I have two administrative accounts: A and B, and a standard account C.

I want User A and C to have a permission to access a folder (can be any folder) but not B.

Logging in from the account A, I gave the permission for account C to access the folder but not to account B.

But as B is the administrator, it can change the settings and can have access to that folder.

Any one knows how to deal with it?

  • Change user B to normal user. As long as the user has Admin right he allways will be able to take back the access. Other solution would be to encrypt files/folder you dont want the user B to access. – Ivan Viktorovic Nov 24 '14 at 10:52

An administrator can gain access to (almost) all files on a system by modifying permissions. This is how the system is designed, for that reason it isn't really possible for a non-administrator to prevent an administrator gaining access to files by using only filesystem permissions.

One possible solution would be to use encryption to protect the contents of the files you do not wish User C to be able to see. Once the files have been encrypted, User C will be able to access the files, but would not be able to make use of them since they are encrypted.

To allow other users to read the encrypted file, you would share the key with only those people.

As I haven't personally used any encryption software for a long time, I'm not able to recommend a utility for this. There is file encryption functionality in Windows but I believe an Administrator may be able to recover the keys it uses.


Simple approach

In NTFS you can manipulate permissions as you want.

  1. Remove all permissions from that folder.
  2. Add permissions only to specyfic account.

To do that - go to folder Properties, Security tab and click Edit. You will figure out next steps.

If other administrator will try to access that folder - he will be notified that he has no permissions, but he will be able to change ownership of that folder.

More correct approach

If you need second administrator to be able to install programs - you don't really need him in "Administrators" group.

Remove second administrator from "Administrators" group and use "Power user" group instead. "Power user" group members can install programs (they have access to Program Files etc), but they cannot control system like Administrator can.

Complicated approach

You can create new group and manipulate its permissions in Local Security Policy editor (run -> secpol.msc). There are all existing Windows permissions and you can set them as you want. You can even give "Shutdown" permission for only one user.

Edited. This will not work in Windows 7.

Very secure approach

Use NTFS encryption, as Crippledsmurf suggested in another answer. However - if your disk fails - it will be probably impossible to recover data from it, because there are no data recovery tools (known to me) which can recover encrypted files from damaged disk.

Network server approach

You can move all these folders to another computer where both administrators have no admin rights and create separate accounts for them. Then share these folders as you want.

You may need at least Windows 7 Professional to manipulate permissions like this.

  • If I change the User B to the group of "Power user", will that user will be able to uninstall the software? – Lifestohack Nov 24 '14 at 11:24
  • @Lifestohack Yes. – Kamil Nov 24 '14 at 11:26
  • Oh dear, in Windows 7 this was changed and "Power user" cannot install software anymore. You have to use "Simple approach" or "Very secure approach". Sorry. I changed my answer. – Kamil Nov 24 '14 at 11:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.