By reading some tutorials online I used these commands:

Make a local group: net localgroup CopsshUsers /ADD

Deny access to this group at top level: cacls c:\ /c /e /t /d CopsshUsers

Open access to the copSSH installation directory: cacls copssh-inst-dir /c /e /t /r CopsshUsers

Add Copssh user to the group above: net localgroup CopsshUsers mysshuser /add

simply put these commands will try to create a usergroup that has no permission on your computer and it only have access to the copSSH Installation directory.

This is not true, since you cannot change the permission on your windows directory, the third command won't remove access to windows folder (it says access denied on his log). Somehow I achieved that by taking ownership of Windows folder and then i execute the third command so CopsshUsers has no permissions on windows folder from now on.

Now i tried to SSH to the server and it simply can't login! this is kind of funny because with permission on windows directory you can login and without it you can't!! So if you CAN SSH to the server somehow you know that you have access to the windows directory! (Is this really true??)

Simple task: Limiting ssh user account only to access his home directory on WINDOWS and nothing else!

Guys please help!

migrated from stackoverflow.com Apr 16 '10 at 20:45

This question came from our site for professional and enthusiast programmers.


The second command (deny access to c:\) seems very scary to me. You are denying members of this group all access to c:\ recursively. Programs are going to be run with their credentials, and those programs (which probably reside on the c:\ drive) are going to need to load libraries located on the c:\ drive. If you deny them access then they won't be able to load those libraries and the programs will fail to load. I can't imagine why you would ever want to do this, and I can't imagine that anything would work right if you did. If you insist on going this route I would try denying write access instead of all access; however, the default permissions should be adequate for this - members of the Users group are denied write access (or rather they are only granted read access).


On Unix systems this can be achieved with a chroot jail. Looking for something similar on Windows I found this:

I'm not sure this is exactly what you're looking for, but maybe this helps?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.