Protecting data from a rogue admin?

I've done some work with retention lock. Only Retention Lock Compliance would prevent a rogue administrator from destroying filesystems, deleting MTrees, etc..

Once Retention Lock Compliance is enabled on the system it can't be disabled. There are some serious operational restrictions imposed on Retention Lock Compliance systems. Some examples:

• Security officer signoffs are required for a number of operational changes. For example, adjusting time sync settings or entering SE mode at the command line.
• Once retention lock is enabled for an MTree, it cannot be disabled.
• It is no longer possible to delete an MTree.
• It's not possible to reduce the minimum or maximum lock periods -- these settings can only ever be increased

Note that these restrictions may also interfere with the correct operation of the backup software. Since retention lock can be enabled on an MTree by MTree basis, it might be best to enable retention lock on an MTree specifically created for that purpose, then fastcopy the data you wish to lock into that MTree instead of trying to retention lock a "live" MTree. Unfortunately this approach would mean you would have to periodically clean up old files out of the retention locked MTree once the lock expired since the backup software would have no visibility into this MTree.

Edit: I forgot to add that actually locking files is done by mounting an NFS export of the retention lock-enabled MTree to an external system and updating the access time of the files to a future date using a utility like the Linux / UNIX "touch" command.

Rentention Lock is great... or one could simply address the real problem:

1)  retrain the rogue

2) counsel the rogue

3)  terminate the Rogue for non-compliance...

However...retention lock gives the greatest chance of success and data protection...