How do I remove ownership of an external NTFS drive in Windows 7 to allow only certain users of 2 different systems to fully access all files

Question

I have a hard drive I would like to access from two different windows 7 machines. I have been taking ownership to access the files when I switch machines, but I know this is likely inefficient.

I would like to set it up so that only one account on the first machine and only one account on the second machine each have equal and full access and no one else.

Is this possible? Do I need to somehow get rid of ownership to do this?

Answer 1

You must have administrative permissions on both computers to complete this task.

On machine A:

1. Make sure you have full access to all of the files on your portable hard drive, taking ownership, etc. as necessary
2. In Computer, right-click the drive icon for your portable hard drive, click Properties, then on the Security tab click Edit
3. In the Permissions window, click Add...
4. Provide the username you want to have full access to the drive, then click OK
5. Select the just-added username in the Group or user names: box, then enable the Full control checkbox in the Allow column and click Apply.
6. If the Everyone identity is not listed in the Group or user names: box, add it and give it the same Full control permissions by repeating steps 3-5 above, but use the name Everyone in step 4.
7. Click OK to return to the Security tab of the drive properties window, then click Advanced, then Change Permissions...
8. In the Advanced Security Settings window, enable the Replace all child object permissions with inheritable permissions from this object, then click OK. Click Yes when warned that this will replace explicitly defined permissions on descendants. Click OK two more times to close all property windows.

At this point the user account on machine A has full control of the portable drive, as does the Everyone user identity and perhaps other users, which we'll get to.

Connect the drive to machine B:

1. In Computer, right-click the drive icon for your portable hard drive, click Properties, then on the Security tab click Edit
2. In the Permissions window, click Add...
3. Provide the username you want to have full access to the drive, then click OK
4. Select the just-added username in the Group or user names: box, then enable the Full control checkbox in the Allow column and click Apply.

Now, in the Group or user names: box you will see the user you just added from Machine B, the Everyone user, a username shown as S-1-5-21-######..., and possibly other usernames. The S-1-5-21..... user is the one you added on Machine A and must be left alone (Machine B doesn't know the actual username, hence the cryptic name). However, you should remove the Everyone identity along with any other usernames, leaving only the user account from Machine B and the account from Machine A identified as S-1-5-21....:

1. Select the username to be removed in the Group or user names: box, then click Remove.
2. Repeat this for any other users to be removed. Be certain to remove the Everyone user.
3. Finish by clicking OK two times to close all property windows.

You will now have only two user accounts with full control of the drive, one from machine A, the other from machine B.

It should be noted that anyone with Administrator rights on any Windows computer in the world, including your machines A and B can perform the Take Ownership process you have been doing to this point and completely defeat the security you have put into place. The only way to address this on your two computers is ensure that none of the other user accounts on those two computers are administrators.