We have a network of Windows 7 PCs that are managed as part of a domain. What we want is for the domain admin to be unable to view the PC's local drive (C:) unless he is physically at the PC. In other words, no remote desktop and no ability to use UNC. In other words, the domain admin should not be allowed to put \\user_pc\c$ in Windows Explorer and see all the files on that computer, unless he is physically present at the PC itself.
Edit: to clarify some of the questions/comments that have come up. Yes, I am an admin---but a complete Windows novice. And yes, for the sake of this and my similar questions, it is fair to assume that I am working for someone who is paranoid.
I understand the arguments about this being a "social problem versus a technical problem", and "you should be able to trust your admins", etc. But this is the situation in which I find myself. I'm basically new to Windows system administration, but am tasked with creating an environment that is secure by the company owner's definition---and this definition is clearly very different from what most people expect.
In short, I understand that this is an unusual request. But I'm hoping there is enough expertise in the ServerFault community to point me in the right direction.
This post, from the Technet forums, by Yan Li explains it easy enough:
Still, it isn't good practice to do this. You are preventing access to things that should be accessible for a domain admin. It's akin to changing the locks on your apartment so your landlord can't get in.
Use encrypted volumes with a 3rd party encryption utility like TrueCrypt.
This is the only way to prevent an admin from having access to data it should not have. It is sufficient against an honest admin, but it is not sufficient against a malicious admin, which could still install key-loggers or use remote access tools to view the volume content while a volume in unlocked.
As for those wondering why you would want to lock out an admin from the data, it is just BAD PRACTICE that by default, admins have access to any kind of confidential data, be it financial data, personal employee details, research data, etc. They should not.
Part of an IT administrator's job should be to make sure that no single administrator account being compromised will lead to the intruder having full access to all the company data.
Is there a written company policy about who, and why any particular information is to be accessed on a networked computer, and why this particular info needs to be on a networked computer in the first place? If this is data is for this office only, why not budget a extra laptop or use an old "offline" computer that can be only accessed in the actual office? A laptop in the safe can't be easily stolen or accessed. Fires, flooding, tornadoes, hackers in China, India etc. Then connect it only when you have to.