys admins with “keys to the kingdom” access can just click a file or type a few quick commands and look at email and everything else in the blink of an eye. Show them the steps necessary and the evidence available when domain admin accounts are used only for truly domain admin tasks and it should go a long way in building trust between ownership, HR, and IT, not to mention the foundation of good controls for incident analysis and response.

Reply

[-]

mobz84@reddit

But who is going to delegate the other permissions if he is the only one? Some 3rd party?

Reply

[-]

dcdiagfix@reddit

This 10000%

Reply

[-]

_Auck@reddit

[https://www.ethics.org/training-and-certification/](https://www.ethics.org/training-and-certification/)

Reply

[-]

Balor_Gafdan@reddit

I've signed a confidentiality agreement at every IT job I've had over the last 25 years.

Reply

[-]

subduderecords@reddit

Acceptable use policy. HR has to come up with this, in cooperation with IT leadership, as to what the policy is for YOUR position. This is what we did st all companies I worked at large and small.

Reply

[-]

CaptainZhon@reddit

If you can’t trust your sys admin….

Reply

[-]

norcaladam@reddit

Since your a tiny organization and using AD I would setup auditing on any sensitive folders you shouldn’t need to access except for troubleshooting and send these logs to a centralized log server that your accounting group has access too. You could get way fancier, stricter and with alerts sent by using some AWS service but I think it’s probably beyond your man power and budget

Reply

[-]

ruttin_mudders@reddit

They either trust you to do your job or they don't. If they can't get around that, they're going to have a hell of a time retaining IT staff.

Reply

[-]

uptimefordays@reddit

NDAs are pretty normal. That said they’re hiring someone to design, implement, and run their information systems—what do they expect?

Reply

[-]

xCharg@reddit

It smell like this hr/accounting person has domain admin access themselves. While they should not.

Reply

[-]

Jwtd29@reddit

Most organisations I’ve worked with have SysAdmin SyOPs which layout the rules specific to the job. This is normally contractual and failure to adhere would be a series breach. You have to renew certification each year on these. There are other things as well: Even as a small company don’t use DA, delegate to least privilege. Create a separate account for managing these sensitive areas/apps. Then a process for approving use of the account. Ultimately this is about providing them the confidence that the data is secure from accidentally access, and that deliberate access without authorisation is a gross breach of the contract which gives them ability to terminate. Also make sure you keep security logs so if they need to they can audit your actions. This will help with auditors too. Written processes are always a good thing. Might also help with Cyber insurances etc.

Reply

[-]

Tymanthius@reddit

So . . . what does HR sign to prove they aren't misusing that info? You can sign the same shit. Really, some positions are required to have a level of trust. IT is one of the most powerful positions in a company. In smaller ones it's almost total. So you have to trust, but auditing is good too. :)

Reply

[-]

BBO1007@reddit

For me, HR has their personnel files separate. Cloud based.

Reply

[-]

doweactuallycare@reddit

>handle the legality. Its not illegal. So like... we just get it. IT typically has the 'keys to the kingdom' more than others. NDAs are not uncommon. I have signed a few. Can't administrate what you don't control. If you're expected to administrate it then... need control. If they just can't offer control, neato. Guess you don't admin whatever handles that? Not much more you can do.

Reply

[-]

lurkeroutthere@reddit

We sign NDA's, we also have auditing turned up to the max for anything related to HR and finance and any activities by the priviledged accounts can and often are independantly reviewed. I never get into those folders without a ticket and a paper trail. Simple, effective easy to verify. It's about need to know and ability to verify, if I've already got DA rights keeping me out of things is pretty much impossible but I should leave fingerprints or trip alarm bells everywhere I go.

Reply

[-]

The-GlitchWizard@reddit

Auditing

Reply

[-]

Pristine_Map1303@reddit

If you are a Systems Administrator, then they need to trust you period. You need to setup a breakglass admin (written on paper and in a sealed envelope) for the company owner.

Reply

[-]

reaper527@reddit

you have a key to the building, what would stop you from walking in on a saturday afternoon and stealing all the desktops/laptops/printers? at the end of the day there just has to be a certain level of trust that you won't misuse the access you have. if you didn't have access to the entire filesystem, you wouldn't be able to backup the entire filesystem. that being said, you can turn on filesystem auditing to create a log of when someone accesses a file, and that MAY ease their suspicions if they know everything is logged.

Reply

[-]

jcpham@reddit

I explain that I can technically lock myself out of the files but there’s still needs to exist an admin account with access to whatever sensitive data. Then I usually tell any one of the hilariously terrible stories of things I’ve learned that I have no interest in ever learning and I assure them this is all covered in either the employee or IT or some other handbook all the employees including myself already signed. Or they can outsource it to the cloud if they are that paranoid

Reply

[-]

thebluemonkey@reddit

If they want you to sign an NDA, then go for it. Ultimately, you need it to do the job if you're the domain admin. Plus, why would you look at that stuff, its one of those instantly fireable choices

Reply

[-]

bobs143@reddit

Why would there be a concern over domain rights? If there is any HR or Accounting software and shares then limit rights to those resources. For IT there are cases where domain admin rights are needed to do your job.

Reply

[-]

BiteMaJobby@reddit

I has nothing to do with those departments in the slightest. I hope all the departments can complain about the Owner sending ice cubes for you, cause that must be a fucking ball ache.

Reply

[-]

Bendezium@reddit

I work at a large company in a highly regulated industry. When I first started in IT, all sysadmins had domain admin. After a few... incidents the board said "enough is enough, get your ish together". We ended up segmenting out a few types of admin use cases. For Domain Admins (changes to domain controllers and domain wide configurations), it was determined this level of access would be rare and only needed by a few people. Separate accounts were broken out for these and they can only be authorized from a few specific computers that are physically connected to the network (you got to be there, no home office). Extensive monitoring is in place and I'm pretty sure our SOC checks for valid change records each time the credentials get used and also each time new people are added to the AD group. We also broke out server admins and desktop admins and a few others into respective groups with lesser and lesser access. It got kind of annoying with all the different credentials and it was messy at first with group policy, but it was necessary. It did drive at least a few people to look for other jobs. But after the dust settles it was fine.

Reply

[-]

labmansteve@reddit

I've been domain admin at 9 different companies over the course of 20 years. I've never had to sign anything beyond the boilerplate company policies that everyone signs when they get hired.

Reply

[-]

Sub_pup@reddit

No NDA. When my company was smaller it was just understood you have to trust me. I had one HR rep insist I remove my own permissions from a folder. I told her that was effectively impossible. I had to placate her but the CEO knew what was up. I'm a professional, I don't look at anything I'm not authorized to and have mastered "not seeing" things. If you don't trust me, don't hire me. When your at the top of the IT chain you have the keys to the castle and that is just the way it is.

Reply

[-]

Affectionate_Ear_778@reddit

Honestly just tell them straight up that this is an inherit part of an IT administrators power. I've seen similar things posted before and it all boils down to professionalism. For you to do your job, you need this access and that's all there is to it. I guess you could set up some script that would log and even email a mailbox anytime something specific was accessed but....who's to say you don't just go in there and disable it for sometime?

Reply

[-]

AppIdentityGuy@reddit

Take a look at the AD hardening documentation. 1st principle is that you shouldnt be running as a domain admin and you shouldnt be using that account to ever login into anything other than a DC..

Reply

[-]

dan-theman@reddit (OP)

I understand, I can’t manage many functions on the DC without DA rights. I already have a non-admin account and a local admin account with higher privileges for some functions but still unable to do things I would consider to be my job.

Reply

[-]

dcdiagfix@reddit

Your domain admin account shouldn’t be able to log on to file servers or end user workstation. What do you consider your job that requires domain admin rights? Deploying domain controllers daily?

Reply

[-]

AppIdentityGuy@reddit

OK cool. But you can actually formalize this approach.

Reply

[-]

enp2s0@reddit

He's not asking to specifically add domain admin privs to his account, he's asking to get domain admin privs. Best practices would be to create a specific account for him with DA to only be used for DA tasks. I don't think OP would have any issues with that at all.

Reply

[-]

Thiccpharm@reddit

That's cool but also 1000% not what was asked.

Reply

[-]

Rude_Strawberry@reddit

Finance are concerned about giving an IT guy domain admin. Lmfao. Run a mile mate.

Reply

[-]

amplifizzle@reddit

When anyone asks why shit doesn't get done, tell them you don't have rights and go back to Fortnight.

Reply

[-]

dcdiagfix@reddit

Domain admin doesn’t provide those rights, badly managed and maintained network file shares provide those.

Reply

[-]

Ochib@reddit

In the U.K. you can be prosecuted under the Computer Misuse Act. And any hint of getting prosecuted under that act will stop you getting a job in IT

Reply

[-]

NorthernVenomFang@reddit

NDA and a contract should be more than enough. I have had to sign NDAs and contracts with non-competition clauses before (consulting job). If they do not agree to you getting domain admin after signing an NDA, then find a new job, you are going to be handcuffed the entire time doing this one.

Reply

[-]

TheRani_Ushas@reddit

In our small company SysAdmin has an account with domain admin rights (not the daily driver but another account). No need to sign anything. Trust is implicit in the job title. Tell them that is how other companies do it. Yes, sysadmin has god rights, yes sysadmin can see everything, no sysadmin does not have the time or desire to look at any of it.

Reply

[-]

mschuster91@reddit

>What does your company do? Did HR have an NDA for you to sign? The people in HR in my company have never encountered this before and are unsure how to handle it. It’s not that they are trying to prevent me from accessing it, they just don’t know how other companies do it. The industry standard is having the system administrators (or any other kind of user with privileged access) sign a dedicated NDA. If your employer doesn't have that because they are scaling up, they should contact their industry association or cybersecurity insurance - they usually have templates.

Reply

[-]

TeddyRoo_v_Gods@reddit

Company policy mostly. I can theoretically touch all uncleared data in my company, but if I get caught sharing or misusing it, it's immediate termination and possible legal trouble as per company policy that I signed when I started here.

Reply

[-]

TheBigBeardedGeek@reddit

I remind them that while they are technically correct (the best kind of correct) that action would open me up at minimum to civil litigation and be career ending. If they press the issue, I ask who the "on call" person is to give me those credentials for those nights and weekends when I need to do the work. Then I spend time at 3am on a Monday morning doing updates.

Reply

[-]

butter_lover@reddit

Two things are relevant here: one is the AUP, this should govern appropr behavior including snooping files. Second is elevated access is another agreement which includes NDA and management/hr approval. the sensitive docs they are worried about are probably emailed back and forth by the officers and much easier to read that way. They are probably not even focusing on the correct treats but: For me, all this Fort Knox mentality for a small company usually is a red flag that someone(s) are doing something they should not be doing.

Reply

[-]

GhoastTypist@reddit

Privacy policy signed off and I was handed the keys to everything. You can't do IT operations without admin access. How are you expected to do disaster recovery unless you can access it?

Reply

[-]

wellwellwelly@reddit

Surely this is why HR systems/tools exist? To keep employee information separate from anyone. I've never seen HR storing employee records on a domain joined file system. I'm not saying its not unheard of, but it seems like a bad idea for this very reason.

Reply

[-]

rjasan@reddit

We don’t give that access out to all but a small handful of people, and it’s not on their daily use accounts. We have different logins that we use only when we need to do something with those rights. HR is not in the decision making process for who gets those rights.

Reply

[-]

Rumikiro@reddit

When I was a DA there was no special process. It just followed our standard process for granting/modifying/removing access. It was basically a form that my manager filled out describing what access was needed and was sent to our SOX officer. That was enough to meet Sarbanes/Oxley which was our biggest concern at that time. I was given a second account with the privileges I needed that was only to be used for administering the domain.

Reply

[-]

Dangi86@reddit

It is pretty easy. You as a Sysadmin are responsible for the information of your company, all information, as your responsibility you have access to everything. They don't want you to have access, pretty simply, revoke your own rights, BUT, **in writing** you need that they acknowledge that if something breaks, you are not responsable, and they have to fend for themselves.

Reply

[-]

vitaroignolo@reddit

Since your HR doesn't want to give you this access and doesn't know how to legally bind you to secrecy with it, I would recommend possibly getting some personal legal aid involved to look over whatever they're going to have you sign. Just have them give you the document, then take it to your friend's cousin who does CPA work or something. I would be suspicious of anyone asking me to sign a document they created and are responsible for enforcing not knowing it could exist within the past couple of weeks.

Reply

[-]

username_no_one_has@reddit

More or less they have to get over it. What you can do, though, is establish mechanisms whereby you can have them audit system administration activity to establish that trust. For example, tiered admin structure where you can do most of your day to day stuff with one admin account and anything requiring particularly sensitive stuff may need full domain admin, or actually just part of it, to do stuff over what they’re concerned about. These events get logged somewhere visible and they (or someone) can read these logs. All of our admins know they are being heavily audited so it’s very much a fuck around and find out situation.

Reply

[-]

aftershock911_2k5@reddit

One company I worked for said even though you have access to it .... dont look at it. One company had me create an HR folder with only HR employees able to access even domain Admin rights were removed.

Reply

[-]

jeezarchristron@reddit

I have never signed anything when given my Domain/global admin rights. If they are worried let them seek legal advice. IT admins need this to do their job.

Reply

[-]

jsrsd@reddit

Seeing a lot of comments about how they need to trust IT, etc, but that doesn't answer your questions about actually establishing a policy, which frankly should be standard. In the past I've had to sign an agreement acknowledging that people had privileged access to information and systems, and in the process of performing their duties may come across private\\proprietary\\etc information and have the responsibility to protect\\not share\\etc. If they were to violate those responsibilities they could or would be subject to disciplinary action. It was a fairly straightforward one-pager, didn't need to go into which systems or types of information, it was something like "Including but not limited to email, documents, database, personal information, financial" and along those lines. They'd probably want to get a lawyer to draft it to make sure it's legal where you're located but shouldn't be that difficult.

Reply

[-]

Nitro_NK@reddit

its usually just common verbage in the AUP / Computer policy. If they are uncomfortable work together to right up a policy that better encapsulates the concerns. Get some form of auditing like Netwrix for accountability. my two cents

Reply

[-]

Consor@reddit

Realize you're looking for a US perspective. But for Europe (Netherlands): Signing some form of NDA/confidentially agreement regarding confidential data is pretty common. Typically there is already some clause on it in your contract, but it can be a seperate document. Many companies will also require a government issued certificate of conduct, which basically indicates you are not convicted for anything that may be relevant. The certificate is more standard than the NDA.

Reply

[-]

NDaveT@reddit

I believe the way most companies handle it is to have something in the employee handbook about not misusing access to confidential information, and maybe having people sign something acknowledging that accessing confidential information for anything but legitimate business purposes is grounds for termination.

Reply

[-]

SpecificOk7021@reddit

If the SysAdmin can’t have access to a part of the system because of trust issues, you have the wrong Sysadmin…

Reply

[-]

cyberdeck_operator@reddit

Our HR uses a SaaS platform for sensitive HR data. The vendor and HR do the support for that platform. For everything else, they trust my professional integrity. This is why we should have some kind of society like ASME to provide this kind of thing. You should be able to say, I'm a member of the Technologist Society of America, in good standing, which means that I am bound by a strict code of conduct, you can trust me with your most sensitive data.

Reply

[-]

dotsql@reddit

There is a doctrine for this, LEAST ACCESS PRIVILEGE to do THE JOB. If you DON'T NEED domain admin rights to do your job, you SHOULD NOT have domain admin right. You need it, then you should have it.

Reply

[-]

HerfDog58@reddit

An NDA is one option. But a domain admin account doesn't necessarily need admin rights in the HR/accounting applications, unless the company expects that person to fix any and all of the issues that arise in that application. There are ways to granularly assign permissions to applications as well as server shares with "confidential" information so that a domain admin account can't access it. For example, the domain admin could have admin permissions to the server, but assign a different "AppAdmin" account to have admin permissions for the programs. Then HR/Accounting has a process whereby someone logs into the program with that account, and makes necessary changes. A domain admin can have ownership of a server folder, but no explicit rights to access it. My company pays for vendor support contracts for all the applications we use and the vendors manage the apps. Most of the apps, I can't even login, even if I did build the server it resides on. Plus, what makes the HR/accounting people more trustworthy than you? Do they have signed NDAs? Why not implement the same safeguards and policies for your position as for theirs?

Reply

[-]

wolfer201@reddit

Domain admin group shouldn't have read access to the directories that store that info. Could you give yourself read access, sure, but you adding yourself is the paper trail. Secondly your daily driving accounting shouldn't have domain admin role either. You should only be elevating to your domain admain role when tasks are needed that require that extensive of access. Pain in the butt for a small business, but better to start that level of control while small.

Reply

[-]

ReydanDeathrain@reddit

IT, HR, and Accounting are all keys to the kingdom departments. Each department uniquely has access to an enormous amount of data, and is responsible for protecting that data from all threats, including within their own department. In theory, neither department is "over" the other, and should rather check/balance the other, and help the others configure and maintain appropriate access. In practice, it usually depends on the executives/owners each department reports to and their personal familiarity with each of the 3. Our business (1600 users, 10+ members of each 3 departments) doesn't have a special NDA, but does have written processes and policy regarding access, accountability, and auditing, follows a secure framework and works with least authoritative access and specialized accounts. Each department is responsible for writing and submitting their own policies, but a policy council approves. The council includes members of each of the three departments, as well as front line departments and ownership/executives, as well as for us a HIPAA officer and legal counsel.

Reply

[-]

JerRatt1980@reddit

How do I handle it? I don't. I remain as not a domain admin and every request that would require it I forward to HR to complete.

Reply

[-]

jimicus@reddit

I've never had to sign an NDA or anything like that. Do they make their accountants sign an NDA? Their HR staff? I should think it's pretty damn obvious that snooping around is gross misconduct and grounds for instant dismissal without any sort of NDA required.

Reply

[-]

LaHawks@reddit

I deal with FERPA data along with a sprinkling of PCI and HIPAA. We have a standard background check and an acceptable use policy. I've never signed anything. If I do something stupid, like leak data, there would be a log of it somewhere.

Reply

[-]

justaguyonthebus@reddit

Do it the exact same way HR does. And that is that they don't do anything special because it's a function of the role, just like this is a function of IT.

Reply

[-]

Hopefound@reddit

Here HR has their own cloud hosted product that we have no access to in any way. If they have issues they know to call support

Reply

[-]

JJettasDad@reddit

Thats the assumption of the job...  Its no different than someone in HR having access to it. When you have this type of position there is a higher standard.  Its the assumption of the job that you have the keys to the kingdom and that is why they need to make sure the people they hire are trustworthy people. No I have never had to sign any NDA for anything.  Here is the thing... someone is going to have to have access to it as a DA. It has to happen to function. So why would you not let the person who actually is the one using these technologies (you) be that person.

Reply

[-]

noctrise@reddit

no one gets admin. Period. I run this way for over 5 years.

Reply

[-]

silasmoeckel@reddit

Small to midsize you pretty much trust your sysadmins to be sysadmins we tend to be trustworthy folk. Bigcorp you put in auditing so you still have access but there is a log of everything your looking at. Any of them NDA is pretty much standard for all new hires.

Reply

[-]

pielman@reddit

Simple short answer, I have an NDA and we have audit/logs if which account accessed what file. In addition restricted information like trade secrets and highly confidential information are not allowed to be saved on standard file servers instead are handled in a business application which will not name. In regards of general IT security measures we have out USB access for USB data storage’s automatically encrypted and can only be read from devices that are in our domain. All Internet services for cloud storage are blocked (zscaler) with exceptions but everything logged.

Reply

[-]

BryceKatz@reddit

My company uses SaaS packages that IT cannot access. #done

Reply

[-]

cichlidassassin@reddit

You cant admin something without being admin. You can sign an NDA if that makes them more comfortable but this is the reality of any system. Ideally you setup enough audit control and logging that if a problem were to arise it would be very clear. You also want to segment your daily account from your admin account so you dont automatically have access to those systems, only on a needed basis.

Reply

[-]

fuzzylogic_y2k@reddit

If HR and accounting use specialized software, they just don't give you access to that software. For instance, my company uses Paylocity for HR. IT can access very little. HR manages it. Same with our main accounting software, IT has no account management rights or reporting/viewing rights. It is very much a least access scenario. If they are storing sensitive info outside of that, they get in trouble. In my experience, NDA's are generally not needed for staff. If they can prove you did something with the data they can have you arrested and or sue you without an NDA. Though you would want probably want them for 3rd parties like contractors.

Reply

[-]

jpm0719@reddit

Our company let's IT IT. You have to be a domain admin in most cases to do your job. I don't tell HR who should access payroll info and they don't tell IT who should be domain admins. All they need to do is remove domain admin access to files/shares that IT does not need to see and make the department the owner. NTFS permissions and share permissions exist for a reason. They can be overridden sure, bit you should never have a reason to access that stuff unless they asl you to i a ticket so that you have a reason documented in a request.

Reply

[-]

dgillott@reddit

Try a least access approach in your environment.

Reply

[-]

Det_23324@reddit

My company didn't have me sign anything. It could see companies doing that, but I'm not sure its necessary. Any damage someone does to the company is already illegal. If you take people's bank account info and sell it on the black market. Thats illegal and you will be prosecuted for that.

Reply

[-]

bot4241@reddit

My companies make your sign NDA agree to companies policy around data to be sysadmin. Then you have to be approved by your manager to get access to certain documents.

Reply

[-]

cmh_ender@reddit

for my company, it's in the employee handbook. All employees must not disclose any HR related data outside of the scope of their job ( and then more generically says) you can be terminated for disclosing any data outside of the scope of your job. so basically anyone in any level of the business, can't just talk about the stuff they have access to, unless they have a need to, for their job. so no separate NDA, no separate BAA, it's just part of the generic employment agreement.

Reply

[-]

StaffOfDoom@reddit

IT is a trusted entity, if the top-levels don't trust the IT they've hired then nothing you say is going to change their minds. Also, everywhere I've worked, HR does not have any say in how IT works or who is granted access. IT creates the policies regarding system access and data retention. What's HR got to do with any of this?

Reply

[-]

echoAnother@reddit

Not knowing your country laws, but supposing it's the same. If they want a bit more legal safe, they could redact a confidentiality clause to your contract. ( a no disclosure clause would be useful to, but is not the same). That said you can sue an employee for mal praxis, and illegitimate use of company resources (that includes data) and you don't need to subject the employee to any clause. A good logging system can be used to better determine who is responsible when someone is doing something undue. However, logging can be tampered. If they are searching for a way to avoid it happen, there is no one. Who has the keys can change the lock.

Reply

[-]

Drew707@reddit

No, no NDA. I had admin access to the HRM and I guess technically QuickBooks, but I tried to limit what I did with those systems mainly because I didn't want to get stuck supporting them. Everything was based on professional trust. It was a small company, but an outage could still be measured in thousands of dollars per minute. They figured if they trust me to keep that going, it doesn't really matter if I have access to everything else.

Reply

[-]

wallacehacks@reddit

I'm going against the grain here, I would love to work for a company that had these concerns. You tell them you will sign an NDA, and then you can set it up where you don't have access to this sensitive data. As a domain admin, you could obviously grant yourself access, but you can make sure that sort of action is logged and audited.

Reply

[-]

cbelt3@reddit

So the other admin person wants to own the domain ? And not let you access ? OK ! They now have to handle all your requests. Within a specific time frame. And have to name a successor if they want to go on vacation or get sick. Oh. They don’t understand? Well they need to go get the right certification then. What ? They don’t do IT work ? Well, maybe they should allow you to do your damn job. People who set barriers for effective work need to feel the pain of owning the work.

Reply

[-]

Zippoman924@reddit

I totally understand the concern here, personally I'm not a sysadmin but to me this sounds like it's not your job to figure out what HR needs to do here. To me it sounds like they need to figure that out for themselves, although I bet they do appreciate you helping them figure this out too.

Reply

[-]

joeykins82@reddit

What have HR signed with regards to confidential employee information? What have accounting signed with regards to sensitive financial data? If the answer is “well nothing, we just trust them to behave professionally” then there’s your answer.

Reply

[-]

Xuzio@reddit

Most contacts of employment would have a section surrounding confidentiality

Reply

[-]

dan-theman@reddit (OP)

Mine is a single page mentioning nothing about confidentiality. I think I may need to do the work for them and find a document that will set their minds at ease.

Reply

[-]

Fickle_Proof_984@reddit

As much as everyone reading this will disagree, you could in fact help with this process. Every company has to grow and learn these things along the way. There are companies running off of Gmail accounts, they don't have legal departments or IT departments until it's time to grow and those becomes necessary. I'm not defending bad practices but I'm explaining reality. Someone telling you to get a new job is just so shortsighted unless they know more about where you work and if it's truly a place worth abandoning.

Reply

[-]

Hyperbolic_Mess@reddit

What did their contract say? IT needs the same access to sensitive info as accounting and HR so I'd have thought there would be similar contractual safeguards

Reply

[-]

dan-theman@reddit (OP)

I am the first IT person this company has ever hired. My hiring agreement mostly has wording about my salary/benefits and working hours. There isn’t much else so I may have to conjure up a contract for them.

Reply

[-]

Xuzio@reddit

That in itself is extremely concerning and understandable why would would have concerns if that’s the case IT have to have control and access to a lot of this data to manage backups and security of said data, very important to have some form of confidentiality agreement in place, but same should apply to anyone accessing any corporate data, even if not as sensitive as HR and Finance

Reply

[-]

mitspieler99@reddit

You sign some legal data security stuff. Also define some infosec principles like least privilege access. Basically say you only touch stuff that's related to your work. Then you define what's sensitive data and how you can audit access to such data and/or audit usage of DA accounts (basically implement a way to check what you're doing). There should be a separate IT security team creating those policies to avoid conflicting interests.

Reply

[-]

dan-theman@reddit (OP)

Haha, team. I am the only team…

Reply

[-]

mitspieler99@reddit

Hey, it's HR raising the concerns, not?

Reply

[-]

ScotchAndComputers@reddit

If nothing in the standard employment agreement/handbook doesn't cover disclosing of confidential data both within and outside the company, then they can add a paragraph covering that, or whip up a separate piece of paper for you to sign. Really, a general statement about that should be in EVERY employee's paperwork when then onboard. "You may see/know things that outsiders, OR OTHER EMPLOYEES have no need to see. So don't talk out of school." In general, you should convey to HR that your position BY DEFINITION requires access to pretty much ALL company data that is kept on sight, or within systems you are responsible for. When they hire at Sys Admin, they should be doing background checks, references, etc. with the thought already in their head that they need to make sure this person is trustworthy, responsible, and has integrity. Others have already mentioned delegation of rights, etc. which it sounds like you have covered. Good luck out there!

Reply

[-]

Moontoya@reddit

Encourage HR to read the data protection acts, HIPAA, gdpr and Marcus Aurelius on ethics. Then worry about what we can see and ask why would IT be looking for confidential / PII without projecting self behaviour.

Reply

[-]

sryan2k1@reddit

Nothing special. Abuse of powers should be in your standard AUP.

Reply

[-]

dan-theman@reddit (OP)

What is an AUP?

Reply

[-]

Cannacrohn@reddit

Acceptable Use Policy

Reply

[-]

MrMeeseeksAnswers@reddit

>AUP Acceptable Use Policy u/AzbeerChef \- Way to be less than helpful. This is obviously a small business and HR themselves clearly don't know what an AUP is or this wouldn't be an issue.

Reply

[-]

AzBeerChef@reddit

Uh oh. Maybe HR is right?

Reply

[-]

matthoback@reddit

For larger organizations, then is generally solved by implementing some sort of auditing software that will track file accesses and modifications. The permissions need to be there to do your job, but the verification needs to be there that you're not misusing your permissions too.

Reply

[-]

Mc-lurk-no-more@reddit

How do they hire additional HR folks? Obviously they are in the company and have access to restricted information as well. As an inside employee I would be bound to the company as much as they are.

Reply

[-]

Cannacrohn@reddit

Companies trust sys admins to not misuse or steal or view unauthorized data without a reason. They need to just trust you basically, it has to be someone. I have access to \*everything\* in my company, absolutely everything. But even if I was super mad at them for some reason, there are logs and records when things are accessed and changed and I don’t want to go to jail. So I would never do anything I’m not supposed to because then I’m a felon and my career is over. So they just have to trust, someone.

Reply

[-]

Klop152@reddit

Acceptable Use Policy can be put in place if it’s not already. However they should be trusting you as the sysadmin or infrastructure admin to do your job… you quite literally need the access.

Reply

[-]

IllicitBrunchTryst@reddit

We have data access agreements, acknowledging that we will only use our access to data for appropriate work purposes. We also have administrative permissions agreements, essentially stating that we will not use our powers for evil. And they aren't just for IT. Folks with elevated permissions appropriate to their role in other teams sign them as well.

Reply

[-]

sacredcookiee@reddit

Would depend on company and country maybe?? Regarding nda.. BLA BLA We as IT infrastructure have full access everywhere. It's part of the job, you got to trust your IT. It's their job to give for example users access to x folder.. even if I as an admin am not directly given access, I can access the server files from our file server and give access to x users which are needed. Or if I wanted too, could look into any folder and file from our file server.

Reply

[-]

Thiccpharm@reddit

If you have to sign something, sign something, but don't take an admin job if you or someone on your team does not have domain admin. Does HR think they should be holding on to that account?

Reply

[-]

AlarieleEverqueen@reddit

You sign something like an NDA or whatever from HR. you will HAVE to have access to those things to do your job

Reply

[-]

NotYourNanny@reddit

> you will HAVE to have access to those things to do your job This. If they don't trust their IT guy to have access to everything, then either they have the wrong IT guy, or you have the wrong employer.

Reply