Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Win 7, protect folder with two admins

I want one admin account to be able to read and write to a Windows 7 folder, other admin accounts on the machine should only have read access.

Folder name = C:\SensitiveData

On the machine there are 2 admin accounts and various user accounts AdminAccount1 = normalAdmin AdminAccount2= sensitiveDataAdmin

I want only sensitiveDataAdmin to be able to read and write to the C:\SensitiveData folder, and all normal users and other admin users to be able to read from it.

Some background on why we want this. The PC is not on a domain or network, it is just stand-alone and connected to the internet. It has an application that saves data to the cloud, however when the cloud is down we want to save this sensitive information to local disk but not allow anyone to delete or modify the data (only to read it).

share|improve this question

marked as duplicate by Dave, Dave M, Canadian Luke, 8088, Kyle Jones Jan 9 '13 at 22:18

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

@Dave Rook - I don't think this is a duplicate of the question you have linked to. He wants to give other users read access and for only the owner to have right access. The question you link to states the problem as being both admins being able to view the folder. – Tog Jan 9 '13 at 15:28
Yes I definitely require that all users have read access but only the one admin able to write, and other admins read only. – DermFrench Jan 9 '13 at 15:36
@DermFrench, so you want to give administrators different permissions? – Dave Jan 9 '13 at 15:38

You cannot do this. The point of an administrator is that they are an administrator. You may be able to do this on a domain by creating "nearly administrator" type groups.

There could be some specialist software which aids you but it's not possible with Windows alone, especially not on a workgroup.

share|improve this answer

From the Ten Immutable Laws of Security:

Law #2: If a bad guy can alter the operating system on your computer, it's not your computer anymore.
Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.
Law #6: A computer is only as secure as the administrator is trustworthy.
Law #7: Encrypted data is only as secure as its decryption key

Reminders of fundamentals out of the way, the other guys here pretty much have it right. Without a domain, you will not be able to effectively protect C:\SensitiveData from NormalAdmin. Even with a domain, if the information is stored locally on a system where NormalAdmin has Administrator permissions, protection of that data via file permissions may still be ineffective. Plus, depending on how really worried you are about NormalAdmin getting access to this data, there's still the "physical access" issue.

The only protection that will likely survive attacks involving physical access, or an attacker with Administrator rights to the system, is file encryption. This is where Law #7 comes into play. If you're going to encrypt the files, and don't want NormalAdmin to have access, make sure that the decryption key is protected by some mechanism that NormalAdmin does not have, or cannot casually acquire, access to.

Even with file encryption though, NormalAdmin could still get the data if he wanted to try hard enough. With unrestricted, unsupervised physical access to the system (and especially with pre-existing Administrator privileges) he can pretty much do whatever he wants to it. This includes installing keyloggers or other spyware that could facilitate him gaining access to locally-stored decryption keys. Or, he could write and install a script to copy off the sensitive data whenever a user decrypts it. Granted, these methods are much more invasive and require a good deal more effort than just casually changing file permissions. But the point is that the risk still remains. See Law #6.

NOTE: All of the above is really only discussing access to the files in general - an all-or-nothing permissions scheme. If you want to get down to a scheme that allows NormalAdmin to have read access, but effectively prevents him from gaining write access, the problem gets even harder (if not impossible).

share|improve this answer
the users do not have any ability to install programmes if that helps, they are just running as bog standard users. – DermFrench Jan 9 '13 at 15:35
But we're not talking about users. We're talking about Administrators. You want NormalAdmin to not have access while SensitiveAdmin does - this is generally not feasible, or at least will not likely be possible in a way that cannot be readily circumvented. – Iszi Jan 9 '13 at 15:46
Sorry I've explained wrong, I want normal admin not to have write access (but to have read access). The people who will be logging in as normal admins are generally only installing 3rd party tools they are not technically great. – DermFrench Jan 9 '13 at 15:48
@DermFrench Yeah, I just caught that. See my final note. In the end, it all comes down to Law #6. – Iszi Jan 9 '13 at 15:48
I've edited my original question to say normal admin users can read. – DermFrench Jan 9 '13 at 15:48

Similar question was asked yesterday Win 7, protect folder with two admins . If encryption is an option that may be the solution.

share|improve this answer
The suggestion in there doesn't suit me, as I can't risk another admin (or another user) deleting the folder. – DermFrench Jan 9 '13 at 15:04

Not the answer you're looking for? Browse other questions tagged .