1

I want to ask you that, how to prevent a new folder creation in the desktop for a limited account user. I had changed the security and give privilege to Administrator only for C drive. But still it is possible to create a folder or file in desktop, but none other places in C drive. And at the same time, when log in as Administrator it should be possible to create files and folders as normally.

2 Answers 2

1

That's normal, users are granted write access to most of their user profile by default, which includes %userprofile%\Desktop. Much of the contents of %userprofile% are modifiable, even when the rest of the system drive is locked down.

Be warned, though: Results may become unpredictable if you remove write access to the wrong parts of users' profiles (like their registry hives).

0

The reason it is not limited for the users profile is because not every directory inherits permissions from it's parent directory, and with good reason.

What about My Documents and Favorites, do you want to prevent limiter users from creating folders anywhere within their local profile?

I believe you'll need to change permissions on the Default User profile folders. Set the user group or account you want to limit to only have Read access.

For specific user or per-user settings, go to each person's profile directory and do the same.

And like Jason above noted, you do not want to just limit the entire profile directory because there are things written in that directory that are normal and expected without compromising security.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .