Flat Folder Permissions and Delegated Administration
Metro Health has 3,000 secrets in a single flat IT folder. All 220 IT staff are in a role with View and Edit on that folder. A helpdesk analyst recently viewed a domain admin password; the analyst had no business need. The CISO wants delegated administration: 12 team leads should create subfolders and secrets for their teams but must not see other teams' secrets. A contractor group needs access to 12 server secrets for a 30-day project. The security team wants approval for any domain admin access, checkout to prevent simultaneous use, and a clean audit trail. The company uses Active Directory groups and wants to avoid per-user permissions. There is no budget for new products; this must be solved with Secret Server configuration and process changes.
1. Design the folder and permission model. How do you fix the flat IT folder and delegate creation without cross-team visibility?
Read the worked answer
Create a top-level structure such as Teams, then one child folder per team, and break inheritance at each team folder so parent permissions do not flow down. Remove the broad IT Staff role from the root. Grant each team's AD group View on its own team folder, and grant the team lead Owner only on that team folder so the lead can create subfolders and manage permissions within that boundary. Do not grant Owner at the root, because Owner can change permissions and would allow escalation across teams. Platform administrators keep a separate administrative role at the root. Use Add Secret where users must create secrets but do not need to browse the whole parent tree. Because permissions inherit downward, a user with View on the root can see too much; the fix is to remove root access and assign at the lowest folder that meets the need. Validate with a test account before removing legacy access.
2. How should contractor access be granted? Include time limit, approval, and audit considerations.
Read the worked answer
Create a dedicated project folder containing only the 12 server secrets, rather than granting access to a broader server folder. Create an AD group for the contractor project, grant that group View only on the project folder, and set the AD group membership to expire at the 30-day project end. If policy requires approval, require a Secret Access Request for the secrets, with the application owner as approver, rather than permanent View. Enable checkout if concurrent use would cause operational risk. Ensure the contractor uses named accounts, not shared credentials, so the audit trail identifies the person. Review the Secret Audit report before the group expires and confirm removal. If the contractor needs remote sessions, require recorded sessions through Secret Server rather than direct RDP. This combines least privilege, time limitation, and evidence.
3. What controls should protect the domain admin secret that the helpdesk analyst viewed?
Read the worked answer
Move the domain admin secret to a Tier 0 folder with a small AD group of privileged administrators; remove helpdesk and general IT access entirely. Require an access request with approval before viewing, and enable checkout so only one administrator can use it at a time. Consider DoubleLock for the highest-risk secrets. Enable session recording for any launcher use and review the Secret Audit and User Audit reports. Confirm that the helpdesk analyst's earlier view is documented and investigate whether the credential was used. Do not rely only on hiding the folder; permission inheritance and search can still expose secrets if the user has View at a parent level. Verify effective permissions after the change with a test account in the helpdesk group.