Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite

Using Windows Vista. What is the correct and best way to limit access to an entire drive (not the C windows drive) for all users except certain specified users (adhering to principle of least privilege)?

When I look on the Security tab of the drive's properties I see:

Group or usernames:

Authenticated Users
SYSTEM
Administrators (MyComputer\Administrators)
Users (MyComputer\Users)
share|improve this question
Exact duplicate of Windows: Prevent access to a drive for a user? – techie007 Sep 20 '11 at 20:48
1  
Incorrect. That question is about letting all users access a given drive except a specific user. This question is about letting no users access a given drive except a specified user. – User Sep 20 '11 at 20:53
Im guessing this is for other users accessing one PC as opposed to a server? – CodeBlend Sep 20 '11 at 21:28
@CodeBlend correct – User Sep 20 '11 at 21:34

1 Answer

up vote 2 down vote accepted

Remove "Authenticated Users" and "Users" and add the group or usernames you want given access.

If there are already existing files on the drive, you may want to use the "Replace all child object permissions with inheritable permissions from this object" option in order to give them the same restrictions.

This will not stop people with access to the drive from changing the permissions on their own files to grant access to other people.

share|improve this answer
Now, after having done that, would there be a way to access that drive while logged in as a user that is not on the permitted list (maybe using runas or something)? The scenario I'm thinking of is if I'm logged in under that user and I want to temporarily view or copy a file. – User Sep 20 '11 at 21:20
1  
Certainly, provided you are willing to access it from the command line or from within an application. For the command line, you could use RunAs, or you could type "cmd" in the Start Menu and press control-shift-ENTER to bring up the elevation prompt. For other apps, start them from the command line or right-click and select "Run as Administrator". – Harry Johnston Sep 21 '11 at 2:11
2  
What I mean by "from the command line or within an application" is that you can't use Explorer, because it doesn't support elevation. There are third-party file manager apps that can be used as an alternative to Explorer. – Harry Johnston Sep 21 '11 at 2:12
You don't need to elevate Explorer. Just Runas with the correct credentials. – surfasb Sep 21 '11 at 2:29
@surfasb, there are some tasks (such as looking at file properties) that can't easily be done except from Explorer or a third-party alternative. – Harry Johnston Sep 25 '11 at 20:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.