Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows 7 SP1 Ultimate box which is my main machine / "server". I also have an 'accountant' account (of type: standard user) which is for my accountant to RDP into the machine to check up on my QuickBooks from time to time. The actual QuickBooks files are sync'd using DropBox between 1) my user account on main machine 2) accountant account on main machine and 3) my account on my laptop. Since only one person uses QuickBooks at a time (and dropbox has a revert feature) this isn't a problem.

I would like to harden the setup a bit more by the following:

  1. Prevent access to any drive that is not "C:". Currently I've added NTFS permissions to DENY access to the accountant account but that doesn't work for FAT drives nor for USB drivers whose drive letters change
  2. Prevent the accountant account from shutting down the machine
  3. Prevent the accountant account from browsing C:\ 'freely'

My guess is these requirements are not new or exotic so may have been already addressed by some tool in the IT industry. Granted it's not a server OS, but how can I get as close to my needs as possible?


share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.