Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When you purchase a windows PC nowadays, you don't actually "own" the whole disk...

There are so many ACLs on each folder that there are portions of it you actually can access only through a complex sequence of actions requiring skills well beyond the average PC user. You have to drill down to deeply buried dialog boxes accessible through concealed buttons. You have to understand at which level of the hierarchy you have to take ownership, remove ACLs etc...
Yet when you think of it, that's your PC, that's what the "P" of PC originally stand for...
So I'm toying with the idea of just stripping the disk of all ACLs I just purchased and leave standard file protections do the basic protection work... Just like previous century Windows used to do... (before I chmod -R 777 ;-)

Has anybody done that already and nevertheless survived in reasonably good shape for a reasonable amount of time ?

Any technical advice to do that ? Powershell script ? basic script using iCACLS ?

share|improve this question

migrated from stackoverflow.com Jan 29 '11 at 14:04

This question came from our site for professional and enthusiast programmers.

    
ha! just format the freaking drive! ;) no, really, ask in superuser.com –  Mauricio Jan 29 '11 at 9:04
    
What do you mean by "standard file protections"? Isn't that what ACLs are in an NT environment? –  Cody Gray Jan 29 '11 at 9:12
3  
"Yet when you think of it, that's your PC..." So stop thinking of it. These protections were put in place to protect us from ourselves (and malware). Take a minute and think about how much more stable and secure Windows 7 is compared to Windows 98. Now, do you still want to remove NT security? –  Cody Gray Jan 29 '11 at 9:17
1  
Give a man a microwave oven, and they still want stone knives and bear skins. –  Moab Jan 29 '11 at 15:25
1  
Of course, there's always the registry. Perhaps it may be worth stripping all the ACLs out of that too. Then you can totally OWN your computer. –  David Heffernan Jan 29 '11 at 19:14

3 Answers 3

up vote 3 down vote accepted

Here is a powershell function to remove ACLs of a specifed user from directories.

function Nuke {
param(
    $Directory,
    $Group
)
$acl = get-acl $Directory
$account = new-object system.security.principal.ntaccount($Group)
$acl.purgeaccessrules($account)
set-acl -aclobject $acl -path $Directory
}

Not sure how much luck you will have when you point it at the root of C

share|improve this answer
    
Some PLEASE do this.. –  Kyle Feb 3 '11 at 17:10

I don't understand why you need to do this. UAC stops me writing files in places I shouldn't (system folders, program files etc.) ACLs are needed to make that happen. Why would you want to change?

What's more, if you are a developer, and I presume you are since you are asking the question here, using such a non-standard machine will only result in you producing software that fails when it runs on a standard machine, because all the normal security will be present.

All developers should run with UAC turned up full and should never modify the ACLs of system components.

share|improve this answer
1  
I upvoted this again after it was migrated to Super User. Just because I could. –  Cody Gray Jan 30 '11 at 7:55
1  
It's a good answer to a strange question. –  Kyle Feb 3 '11 at 17:09

I suspect that what you are proposing could easily end up being counter-productive, with your PC ending up be less "yours" and more the propertery of some bot-herder.

share|improve this answer
1  
+1 for facetiousness. I love it. –  x0n Jan 29 '11 at 14:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.