2

Is it possible to run Windows 7 from a read-only hard disk? I know that you can move the users folder to another drive, so you could in theory run Windows 7 in Read-Only mode, which would make it much more reliable and secure. Linux can do that, can Windows do that too?

  • Are you wanting to stop the system from writing to the harddrive, or are you wanting to prevent users from writing outside their profile directory? – Darth Android Aug 15 '14 at 17:30
  • I wanted to stop the system from writing, because the system would only need a specific set of software and by preventing writes it would be 100% reliable. But it seems that that's not possible. – Lorenz Aug 15 '14 at 19:36
2

Windows needs constant R/W access to local disk C:. (using SYSTEM account, and various SERVICE ACCOUNTS) Your user should not require R/W to anything but PROFILE. Unfortunately NTFS does not allow extended attributes and access controls. I am sure there is an equivalent way of accomplishing this in Windows, but I cannot imagine it making a difference from a security stand point as most nefarious writes are from escalated privileges or spoofed accounts.

EDIT: Look into something like Deep Freeze which will restore back to a specified state no matter what the damage. I am not sure of a free alternative, but the above link lists some.

  • "Unfortunately NTFS does not allow extended attributes and access controls." ? What exactly are you referring to with extended attributes and access controls? The default Windows install does not give a user access to anything outside of the user's profile. Such requires administrator access. – Darth Android Aug 15 '14 at 15:29
  • NTFS has R/W allowed for all files for owner and you cannot change this at the filesystem level like you can with ext3/4 and others. You can still change this in windows permissions, but there is no point because SYSTEM and ADMIN or OWNER have R/W access. – jredd Aug 15 '14 at 15:40
  • By extended attributes I mean XATTR for various FS that support it. By Access Controls I mean "octal permissions" on directories/files. – jredd Aug 15 '14 at 15:43
  • That makes no sense. Not only does NTFS support extended attributes in addition to the basic read/write/execute on the filesystem level, but your comment about the SYSTEM user and Administrators group having access is like saying that root has access to ext3/4 - That's how it's supposed to be. Don't give a user admin if you don't want them to be an admin. – Darth Android Aug 15 '14 at 17:28
  • In linux I can set read only flag to my root partition. I can do this because root does not need write access to many root directories or partitions. SYSTEM needs write access to everything. Although my verbiage on NTFS not having extended attributes and access controls is just plain false as I realize. – jredd Aug 15 '14 at 18:30
0

You can create a Windows PE setup which typically runs from a bootable CD/DVD. It of course uses a RAM disk to write things during run-time but none of that persists between boots.

  • Thank you, but I won't boot from an optical drive and need a custom system, which means I need to enable the lock after some initial work. – Lorenz Aug 15 '14 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.