We need the files to be encrypted so that someone ont he file server
can't view them.
You have apparently confused what encryption is. Encryption does not prevent someone on the file server from viewing them. Encryption prevents someone from taking the files and opening them elsewhere.
What you're speaking of is access control.
Determining who can access the share needs to be controlled solely by
me. So not even a root admin can change who has access.
And now you've apparently confused what access control means. There are certain things that cannot be done (without inglorious hacks), and one of them is preventing file access to the topmost administrative account.
Is there a way to do this? Or should I get a DropBox account for the 3
of them?
Solving any of this with DropBox is akin to not trusting a safety deposit box at your bank, so you put title deeds in a Fisher Price safe. Enjoy that. (Also, you've transferred access to your files to a different service that has their own root account that can get to your stuff... it's just a root account that you in essence don't see, so if it's out of sight I suppose that gives you a certain peace of mind?)
Here's what you do:
- Get your EFS encryption keys made and protected.
- EFS encrypt the file (it's as easy as a right click).
- Divvy up access to the file using standard security groups, and add users to the group.
- Don't give access to the Administrator account to people that you don't want to have access to that file.
Alternatively you can simply encrypt the whole drive with BitLocker. Alternatively you can implement some pretty crazy expensive security software that can implement more specialized privileged account management within a Windows environment, but be prepared for some beaucoup bucks to be hemorrhaged straight out of your wallet.