0

My surface tablet is shared with a friend. She uses a separate account, with admin rights.

Being an admin, she is able to gain access to all my files. Even my OneDrive files.

I guess I could follow these steps to prevent this (it basically states that you'll need to disable access for the targeted administrator), but the same scenario would be present if I were to create another administrator account.

You could say "don't make her administrator", but I don't want to mess with her personal files as well.

Somehow this feels as a security flaw... or am I mistaken?

Is there any way to protect private files from "administrator eyes" by default?

7
  • 2
    This is not a bug, it's a feature. May 13, 2015 at 23:00
  • 2
    What you want is not possible. An Administrator can take ownership of any folder on the device. So making her NOT an Administrator is your only option.
    – Ramhound
    May 13, 2015 at 23:00
  • 3
    Her not being an admin won't mess with her files. Ideally, neither of you use an admin account except when one is required to install software. May 13, 2015 at 23:02
  • 2
    What you want is not possible. An Administrator is suppose to be able to take ownership of any folder or file on a Windows machine. Why is a User, your friend, be given Administrator access to your personal device. How would changing this user's user group effect the user's files? All the accounts should be Users and only when required should an Administrator user's password be used to escalated the permission of process when required. A password you should keep to yourself.
    – Ramhound
    May 13, 2015 at 23:04
  • Can you be specific as to what model Surface you're using and the version and edition of Windows? Your options vary depending on what edition of Windows you're running.
    – bwDraco
    May 13, 2015 at 23:06

3 Answers 3

9

Administrators are just that, they administer the computer, above regular users.

The correct way would be to make the two "Limited" users - One for you, one for her. Create a third Administrative user that is used just for installing programs and doing system wide changes. You can even configure Windows 8 Pro to allow regular users to install Windows Updates! The MS Store can be accessed with regular users.

Why did she get Administrator access? That's where the flaw is, not with Windows. Just because you don't want this to be the answer (not having her be Admin) doesn't mean it's not the correct answer.

2
  • Although I understand your explanation, I do not totally agree. Of course its easy to set up the 2 limited users and the administrator account. But, since OneDrive (formally skydrive) came in place, which is able to sync data from personal devices like phones, tablets, (pictures, videos, one-note, etc), which are personal devices, I do think it would be reasonable require that that data is protected against administrators by default. I think this could be easily implemented in the OS since the accounts are bound to microsoft accounts, which potentially implies user authentication.
    – Stefan
    May 14, 2015 at 10:22
  • One drive syncs a copy of your data to your hard drive. As far as the file system is concerned, they are local files. The one drive daemon can't protect local files from being accessed by administrators, by design May 14, 2015 at 14:33
4

If you encrypt the file or files that you don't want anyone else to access, then those files can only be opened from your account. Admins would only be able to see metadata about the files, like the filename, created, modified dates, etc. You want to be VERY careful that you don't lose your username/password combination or you'll never be able to open the file again.

Make sure you're logged in under your account and right click on the file or files and click "Properties", then click the "Advanced" button and check "Encrypt contents to secure data." Then click Apply/OK. The encrypted files will usually change color to green, that's normal.

If you encrypt a folder then any new files you create in that folder will also be encrypted.

You should keep an un-encrypted backup of all your files in a separate location just in case.

2
  • Is this encryption bound to the Microsoft Account? Because that would really help if the password needs to be recovered :-).
    – Stefan
    May 14, 2015 at 10:25
  • 1
    No, even though you are logging in with a Microsoft Account, you are in fact still using a local Windows account linked to a Microsoft Account. Using Windows File Encryption (EFS) is based on a certificate created and bound to that local account, if you loose the account/certificate your Microsoft account will not help you decrypting your files. I do not recommend EFS for home use, you really need to know what you are doing and have to have a proper key backup strategy in place. Give up your admin rights!!!! May 15, 2015 at 11:52
3

Your device uses NTFS - The Encrypting File System (EFS) is a component of NTFS and may allow you to encrypt your files. It's not something I've looked into much or even played with, but you may want to read about it.

Otherwise users should NOT have admin access - if she gets infected with an encrypting virus, she could easily infect your files and key systems files with admin rights. Removing her rights should not remove her ability to access files she needs unless she's done something really silly.

0

Not the answer you're looking for? Browse other questions tagged .