3

I wish to password protect specific programs before they are executed.

For instance, I have just downloaded Google Chrome, and have a shortcut for it on my desktop.

I am wondering if it is possible that when a user goes to launch Chrome, this launches a WinForm .exe that requires the user to enter a password before Chrome loads. If the password is incorrect then Chrome will not load.

I aim to do my development in C#.

2
  • 14
    This wouldn't prevent the user from just finding and launching the actual Chrome executable, or even installing their own. Why not use the permissions already built in to the host system? Windows can restrict application access by user account.
    – David
    Nov 7, 2011 at 18:27
  • I see that makes more sense, how can I do that?
    – Jambo
    Nov 7, 2011 at 18:30

3 Answers 3

3

This is mostly directed toward your comment on the OP.

Go into Chrome's Program File Folder.

Right click the .EXE
Click Properties
Go to the Security Tab
Go to each User and unselect Read/Write for the ones you don't want to have permission
Give Read/Write to the users you want to have access

0

If your scenario is relatively typical, i.e., if you're the owner of the machine & have admin access, then the "traditional" model is to:

  • create individual (non-admin) accounts for other people who use this machine (implicitly, most software installations will be prohibited except for a few applications like google chrome, which support per-user installatinos)

  • prohibit via group policy (supported by narrow list of microsoft apps)

  • for application-specific prohibitions, tweak NTFS perms to disallow access to some users

-1

If you are trying to restrict your users from certain programs, this is an ineffective method.

This sounds like the terribly difficult and convoluted solution to a problem. In order to effectively make such a solution, you'll need to intercept file system calls to Chrome.exe, which will probably require you to write a low level driver since AFAIK there isn't an API for such functionality.

And if you manage to write such a driver, anyone with admin privileges can override this tool by simply uninstalling the driver.

A better solution is to use EFS to encrypt it. EFS is pretty transparent, key based, and cannot be overridden by someone with Admin privs, unless they are setup to have a recovery certificate.

Cistoran's solution above works as long as no one else has Admin privs.

Not the answer you're looking for? Browse other questions tagged .