Block file copy

My main concern is to allow my programmer to modify, execute this source
file
but prevent them to copy this file out of server (Server 2003).

1) Is there a way to prevent users copy file out of server
and this user is assign right to modify and execute this file? How?
2) Is there a auditing to keep track this user has copy this file out of
server?
Is yes, how and what is the audit id?

Thank You

Once a user has the appropriate permission to a folder/file, he will be able
to exercise that privilege. In your case, the programmers have rights to
modify and execute the files, I presume they will also have read permission
as well. And this read permission allows user to copy the file to another
location, such as floppy and thumb drive.

Although there are solutions like EFS, RMS to stop others from copying the
files out, but it doesn't apply in your case because the user himeself is
granted read permission.

Auditing can see who is accessing the files but there isn't an attribute for
monitoring "copying". The closest is Read which is 560.

HTH.







"alvin" wrote:

> My main concern is to allow my programmer to modify, execute this source
> file
> but prevent them to copy this file out of server (Server 2003).
>
> 1) Is there a way to prevent users copy file out of server
> and this user is assign right to modify and execute this file? How?
> 2) Is there a auditing to keep track this user has copy this file out of
> server?
> Is yes, how and what is the audit id?
>
> Thank You
>
>
>

Ok you can’t stop them from copying the file but you can restrict access to
all the drives on their PCs using group policy.
Ok now they can just e-mail or ftp it out of the organisation so.
Disable FTP access for them and limit their mail size to less than the file
size
or disable all internet access and external mail.
It might not stop them but at least it will slow them down.

"Wong Tuck Wah" wrote:

> Once a user has the appropriate permission to a folder/file, he will be able
> to exercise that privilege. In your case, the programmers have rights to
> modify and execute the files, I presume they will also have read permission
> as well. And this read permission allows user to copy the file to another
> location, such as floppy and thumb drive.
>
> Although there are solutions like EFS, RMS to stop others from copying the
> files out, but it doesn't apply in your case because the user himeself is
> granted read permission.
>
> Auditing can see who is accessing the files but there isn't an attribute for
> monitoring "copying". The closest is Read which is 560.
>
> HTH.
>
>
>
>
>
>
>
> "alvin" wrote:
>
> > My main concern is to allow my programmer to modify, execute this source
> > file
> > but prevent them to copy this file out of server (Server 2003).
> >
> > 1) Is there a way to prevent users copy file out of server
> > and this user is assign right to modify and execute this file? How?
> > 2) Is there a auditing to keep track this user has copy this file out of
> > server?
> > Is yes, how and what is the audit id?
> >
> > Thank You
> >
> >
> >

Are trying to prevent copying to CD and floppies or other attached media?

--
Amnon Feiner
http://www.woodcontour.com
Solid Wood & Stone PC Peripherals.
"alvin" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> My main concern is to allow my programmer to modify, execute this source
> file
> but prevent them to copy this file out of server (Server 2003).
>
> 1) Is there a way to prevent users copy file out of server
> and this user is assign right to modify and execute this file? How?
> 2) Is there a auditing to keep track this user has copy this file out of
> server?
> Is yes, how and what is the audit id?
>
> Thank You
>
>

The solution is not so simple. Since they are programmer, thier computer
knowledge is not similar to novice users.

1. File can be compressed before email out.
2. File can be transfer without having to use FTP. There are plenty of free
on-line storage sites available.
3. Not practical to lockdown totally for their machines as they need to
perform plenty of testing on the programs which need access to the system.

HTH.

The one with the hands on the group policy and e-mail is the one in control.
Not easy, but the doable.

--
Amnon Feiner
http://www.woodcontour.com
Solid Wood & Stone PC Peripherals.
"Wong Tuck Wah" <(E-Mail Removed)> wrote in message
news:0EC980E8-2B7A-4FF4-847A-(E-Mail Removed)...
> The solution is not so simple. Since they are programmer, thier computer
> knowledge is not similar to novice users.
>
> 1. File can be compressed before email out.
> 2. File can be transfer without having to use FTP. There are plenty of
> free
> on-line storage sites available.
> 3. Not practical to lockdown totally for their machines as they need to
> perform plenty of testing on the programs which need access to the system.
>
> HTH.
>