Block Other Admins from a HDD

Just have one Admin account and password protect it. All other users including you should have regular accounts (not full Admin rights). This is safer from a virus and malware protection standpoint too.

The computer will be shared, but the HDD will be mine!

Yes that is fine. You can still have just one Admin account, password protected. All users including you should have and use regular accounts.

Other users will not be able to install/delete/modify programs.

That is not what he is asking, he is asking how to block other administrators on the box. It is a shared pc, so it looks like he is saying that everyone has rights to the pc as admins, or more than just him.

The answer is, well, I don't know what kind of os is on the box. Typically with admin rights, you can't prevent anyone from doing stuff to that drive. If the whole drive is under your SID (I haven't messed around with this stuff for years) and encrypted (like the my docs folder is now) then they can't see anything in your directory (well, at least not read any of the files, I don't know if it encrypts file names). It does NOT prevent someone with admin access from just formatting your drive though.

If you are buying a separate drive, I would suggest buying either a fast removable usb2 external drive, or a hot swap cage that will allow you to remove your drive when you are not using the pc.

Basically, there is not a way to guarantee anything if there are other admins on the box.

Yes, all Admin accounts have the same rights. And, Admin accounts are not recommended for general surfing because of the potential of malware infiltration.

Very true even if you run the group policy editor as long as another user is an Admin they can still change the group policy to make them the one in control, then you can play a nice group policy tug a war for control over the resources. Unless you physically remove the drive from the computer there is no way to keep them from reading or writing to the drive.

Am not protecting it from genuises, they are just 4 dumb little brothers, they don't know what group policy is.

It sounds to me like "4 dumb little brothers" are not qualified to have Administrator access. If that isn't an option, then you need to encrypt the entire drive. That still won't stop them from installing / uninstalling things in and out of Windows, but at least will offer some protection to the source files.

Can't you password protect drives or directories? I know you can when you share them over a network.

Well, they are dummies, but still know how to open files, install, uninstall and sometimes download.

Don't under-estimate these guys. They discuss, have the support of their peers, and learn a lot from friends at school.

I agree with ubrales. If this is a home computer there is no need to have more than one admin account (with password). Unless you are constantly installing/removing programs or adjusting system setting, even your account should be a regular account and only login as admin when system changes are needed. I've been doing this since XP came out, although it's much more tedious in XP. Most software today takes mutli users into account, not so much when XP came out.

You can set the access control lists on the files and directories on your disk to deny access to other administrators. But an account with administrator rights can always "take ownership" of any files or folders and then change their security, so there simply isn't any iron-clad way to prevent an administrative account from accessing the data.

I agree that the solution is to NOT give administrator accounts to ANYONE, and have only one admin account that is used only when absolutely necessary (which, in my experience with Windows 7, is hardly ever).

But if this is not in fact your computer and the "administrator" is one of the people you can to keep your files secret from, then you have two options:

1) Use a physical security by putting the files on an external, removeable drive and simply take it with you when you're not using the computer.

2) Use encryption. An encrypted disk can't be read by anyone, even an administrator, unless they know your password.

Thank you, I'll encrypt the HDD!

Be careful when using encryption - you can loose all your data if you forget your password, if your user profile is deleted, if the system fails, etc. At the minimum you should be sure to back up your encryption key as described here: http://www.howtogeek.com/howto/windows-vista/back-up-yo...

I won't. BTW:
Will encryption slow down the HDD?
How much time it will take to encrypt 1TB HDD?
Thanks.

Encryption won't technically slow the drive itself down, but it does consume CPU time for reads and writes. If you don't have a fast CPU and you're doing heavy I/O you could see poorer performance.

This page says that it takes 3 hours to encrypt a 1TB hard drive. For an external hard drive it may take longer if you're using a slower connection technology like USB 2.0.