Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am running windows 7 x64.

I am sharing my PC with a brother who plays a lot of games and runs all kinds of questionable programs that might have trojans, etc. A lot of that software needs admin privileges to install/run, especially the games. I want him to play games on his own disk, without damaging/corrupting my disks (which has already happened twice).

Is it possible to completely restrict access to either folders or entire volumes / disks to processes running with admin privileges?? And admin users?

I'm not too happy about going the encryption route as it will be impossible to access the data without Win7, and also, its time consuming - i have several large disks.

I do not mind running two copies of Win7 in separate partitions, as long as admin account & hostile processes in one Windows cannot see the disks accessible to the other copy of Windows.

Thanks.

share|improve this question

migrated from stackoverflow.com Nov 1 '10 at 21:04

This question came from our site for professional and enthusiast programmers.

    
Your Brother needs his own computer, no real solution to your problem when sharing a PC, malware is smart and nasty these days. He has a track record of damaging your system, that should be all you need to know. –  Moab Nov 2 '10 at 2:12
add comment

4 Answers 4

up vote 1 down vote accepted

You do have options. You may not like them.

  1. Physical control. There are hot-swappable drive bays (which I mention because they are designed for ease of swappability, not because you would EVER want to swap them while the machine was running), or you might be able to find a physical switch that will switch between two hard drives.... I've never seen one, but I've never looked. In any case, if the drive is not attached to the machine, he can't affect it, regardless of privileges.

  2. Encryption. You can use OS-independent encryption like TrueCrypt. The time-consuming part is one-time (only for encryption), and you should be able to decrypt it later, regardless of the OS you use. I've found encrypted hard disks not to noticeably affect performance even on a limited CPU like a laptop. The down-side of this option is twofold.

    A. Since the hard drive is still connected, your brother could still corrupt the attached, encrypted disk.

    B. You are vulnerable to the "Evil Maid" attack in the situation where your brother acquires super-sophisticated spyware / viruses.

share|improve this answer
    
Hot swappable bay is my best choice by far. Now I just gotta find one for decent price. –  Saideira Nov 5 '10 at 16:25
add comment

You can restrict files and folders to those with admin rights. You can do this by using Windows Explorer. Right click on the file and go to Properties, Security settings. Add an Everyone group if it isn't already there. Then click Deny for each right that you want to Deny.

share|improve this answer
    
This will stop most malware and the casual user, but Administrators by default have SeTakeOwnershipPrivilege, and the object's owner can remove "Deny" permissions. –  grawity Nov 1 '10 at 22:34
add comment

A software solution would be to lock the BIOS, and have it

  • Not recognize your disk
  • Boot to your brothers disk

Then, when you want to boot, you need to change the BIOS, but you will have to remember to change it back afterwards!

Using a boot-loader like XOSL, you can hide/unhide partitions automatically without having to change the BIOS. I haven't used it for a while though, so I'm not sure how well it works nowadays.

share|improve this answer
add comment

Another answerer suggested using hot-swappable drive bays to allow you to easily pull your HD out and switch it with your brothers but there is another solution that might be cheaper for you.

Using a SATA power switch could allow you to toggle between 1-3 devices and depending on your electronics/soldering capabilities you could even build your own on the cheap based on this tutorial: http://www.extremetech.com/extreme/82086-build-your-own-sata-hard-drive-switch

There are devices on Amazon which allow you to turn up to 4 drives on/off but this wouldn't necessarily protect you against your brother leaving both hard drives turned on. http://www.amazon.com/ORICO-HD-PW4101-Floppy-Switch-Control/dp/B009XPCL5U

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.