There is a non-techsavvy user, who doesn't want to learn, and can only use Windows XP or 7. The problem is, that the computer is shared which she would like to use, and the computer stores sensitive, important data. Since she clicks on everything, it's quite a russian roulette.

How could I isolate her account from the rest of the system? Like having a profile on the computer (it runs Windows 7 now) which would have the files and other stuff sandboxed?

I was thinking of having a dual boot system, but that could compromise the files too, or the boot sector (talking about Windows). Linux is not a way, hence ... see the first line.

Is there such a software that can set up a sandboxed environment?

  • If she has no root access under Linux and doesn't have any permissions to write outside her home directory, it's very unlikely that she will be able to compromise anything. – Renan May 30 '12 at 16:39
  • 1
    Linux could be set up @Renan, but she couldn't use it. Not even Ubuntu, or KDE, or any desktop environment. :/ – Shiki May 30 '12 at 16:42
  • unfortunately, otherwise it would be the easiest way to have an isolated system for her. :| – Renan May 30 '12 at 16:53
  • 1
    @Renan I was thinking of installing a new HDD, and then disconnecting the other one every time the computer left alone. But that would stress the SATA cable and the interface. Hmm hmm. – Shiki May 30 '12 at 17:04
  • Sensitive important data and letting a user who clicks on everything use it, now that is a disaster in the making. – Moab May 30 '12 at 18:02

Remove the user's Administrator privileges (if they have them) so that they are a standard user, and then deny that account access to the files and folders containing sensitive data.

Being a standard user should remove her ability (or any malware run as her) from being able to access system files, folders or system utilities; at least not without popping up and asking for Administrator credentials.

  • What I'm concerned about is the "Strength" of this whole thing. If I set up a totally limited user account (even limit the applications can be runned, even use Sandboxie maybe)... is it really bulletproof? I mean, a malware can't just pass all this stuff and go for the golden prize? There are so many exploits and vulnerabilities out there.. and that's what makes me worry. – Shiki May 30 '12 at 17:06
  • 1
    It's not supposed to be able to as that's kind of the whole point of an OS's security. Having said that, I can't even begin to guess if future malware will figure out a way past any form of separation you attempt to enforce. If you're really THAT worried, and the data is really THAT sensitive/important, than get her her own computer and sleep better. :) – Ƭᴇcʜιᴇ007 May 30 '12 at 17:24
  • Oh okay, thank you. I'll go with that @techie007, thanks! – Shiki Jun 4 '12 at 20:43

You can build a virtual machine for her and she won't compromise the rest of the machine if she uses it.

  • Yes, but she wants to use the computer when no one is around. So you can't really watch if everything starts and stuff, and I never seen a VM starting up by itself, going full-screen and stuff. It would be nice, that's true. – Shiki May 30 '12 at 19:49
  • 1
    @Shiki: It's not that hard: just drag a shortcut to the VM in her Startup folder. Set her regular (non-VM) desktop background to a big "PLEASE WAIT ... STARTING" notice, no icons, and the VM dekstop background to her current background. – MSalters May 30 '12 at 21:37
  • @MSalters - Is it possible to launch a VM with a bat file or something in full screen, everything grabbed? I tried asking this question, but no answers ever since: superuser.com/questions/276897/… – Shiki May 31 '12 at 12:14
  • @Shiki: See answer there. – MSalters May 31 '12 at 13:13
  • Pretty sure VMWare supports this. – LawrenceC Jun 3 '12 at 14:45

Make user limited, and not administrator as @techie007 says.

Install an antivirus and enable all of its features, at the very least MSE, AVG, or another free one.

Install Firefox or Chrome, make sure Flash works, and tell her to use it instead of IE.

I would love to tell you to disable addons completely for all browsers, but I'm pretty sure if you do something like this then Flash won't work.

Does she or anyone on the system need the proprietary features of Adobe Reader? If not, uninstall that and install SumatraPDF or another PDF reader.

A non admin user by default under Windows cannot access anyone else's folders. So you do not have to worry about her accessing other files unless she gets administrator permissions somehow.

Make sure Automatic Updates are enabled and tell her to allow them to install when prompted.

Make sure file extensions are set to visible in Control Panel -> Folder Options

You may want to take a quick look at the Local Security Policy and see if there are things you want to put on lockdown from there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.