Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to set up another User Account on my Windows 7 Professional laptop for use by another person. I do not want that person to have access to any of the files in my User Account on the same machine. This machine has a single hard disk formatted with NTFS. User accounts data is stored in the default location, C:\Users.

I use the computer with a Standard Account (not an Administrator). Let's call my user account "User A."

I have given the new user a Standard Account. Let's call the new user's account "User B."

To be clear, I want User B to have the ability to log in to her account, to use the computer, but to be unable to access any of the files in the User A account on the same machine.

Currently, User B cannot use Windows Explorer to navigate to the location C:\Users\User A. However, by simply using Windows Search, User B can easily find and open documents saved in C:\Users\User A\Documents. After opening a document, that document's full path appears in "Recent Places" in Windows Explorer, and the document appears as a file that can be opened using the "Recent" feature in Word 2010. This is not the desired behavior. User B should not have the ability to see any documents using Windows Search or anything else.

I have attempted to set permissions using the following procedure.

  1. Using an Administrator account, navigate to C:\Users and right-click on the "User A" folder. Select "Properties."

  2. In the "User A Properties" window that appears, click the "Security" tab.

  3. Click the "Edit..." button to change permissions.

  4. IN the "Permissions for User B" window that appears, under "Group or User Names," select User B.

  5. Under "Permissions for User B", check the box under the "Deny" column for the "Full Control" row. Ensure that the "Deny" box is automatically checked for all the other rows, and then click "OK."

The system should then begin working. The process could take several minutes.

When I followed this procedure, I received several "Access Denied" errors, suggesting that the system was unable to set the permissions as I had directed. I think this might be one of the reasons why User B is still able to access files in User A's account folders.

Is there any other way I could accomplish my goal here? Thank you.

share|improve this question
1  
The "access denied" messages result from attempting to alter the junctions in your profile folder, which even administrators cannot access. It really shouldn't be necessary to have Deny entries for userB, simply the lack of read permissions should suffice. Something's very broken in your setup, but I don't know what. –  kreemoweet Feb 2 '12 at 19:02

1 Answer 1

up vote 1 down vote accepted

I solved this problem by slightly changing the procedure I outlined in the question. Basically, instead of clicking "Deny" under "Full Control," I individually selected each permission I wanted to deny. I'm not sure why this works, but it does.

First, I deleted User B and recreated User B, to clear up any confusing and contradictory permissions. Then, I followed this modified procedure.

  1. Using an Administrator account, navigate to C:\Users and right-click on the "User A" folder. Select "Properties."

  2. In the "User A Properties" window that appears, click the "Security" tab.

  3. Click the "Edit..." button to change permissions.

  4. I the "Permissions for User B" window that appears, under "Group or User Names," select User B.

  5. Under "Permissions for User B", check the box under the "Deny" column for the "Read & Execute," "Modify," "List Folder Contents," "Read," and "Write" rows. Click "OK."

The system should then begin working. The process could take several minutes.

share|improve this answer
2  
Be very careful with Deny. It is generally advisable to simply remove the Allow entries. Deny will always take precedence. So if a user due to group membership matches a Deny ACE, you may be surprised. –  0xC0000022L May 24 '12 at 2:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.