Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

By default, C:\Program Files, C:\Windows are UAC protected. How to make additional folders to be UAC protected?

share|improve this question
What exactly do you mean by "UAC protected"? What is the behaviour you're trying to replicate? – Harry Johnston Jun 15 '12 at 2:59
When you need to make changes inside that folder, such as overwriting a file, creating a folder, deleting a file, etc..., UAC prompt will show up and the user confirm the action – linquize Jun 15 '12 at 4:39
This will happen for any folder that doesn't grant write permissions to the user in question or to all users. Remove write access for groups like "Users", "Everyone", or "INTERACTIVE". Secure folders typically only grant write permission to the Administrators group, CREATOR OWNER, and SYSTEM. – Harry Johnston Jun 15 '12 at 5:36

Change the folder permissions.

  1. right click on the folder
  2. select Properties
  3. in the Security tab
  4. click Advanced
  5. under Owner tab click Edit
  6. Select Admin

To keep non-Admin users from accessing the folder:

  1. Go to the same Security tab
  2. Click Edit
  3. Deny Full Control by checking the deny box
share|improve this answer
how? which user should enable / disable what permisions? – linquize Jun 13 '12 at 8:20
Deny Full Control will deny all access, including read access, and typically will block administrators as well as non-administrators; e.g., if you Deny Full Control to Users, you'll block out everyone, because Users includes Authenticated Users and deny entries take precedence. – Harry Johnston Jun 15 '12 at 5:35
@HarryJohnston: Deny Full Control only applies to the user in question. Actually I suggested blocking non-Admin users. He can select them at his own discretion. – WikiWitz Jun 15 '12 at 5:37
What, you mean give each user you don't want to have access an individual deny entry? That would work, I suppose, on non-domain-joined machines, provided you remembered to update the permissions every time you added a new user. But blacklists aren't good practice except in special cases. Instead, you should grant access only to the specific users you want to have it, which in this case would be the Administrators group. – Harry Johnston Jun 15 '12 at 5:42
Also, deny entries won't work at all in this case, because the user wants to be able to gain access via the UAC approval dialog. Since the elevated token contains all the security primitives contained in the non-elevated token, any deny entry that applies to the non-elevated user will also apply to the elevated user. – Harry Johnston Jun 15 '12 at 5:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .