Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is it possible in Windows 7 to lock a file for writing by only one program? anyone can have read or copy accesss, but I need write/move/delete to be done only by one program.

share|improve this question

2 Answers 2

Typical answer: No. Windows NT security is applied to SIDs (users, groups, special groups...). Programs do not 1 2 have unique SIDs which could be used, and you cannot add a process name or path to any ACL.

All programs run by the same user have the same SIDs – of that user and all groups they're in. (The login SID is different for every session, but it still remains the same within a session.)

You could, however, create a separate user account just for that program, then use "Run As..." to launch the program. The account could be hidden from the "Welcome" screen easily.

runas /user:myapp /savecred /noprofile "myapp.exe"

Some programs (usually viruses and anti-virus tools) install system drivers which hook Windows kernel functions to disallow modifying certain files or registry values except by certain processes (for example, only allow disabling the antivirus from its own GUI). This requires a lot of work (writing a driver, making sure it won't crash the user's system, finding a way to verify the process...) and likely will not work reliably in later Windows versions (Vista and above).


1 Windows services do get an unique SID as of Windows Vista and Server 2008. (However, they also lost the ability to be run interactively, so this won't help you.)

2 Metro apps in Windows 8 have their own SIDs, known as App Container SIDs.

share|improve this answer
2  
The "Create a account for the app" trick is actually used by Microsoft itself. This is often how SQL Server manages it's own permissions. You will see a users/groups called called something like NT SERVICE\SQLAgent$SQL2008 that the program uses. Another classic example is the ASPNET user that gets installed with IIS. –  Scott Chamberlain Jan 23 '12 at 18:20
    
It's very common for servers on Unix as well. Not for client applications, though, since authentication as that user would become tricky. –  grawity Jan 23 '12 at 18:24

This is a standard lock on a file. Generally it is accomplished by opening the file in a program. Unless a program explicitly says that it can be shared, the file will then be locked.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.