To experiment with security settings of folders, on my Windows 7 Ultimate desktop (Standalone) I have two users created on it, both are administrators. User1 & User2. I want to make sure that a folder say C:\Temp created by User2 is only accessible to User2. Even if User1 logs in he can’t access it.

I have partly succeeded as follows

Log in as User2

Create a folder named say C:\Temp

Access ownership and set owner as User2 and also remove all inheritance

Now assign User2 full control and deny User1 all control

With this when User1 logs in he cannot access the folder.

The cache is that User1 can still go to ownership, change the ownership to User1 and then he can access the folder. What am I missing here? How can I completely prevent User2 from ever accessing C:\Temp or any of its permissions settings despite both are administrators?

Here are relevant screenshots of the folder permissions set.

No users having any permission

User2 full control

User1 denied control

User1 when logged in can change the ownership easily being part of administrators

  • 1
    The only way to prevent the users from changing permissions is to NOT have them as Administrators. – Justin Pearce Aug 8 at 21:07
  • Provide a screenshot of the ACL for the folder. – Ramhound Aug 8 at 21:17
  • Screenshots added, however for some reason they are not displaying on screen at my end, even stack.imgur page errors out. – rajeev Aug 8 at 23:06
  • You need to remove User1 from the Administrator user group, based on your screenshot, the owner of the folder is in that group and User1 is in that group effectively giving ownership of the folder to all Administrators. Suppose you could explicitly deny permissions to all Administrators after specifically giving ownership and permissions to a specific user. – Ramhound Aug 8 at 23:15
  • @rajeev What you are trying to do isn't possible as long as User1 is an administrator. As long as the directory is on the local computer, there isn't anything that can be done. The best you could is to place the contents of the directory on a network drive and only give access to User2 via have User2 connect with credentials of a user on the remote machine that User1 doesn't have. – Nasir Riley Aug 9 at 0:25

Mission impossible as far as both users are administrators. IMHO, the only workable solution if you can't avoid to have two admins, is to setup VeraCrypt container for User2 and be make sure that User1 can not connect remotely to PC while User2 working with mounted encrypted container. The only weak spot in this solution is that User1 can delete encrypted container of User2, but still, content of container won't be available for User1 (of cause if User2 set a strong password)

Your goal is to prevent access to a folder by anyone else, right? The question is, how much trouble do you want to go thru to access it. Setting it up the way you want, if you could, would only require your logon. You can try encrypting the folders.

this is the first hit you get if you google "super administrator"

https://www.thewindowsclub.com/activate-windows-super-administrator-account

try it, there are lots more.

  • Even if you enable built-in Administrator account and set controls, still User1 can eventually take ownership and grant access to itself. There does not seem to be a concept of Super Admin, then Admins and then a User. An Admin user can always override settings set by another admin. I am still trying but it seems what already mentioned by others in answer and comments is true. This does not seem possible. – rajeev Aug 11 at 9:22

I have not used the SUPER ADMINISTRATOR function, but reading some info about it might hold the answer to your question. First you must enable it and password it, then you can peruse it to see if you can limit the ADMINISTRATOR's ability to change ownership. That means your own admin account will also be affected.

  • Could you please clarify meaning of SUPER ADMINISTRATOR and confirm its existence from official links – Alex Aug 9 at 2:37

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.