I am setting up a computer that uses an SSD for the operating system (Windows 7 Professional) and a hard disk for data and most programs.
I would like to have two "Program Files" directories, one on the SSD (the original one) and a second one on the hard disk, say "D:\Program Files".
This second directory should have the same protection as the original "C:\Program Files", i.e., any user should be able to read and execute files but only an elevated account should be able to write to it.
- What are the exact permissions I need to assign to what directories (D:\, D:\Program Files)?
- How do I ensure that all sub-directories inherit these permissions properly?
Bonus points:
- How do I setup "islands" where unelevated users have write access? So that for instance "D:\Program Files\Product\config" is writable.
- How can I do this from the command line (PowerShell)?
Note I do not want to simply move the "C:\Program Files" to "D:\Program Files", as I want to install some programs on the SSD. Also I'm interested in a solution that would work for any directory.