2

Is it possible in Windows 7 to lock a file for writing by only one program? anyone can have read or copy accesss, but I need write/move/delete to be done only by one program.

6

Typical answer: No. Windows NT security is applied to SIDs (users, groups, special groups...). Programs do not 1 2 have unique SIDs which could be used, and you cannot add a process name or path to any ACL.

All programs run by the same user have the same SIDs – of that user and all groups they're in. (The login SID is different for every session, but it still remains the same within a session.)

You could, however, create a separate user account just for that program, then use "Run As..." to launch the program. The account could be hidden from the "Welcome" screen easily.

runas /user:myapp /savecred /noprofile "myapp.exe"

Some programs (usually viruses and anti-virus tools) install system drivers which hook Windows kernel functions to disallow modifying certain files or registry values except by certain processes (for example, only allow disabling the antivirus from its own GUI). This requires a lot of work (writing a driver, making sure it won't crash the user's system, finding a way to verify the process...) and likely will not work reliably in later Windows versions (Vista and above).


1 Windows services do get an unique SID as of Windows Vista and Server 2008. (However, they also lost the ability to be run interactively, so this won't help you.)

2 Metro apps in Windows 8 have their own SIDs, known as App Container SIDs.

2
  • 2
    The "Create a account for the app" trick is actually used by Microsoft itself. This is often how SQL Server manages it's own permissions. You will see a users/groups called called something like NT SERVICE\SQLAgent$SQL2008 that the program uses. Another classic example is the ASPNET user that gets installed with IIS. – Scott Chamberlain Jan 23 '12 at 18:20
  • It's very common for servers on Unix as well. Not for client applications, though, since authentication as that user would become tricky. – user1686 Jan 23 '12 at 18:24
1

This is a standard lock on a file. Generally it is accomplished by opening the file in a program. Unless a program explicitly says that it can be shared, the file will then be locked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.