Administrator's Access Control for File or Folder

Dear All,

I have faced a problem while configuring taskspce permission for folder or files. there is a request needs to encrypt some files and those files can only be viewed by certain users due to the secure purpose. I have tried to use ACL to prevent viewing by normal user, but it doesn't work for the system Administrator. I also tried the 'Restriction' function, but it still can not deny the "read" access for system Administrator.

Does any body know how to prevent file viewing by system Administrator? Or any suggestion or solution on it?

Best Regards

Evan Liu

Find more posts tagged with

Note:

If there are Accepted Answers, those will be shown by default. You can switch to 'All Replies' by selecting the tab below.

Accepted answers

DCTM_Guru

License key is not specific to server instance. So activating in DEV will not prohibit you from using it in PROD.

Several things to keep in mind about TCS:

1) You have to create a brand new encrypted filestore. TCS will not encrypt any content located in existing filetstore. You may be able to use MIGRATE_CONTENT admin job, but I havent tried this, so I dont know if the job is smart enough to encrypt it as it moves content from non-encrypted filestore to encrypted filestore. This will prevent anyone from circumventing the Content Server and trying to view the files directly on the filestore.

2) As I said in my first, superuser has the same permissions as the document owner. So if a documentum has read permissions, the superuser will have read permissions. There is no way around this. If you set dm_owner to NONE, the superuse will still browse permissions, at which point he/she can change the permisions on the document to give himself permissions. This basically gives superuser the ability to retrieve an object if document owner mistakenly removes his own permissions from the object.

All comments

DCTM_Guru

If you grant system administrator superuser privileges, then he/she has the same permissions as the document owner (so ACL doesnt really work). If you want to prevent server administrator (or anyone who has access to content server and/or file store) from reading the document, then you can install Trusted Content Services (requires additonal license) and create encrypted filestore. This will prevent anyone who has access to filestore from actually deciphering the encrypted content.

Basically, anyone who has superuser privileges within Documentum is "trusted" with data and content within Documentum. That being said, you can enable auditing and the audit trail will capture if system administrator has viewed/export content of file.

Evan_L

Dear Johnny,

In fact, our user wanna prevent viewing totally even using auditing function. That means the files are top classified and view access will be totally denied for irrelevant person.(include system administrator). therefore, i can't just simply track the auditing history.

About the TCS, there is only one license key and which is already be used on our Production. so if i use this key to active TCS on my develop env, does it work? or will it affect our Production env?

Thanks for your comments

Best Regards

Evan Liu

DCTM_Guru

License key is not specific to server instance. So activating in DEV will not prohibit you from using it in PROD.

Several things to keep in mind about TCS:

Evan_L

Hi Johnny,

According to your answer, does that mean i can use the same license key on both DEV and PROD server at the same time without any trouble? Have your tried this before ?

If i use a new encrypted filestore for my files, does that mean even superuser can not have the view access for my file ?

Best Regards

Evan liu

DCTM_Guru

1) Yes. As I said before, the license key is NOT server specific.

2) Superuser cannot view the file trying to access it via OS. He/she can access the file as if he/she was the document owner. As I stated in my original reply, superuser is given trust to entire repository. Its almost like a DBA or network admin. They are trusted with the resources they manage.