Account permissions on Windows 7 to allow easy access for one account, restricted for another

Question

I have three accounts on my PC:

• Administrator
• Account_1 (Limited)
• Account_2 (Limited)

What I want is to prevent Account_2 from accessing cmd.exe and taskmgr and permit Account_1 to access it easily.

I tried Windows 7's security options, but I was unable to add Account_2 to the list and deny the Read, Write & Execute access.

Answer 1

Try AppLocker. A bit of a sledge hammer for this task but you can easily use it to scope to a user or group of users.

What Is AppLocker? Technet document

Answer 2

Try using XCACLS to set the permissions. Perhaps you can override the Windows UI.

Also, make sure that you are the owner of the file before trying to change permissions. In Windows 7 you can change the owner like this:

• right-click the file and select Properties
• go to Security tab
• click the Advanced button
• go to the Owner tab and use Edit button to change the owner to your current user account
• you should now be able to edit the permissions through the original Security tab or through XCACLS.EXE