windows 7 - lock a file for writing by only one program?

Question

Is it possible in win7 to lock a file for writing by only one program? anyone can have read or copy accesss, but I need write/move/delete to be done only by one program.

Answer 1

Typical answer: No. Windows NT security is applied to SIDs (users, groups, special groups...). Programs do not ^{1 2} have unique SIDs which could be used, and you cannot add a process name or path to any ACL.

All programs run by the same user have the same SIDs – of that user and all groups they're in. (The login SID is different for every session, but it still remains the same within a session.)

You could, however, create a separate user account just for that program, then use "Run As..." to launch the program. The account could be hidden from the "Welcome" screen easily.

runas /user:myapp /savecred /noprofile "myapp.exe"

---

Some programs (usually viruses and anti-virus tools) install system drivers which hook Windows kernel functions to disallow modifying certain files or registry values except by certain processes (for example, only allow disabling the antivirus from its own GUI). This requires a lot of work (writing a driver, making sure it won't crash the user's system, finding a way to verify the process...) and likely will not work reliably in later Windows versions (Vista and above).

---

¹ Windows services do get an unique SID as of Windows Vista and Server 2008. (However, they also lost the ability to be run interactively, so this won't help you.)

² Metro apps in Windows 8 have their own SIDs, known as App Container SIDs.

Answer 2

This is a standard lock on a file. Generally it is accomplished by opening the file in a program. Unless a program explicitly says that it can be shared, the file will then be locked.