Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to make my folders private, so that they can only be accessed after logging in with my own account, but be inaccessible by other local accounts, even the administrator accounts.

I have a PC with windows 8 Professional.

I know I can set the security options for a folder and deny full control access for any other account already created. But since there are other Administrator accounts, new accounts can be created from there and then my folder will be accessible from there.

And if I deny access for ALL administrator group, then even I myself wont have access to my folder!

What is the solution?

share|improve this question
1  
Have you considered something like EFS? –  Louis Feb 21 '13 at 17:43
2  
Can you explain? I did try to active encryption on these folders. To my surprise, I still was able to open the folder that I encrypted via another Administrator account! However I could not changes files there. –  cybergeek654 Feb 21 '13 at 17:47
    
I would try encrypting a (test) file, deleting the certificate, and finally importing it but only for the current user. –  Louis Feb 21 '13 at 17:54
    
These local or domain administrators. The simply solution would be to create a user group. If you can only view the files what was the problem? If you encrypt the contents of a folder which contains folders you should view the contents of the encrypted folder even as an administrator. Furthermore why is everyone an administrator? –  Ramhound Feb 21 '13 at 18:06
    
@Ramhound It is a shared PC and I don't want to get an exclusive access over all computer. I just want my own files and folders to be private. Can you explain how I should create the user group, and how it will give my access, while banning other administrators? –  cybergeek654 Feb 21 '13 at 18:16

2 Answers 2

within the windows ecosystem, there is NEVER a way to keep an admin out of your files, especially if they have physical access to the machine. Trying to keep admins out is a good way to lose access to your own files.

instead look at an external encryption solution like Truecrypt or even PGP/GPG. MS EFS goes a long way, but if another user can export your cert, its completely worthless for your usecase.

share|improve this answer

You can make it slightly more difficult for them by changing Owner of the file to be you and removing (not deny, but remove) the Administrator's permission in the advanced file permissions options, but this will only prevent them from being able to access the file without taking ownership. As a system admin, they will be able to take ownership of the file and then change the permissions to give themselves permissions again.

It is worth noting that this will also break the inheritance of permissions on that directory tree at the point that you do your advanced edit.

share|improve this answer
1  
also keep in mind, NTFS permissions are meaningless if the user can just boot to a liveCD. when most live distros mount a NTFS drive, they treat the user as root. Crypto is the only way to defeat that vector. –  Frank Thomas Feb 21 '13 at 19:32
    
@FrankThomas - yes, that's another good thing to point out. I agree that crypto is the best approach to this goal. My answer is only to explain what the best you can manage without use of crypto is, and it isn't very good. –  AJ Henderson Feb 21 '13 at 19:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.