Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

We in our club have a computer with Windows 7 Professional that every club member may use. And everyone has their own separate account.

Those accounts have to have administrator priveleges since I want everyone to be able to install any software and use any feature they want. However, there is a single thing that they shouldn't be allowed to do - that is, look into another users' profiles. Now when anyone goes to 'c:\Users(Any User Name)' a little prompt appears that this folder is secured and whether you really want to look inside. Simply clickinh 'ok' give you access to any profile.

I tried disabling taking ownership for Administrators group in Group Policies but that had no effect. How can I effectively prohibit administrators looking into each others' profiles and documents?

share|improve this question

4 Answers 4

You can't, it's as simple as that.

share|improve this answer
    
Any prooflink on that? Isn't there any way to protect a directory from an administrator on NTFS partition? –  kojo Apr 17 '10 at 23:06
2  
How can you protect a directory from an administrator? The administrators group inherently has the ability to change permissions on NTFS volumes, so no matter what you change it to, they can change it back. –  MDMarra Apr 18 '10 at 0:27
    
And limiting 'Administrators' group's permissions is also impossible? And there is no easy way of creating a new group that may do anything except for changing permissions on main NTFS partition? –  kojo Apr 18 '10 at 21:45
1  
@kojo - I think you're trying to solve this problem the wrong way. Having users keep files on a network share with the necessary ACLs or even a flash drive that you carry with them would be more appropriate than trying to neuter the Administrators group. –  MDMarra Apr 21 '10 at 15:03
    
This is true. The admin group is a built in group. The permissions cannot be changed. –  surfasb Mar 8 '11 at 13:08

Try to change your point of view: change every account in common users, then give 'em permission to install softwares, thus holding your super-admin-powers for yourself!

share|improve this answer
    
Thought of that. Though, it seemed to me that difference between User and Administartor in Windows 7 is not only installation of sofware. They should be able to succesfully elevate in UAC and be detected by legacy software as administrator. I just thought there must be an easier way. –  kojo Apr 17 '10 at 23:04

Probably the best solution is for each user to encrypt their files using EFS. While you cannot prevent other admins from listing the contents of each folder, EFS will encrypt the files to where not even an Admin can decrypt them unless it has been provided a copy of the private key or a backup certificate.

Since the Administrator group is built in, you cannot change the permissions for it.

share|improve this answer

Actually, you can specify each user and DENY them security privileges.

For instance, you have users: Bob, Tom, Harry, and Joe. On Joe's user folder, specify that Bob, Tom, and Harry cannot access it. (DENY their security privileges.)

It's time consuming, but it's an answer.

share|improve this answer
    
If you explicitly deny a user who's part of the administrator group, it still won't work. As an admin, they can seize ownership of the file and reassign the permission. –  surfasb Mar 16 '11 at 0:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.