1

I am running windows 7 x64.

I am sharing my PC with a brother who plays a lot of games and runs all kinds of questionable programs that might have trojans, etc. A lot of that software needs admin privileges to install/run, especially the games. I want him to play games on his own disk, without damaging/corrupting my disks (which has already happened twice).

Is it possible to completely restrict access to either folders or entire volumes / disks to processes running with admin privileges?? And admin users?

I'm not too happy about going the encryption route as it will be impossible to access the data without Win7, and also, its time consuming - i have several large disks.

I do not mind running two copies of Win7 in separate partitions, as long as admin account & hostile processes in one Windows cannot see the disks accessible to the other copy of Windows.

Thanks.

Improve this question
1
  • Your Brother needs his own computer, no real solution to your problem when sharing a PC, malware is smart and nasty these days. He has a track record of damaging your system, that should be all you need to know.
    – Moab
    Nov 2, 2010 at 2:12

4 Answers 4

Reset to default
1

You do have options. You may not like them.

  1. Physical control. There are hot-swappable drive bays (which I mention because they are designed for ease of swappability, not because you would EVER want to swap them while the machine was running), or you might be able to find a physical switch that will switch between two hard drives.... I've never seen one, but I've never looked. In any case, if the drive is not attached to the machine, he can't affect it, regardless of privileges.

  2. Encryption. You can use OS-independent encryption like TrueCrypt. The time-consuming part is one-time (only for encryption), and you should be able to decrypt it later, regardless of the OS you use. I've found encrypted hard disks not to noticeably affect performance even on a limited CPU like a laptop. The down-side of this option is twofold.

    A. Since the hard drive is still connected, your brother could still corrupt the attached, encrypted disk.

    B. You are vulnerable to the "Evil Maid" attack in the situation where your brother acquires super-sophisticated spyware / viruses.

Improve this answer
1
  • Hot swappable bay is my best choice by far. Now I just gotta find one for decent price.
    – Saideira
    Nov 5, 2010 at 16:25
0

You can restrict files and folders to those with admin rights. You can do this by using Windows Explorer. Right click on the file and go to Properties, Security settings. Add an Everyone group if it isn't already there. Then click Deny for each right that you want to Deny.

Improve this answer
1
  • This will stop most malware and the casual user, but Administrators by default have SeTakeOwnershipPrivilege, and the object's owner can remove "Deny" permissions.
    – u1686_grawity
    Nov 1, 2010 at 22:34
0

A software solution would be to lock the BIOS, and have it

  • Not recognize your disk
  • Boot to your brothers disk

Then, when you want to boot, you need to change the BIOS, but you will have to remember to change it back afterwards!

Using a boot-loader like XOSL, you can hide/unhide partitions automatically without having to change the BIOS. I haven't used it for a while though, so I'm not sure how well it works nowadays.

Improve this answer
0

Another answerer suggested using hot-swappable drive bays to allow you to easily pull your HD out and switch it with your brothers but there is another solution that might be cheaper for you.

Using a SATA power switch could allow you to toggle between 1-3 devices and depending on your electronics/soldering capabilities you could even build your own on the cheap based on this tutorial: http://www.extremetech.com/extreme/82086-build-your-own-sata-hard-drive-switch

There are devices on Amazon which allow you to turn up to 4 drives on/off but this wouldn't necessarily protect you against your brother leaving both hard drives turned on. http://www.amazon.com/ORICO-HD-PW4101-Floppy-Switch-Control/dp/B009XPCL5U

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .