0

If I am a Normal user (or an Administrator) on a Windows 8 machine, how secure or otherwise are my files, settings, etc. against an Administrator on the same machine?

Is there a way of improving my privacy?

Edit: Further, as an Administrator of a personal computer sharing this computer with others, is there a way of explicitly managing the computer to give comfort to other users that their privacy is respected?

3
  • 9
    admin users are god in Windows. They can do (nearly) anything. You have to encrypt data with TrueCrypt if you don't want that admins can look at them. Dec 23, 2012 at 16:03
  • 2
    Even then, one suspects that an admin could install an undetectable keylogger and get your passwords to DropBox, etc.
    – dsolimano
    Dec 23, 2012 at 17:12
  • 1
    You could use EFS. Dec 23, 2012 at 20:48

1 Answer 1

4

Most administrators I know are generally decent at what they do, but they respect privacy of others. They don't go snooping. Even if they're not a very nice person, it gives them plausible deniability if any fecal matter goes fanward.

That doesn't mean however, they can't. If you're on a work computer, say goodbye to your privacy because you have none. They can track literally anything you do and you have no say in it; it's not your computer. If you ever leave the company they can get every file you have created.

I actually had to do this to an employee who was breaking his contract by starting up his own business using company resources and on his computer. I'm still curious how he got any clients with the e-mail address of a different company?

Usually there are things in place in a bigger company to prevent things like this. Such as audit logs on any permissions, so that if a single admin goes rogue, the rest of the IT staff are alerted and can discipline them.

If this is a home computer, same basic principle applies, administrators can see all if they try hard enough. Only think I can suggest is maybe non-default encryption software, though this won't stop a keylogger. Not only that, home users aren't held to the same standard as IT staff in a company.

I guess it ultimately comes down to what you're trying to keep private:

  • If it is company data on a company computer, don't worry too much about it. It's not your data to keep private anyways (beyond keeping it in the company, that is).
  • If it's personal data on a company computer, just don't do personal things on a company computer!
  • If it's personal data on a personal computer and you wish to keep it completely private, use a different computer or ask for regulations to be put in place, such as mutual access to an admin account and normal users for day-to-day operation. Put audit logs in for when someone logs in the admin account. Though even through that, admin accounts would normally be able to delete the logs!

If worse comes to worse, just do your private activities on an entirely different computer. But either way if it's a shared computer at home with a trusted person or a company computer (with technically their data), what do you have to hide?

1
  • I realized that anyone with Administrator privileges, malign and with sufficient technical knowledge could ultimately do what they liked. However, I was interested in taking steps to improve things beyond having everything wide open. These are helpful comments. Thank you.
    – harunahi
    Dec 24, 2012 at 5:12

Not the answer you're looking for? Browse other questions tagged .