Noob here.

I've looked around and not been able to find an answer for this on Windows 7 Platform. This pertains to Securing data files.

The basic idea is that files should not be permitted to be modified by the user directly. Only through the use of an designated application can it be modified (Thus Indirectly). The idea is that the Designated Application contains its own authentication, access control and audit logs and can manipulate the contents of the data files and keep a log of the changes it made to the data files.

Here are some illustrations.

There is a directory D to which the User U has no access.

The user U uses Application A to generate data files F1,f2,F3 which the application writes into Directory D.

This illustrates the point that the user can only write into Directory D using Application A to create data files, F1,F2,F3,Fn

If the User U uses Windows explorer (or similar) to rename/delete these files F1,F2,F3,Fn in Directory D, he will be denied access.

If the User U uses Windows explorer (or similar) to read these files F1,F2,F3,Fn in Directory D, he will be denied access. He has to use Application A to read and view these files within Application A.

The only solution that I have found it to elevate privileges using runas with /savecred (admin credentials) but my understanding is that this raises the possiblity of the user using the saved credentials to run some other program (say CMD) and gain unprivileged access to the data files F1,F2,Fn in Directory D

Finally note that this is a Windows 7 Pro Edition which is running in a workgroup.

PS: I have access to admin and can setup the PC as required.

  • There isn't another solution. Applications run with the same permissions as the user who launched them. You can either aunch an application as another user or elevate the application's permissions. If you are worried about a user running authorized programs, deal with that problem, App Locker exists for problems like that. – Ramhound Oct 5 '16 at 17:09
  • Agree with Ramhoundm Aisde form compartmentalizing programs + assoc data into VMs, can't fo much on windoze – aidanh010 Oct 6 '16 at 1:08
  • Services can be run using specific credentials. If you can implement an application to communicate with a service, but not allow other unauthorized actions to be performed (i.e. start other processes) you could develop an application to do what you're asking. As already stated there's no native way to do this in Windows. – Twisty Impersonator Oct 10 '16 at 1:25

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.