Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

We in our club have a computer with Windows 7 Professional that every club member may use. And everyone has their own separate account.

Those accounts have to have administrator priveleges since I want everyone to be able to install any software and use any feature they want. However, there is a single thing that they shouldn't be allowed to do - that is, look into another users' profiles. Now when anyone goes to 'c:\Users(Any User Name)' a little prompt appears that this folder is secured and whether you really want to look inside. Simply clickinh 'ok' give you access to any profile.

I tried disabling taking ownership for Administrators group in Group Policies but that had no effect. How can I effectively prohibit administrators looking into each others' profiles and documents?

share|improve this question

6 Answers 6

You can't, it's as simple as that.

share|improve this answer
    
Any prooflink on that? Isn't there any way to protect a directory from an administrator on NTFS partition? –  kojo Apr 17 '10 at 23:06
2  
How can you protect a directory from an administrator? The administrators group inherently has the ability to change permissions on NTFS volumes, so no matter what you change it to, they can change it back. –  MDMarra Apr 18 '10 at 0:27
    
And limiting 'Administrators' group's permissions is also impossible? And there is no easy way of creating a new group that may do anything except for changing permissions on main NTFS partition? –  kojo Apr 18 '10 at 21:45
1  
@kojo - I think you're trying to solve this problem the wrong way. Having users keep files on a network share with the necessary ACLs or even a flash drive that you carry with them would be more appropriate than trying to neuter the Administrators group. –  MDMarra Apr 21 '10 at 15:03
    
This is true. The admin group is a built in group. The permissions cannot be changed. –  surfasb Mar 8 '11 at 13:08

Try to change your point of view: change every account in common users, then give 'em permission to install softwares, thus holding your super-admin-powers for yourself!

share|improve this answer
    
Thought of that. Though, it seemed to me that difference between User and Administartor in Windows 7 is not only installation of sofware. They should be able to succesfully elevate in UAC and be detected by legacy software as administrator. I just thought there must be an easier way. –  kojo Apr 17 '10 at 23:04

Probably the best solution is for each user to encrypt their files using EFS. While you cannot prevent other admins from listing the contents of each folder, EFS will encrypt the files to where not even an Admin can decrypt them unless it has been provided a copy of the private key or a backup certificate.

Since the Administrator group is built in, you cannot change the permissions for it.

share|improve this answer

Actually, you can specify each user and DENY them security privileges.

For instance, you have users: Bob, Tom, Harry, and Joe. On Joe's user folder, specify that Bob, Tom, and Harry cannot access it. (DENY their security privileges.)

It's time consuming, but it's an answer.

share|improve this answer
    
If you explicitly deny a user who's part of the administrator group, it still won't work. As an admin, they can seize ownership of the file and reassign the permission. –  surfasb Mar 16 '11 at 0:30

If you want to protect files from other admins or restrict them to spesific group, you want to use ACL's. But All administrators can take ownership of files. In domain or local security policy, change take ownership of files permission to spesific group and their members.

Second method is smoother but dangerous.. If you use EFS, nobody can steal, view, copy or use your files. But you still need to protect your efs certificate and hide it in a safe/personal location.

plus, if an administrator account has EFS recovery agent permission, he/she can decrypt your files..

share|improve this answer

You can change the ownership to your folder to your only (remove all other users).

But trick only prevents others administrators until they retain ownership. If they don't know how to change ownership, you are safe.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.