Sign in with
Sign up | Sign in
Your question

Block Other Admins from a HDD

Last response: in Storage
Share
October 19, 2011 4:43:47 PM

Hello, I'll be buying a 1TB HDD. How can I block another administrator account from accessing it?
I'll be installing games that I rather keep them safe from deletion or restarting.
I know I can hide it with group policy editor, but can I block them from typing D: on the explorer?

More about : block admins hdd

a c 116 G Storage
October 19, 2011 6:14:15 PM

Just have one Admin account and password protect it. All other users including you should have regular accounts (not full Admin rights). This is safer from a virus and malware protection standpoint too.
October 20, 2011 6:35:22 AM

Ubrales said:
Just have one Admin account and password protect it. All other users including you should have regular accounts (not full Admin rights). This is safer from a virus and malware protection standpoint too.


The computer will be shared, but the HDD will be mine!
Related resources
a c 116 G Storage
October 20, 2011 1:35:18 PM

muradw2 said:
The computer will be shared, but the HDD will be mine!

Yes that is fine. You can still have just one Admin account, password protected. All users including you should have and use regular accounts.

Other users will not be able to install/delete/modify programs.
October 20, 2011 2:30:33 PM

That is not what he is asking, he is asking how to block other administrators on the box. It is a shared pc, so it looks like he is saying that everyone has rights to the pc as admins, or more than just him.

The answer is, well, I don't know what kind of os is on the box. Typically with admin rights, you can't prevent anyone from doing stuff to that drive. If the whole drive is under your SID (I haven't messed around with this stuff for years) and encrypted (like the my docs folder is now) then they can't see anything in your directory (well, at least not read any of the files, I don't know if it encrypts file names). It does NOT prevent someone with admin access from just formatting your drive though.

If you are buying a separate drive, I would suggest buying either a fast removable usb2 external drive, or a hot swap cage that will allow you to remove your drive when you are not using the pc.

Basically, there is not a way to guarantee anything if there are other admins on the box.
a c 116 G Storage
October 20, 2011 3:26:37 PM

Yes, all Admin accounts have the same rights. And, Admin accounts are not recommended for general surfing because of the potential of malware infiltration.
October 20, 2011 3:42:45 PM

ngoy said:
That is not what he is asking, he is asking how to block other administrators on the box. It is a shared pc, so it looks like he is saying that everyone has rights to the pc as admins, or more than just him.

The answer is, well, I don't know what kind of os is on the box. Typically with admin rights, you can't prevent anyone from doing stuff to that drive. If the whole drive is under your SID (I haven't messed around with this stuff for years) and encrypted (like the my docs folder is now) then they can't see anything in your directory (well, at least not read any of the files, I don't know if it encrypts file names). It does NOT prevent someone with admin access from just formatting your drive though.

If you are buying a separate drive, I would suggest buying either a fast removable usb2 external drive, or a hot swap cage that will allow you to remove your drive when you are not using the pc.

Basically, there is not a way to guarantee anything if there are other admins on the box.


Very true even if you run the group policy editor as long as another user is an Admin they can still change the group policy to make them the one in control, then you can play a nice group policy tug a war for control over the resources. Unless you physically remove the drive from the computer there is no way to keep them from reading or writing to the drive.
October 20, 2011 5:09:27 PM

caqde said:
Very true even if you run the group policy editor as long as another user is an Admin they can still change the group policy to make them the one in control, then you can play a nice group policy tug a war for control over the resources. Unless you physically remove the drive from the computer there is no way to keep them from reading or writing to the drive.

Am not protecting it from genuises, they are just 4 dumb little brothers, they don't know what group policy is.
a b G Storage
October 20, 2011 5:24:45 PM

It sounds to me like "4 dumb little brothers" are not qualified to have Administrator access. If that isn't an option, then you need to encrypt the entire drive. That still won't stop them from installing / uninstalling things in and out of Windows, but at least will offer some protection to the source files.
October 20, 2011 5:54:39 PM

Can't you password protect drives or directories? I know you can when you share them over a network.
October 21, 2011 5:37:33 AM

Onus said:
It sounds to me like "4 dumb little brothers" are not qualified to have Administrator access. If that isn't an option, then you need to encrypt the entire drive. That still won't stop them from installing / uninstalling things in and out of Windows, but at least will offer some protection to the source files.

Well, they are dummies, but still know how to open files, install, uninstall and sometimes download.
a c 116 G Storage
October 21, 2011 2:52:56 PM

muradw2 said:
Well, they are dummies, but still know how to open files, install, uninstall and sometimes download.

Don't under-estimate these guys. They discuss, have the support of their peers, and learn a lot from friends at school.
a c 372 G Storage
October 21, 2011 3:37:52 PM

I agree with ubrales. If this is a home computer there is no need to have more than one admin account (with password). Unless you are constantly installing/removing programs or adjusting system setting, even your account should be a regular account and only login as admin when system changes are needed. I've been doing this since XP came out, although it's much more tedious in XP. Most software today takes mutli users into account, not so much when XP came out.
a c 415 G Storage
October 21, 2011 4:31:08 PM

You can set the access control lists on the files and directories on your disk to deny access to other administrators. But an account with administrator rights can always "take ownership" of any files or folders and then change their security, so there simply isn't any iron-clad way to prevent an administrative account from accessing the data.

I agree that the solution is to NOT give administrator accounts to ANYONE, and have only one admin account that is used only when absolutely necessary (which, in my experience with Windows 7, is hardly ever).

But if this is not in fact your computer and the "administrator" is one of the people you can to keep your files secret from, then you have two options:

1) Use a physical security by putting the files on an external, removeable drive and simply take it with you when you're not using the computer.

2) Use encryption. An encrypted disk can't be read by anyone, even an administrator, unless they know your password.
October 22, 2011 2:28:04 PM

sminlal said:
You can set the access control lists on the files and directories on your disk to deny access to other administrators. But an account with administrator rights can always "take ownership" of any files or folders and then change their security, so there simply isn't any iron-clad way to prevent an administrative account from accessing the data.

I agree that the solution is to NOT give administrator accounts to ANYONE, and have only one admin account that is used only when absolutely necessary (which, in my experience with Windows 7, is hardly ever).

But if this is not in fact your computer and the "administrator" is one of the people you can to keep your files secret from, then you have two options:

1) Use a physical security by putting the files on an external, removeable drive and simply take it with you when you're not using the computer.

2) Use encryption. An encrypted disk can't be read by anyone, even an administrator, unless they know your password.

Thank you, I'll encrypt the HDD!
a c 415 G Storage
October 22, 2011 5:25:16 PM

muradw2 said:
Thank you, I'll encrypt the HDD!
Be careful when using encryption - you can loose all your data if you forget your password, if your user profile is deleted, if the system fails, etc. At the minimum you should be sure to back up your encryption key as described here: http://www.howtogeek.com/howto/windows-vista/back-up-yo...
October 23, 2011 3:31:54 PM

sminlal said:
Be careful when using encryption - you can loose all your data if you forget your password, if your user profile is deleted, if the system fails, etc. At the minimum you should be sure to back up your encryption key as described here: http://www.howtogeek.com/howto/windows-vista/back-up-yo...

I won't. BTW:
Will encryption slow down the HDD?
How much time it will take to encrypt 1TB HDD?
Thanks.
a c 415 G Storage
October 23, 2011 3:47:27 PM

Encryption won't technically slow the drive itself down, but it does consume CPU time for reads and writes. If you don't have a fast CPU and you're doing heavy I/O you could see poorer performance.

This page says that it takes 3 hours to encrypt a 1TB hard drive. For an external hard drive it may take longer if you're using a slower connection technology like USB 2.0.
!