Security concerns with moving temp folder in Windows 7

Question

I'm thinking about moving the Windows 7 temp folders to a different partition to prevent excessive fragmentation. However, my concern is that if I simply change %TEMP%, user specific temporary files will lose their protection against read or write attempts from processes of different users.

Is my concern justified? How do I work around this?

Answer 1

The protection is based on standard NTFS access lists. By default, they inherit the ACL from the user profile directory.

• When you create the temp folder, lock it down:

  icacls "%Temp%" /grant:r %Username%:F
  

  (/grant:r will replace the existing inherited permissions.)

  Alternatively, right-click on your new temp folder, click Properties and open the Security tab.

• If you are going to batch-create the folders for all users, make sure you have their ownership right.