Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Hiding system folders on a shared computer

28 Feb 2014   #1
apertotes

Windows 7 Ultimate x64
 
 
Hiding system folders on a shared computer

Hello, I am sharing a computer with my son and I want to hide some programs from him, mainly Steam games, but not only. I have managed to hide them from his start menu. He has a standard account, so I think on that front we are OK.

I have also managed to prevent him from accessing the control panel, and thus seeing the list of installed programs.

But I have a problem:

Windows explorer. I tried navigating from his account, and he can go into program files without any problem, he can even go into windows folder. He can not delete files, but he can run them. So, you know how kids are. He will see all the installed programs and try to run directly their .exe file. And even though he won't be able to launch Steam games, he will see a list of all installed games, and I want to prevent that from happening.

He can even go to "Start", type "witch" and a few seconds later he'll be able to see that we have The Witcher 2 installed on the computer. He won't be able to launch it if I activate Parental Controls, but the damage is done.

So, can anybody help me hiding certain folders (windows and program files) from a standard user explorer?

Thanks!


My System SpecsSystem Spec
.
28 Feb 2014   #2
carwiz

Windows 7 Pro-x64
 
 

Yes. Use folder permissions. Log on as the Administrator. Open Windows Explorer then right click on a folder and select Properties. Click on the Security Tab then click on the Edit button. On the Permissions window, select the user you want to change and check the Deny boxes that apply.

Here's a sample:


Attached Thumbnails
Hiding system folders on a shared computer-folder-permissions.jpg  
My System SpecsSystem Spec
01 Mar 2014   #3
apertotes

Windows 7 Ultimate x64
 
 

Thanks! When I try to do that, I get two errors:

1. Error Applying Security: An error occurred while applying security information to

c:\Program Files (x86)

Access is denied

2. Windows Security: Unable to save permission changes on Program Files (x86)

Access is denied

--------------------------------------

I got this when I tried to change permissions for my son's account on the program files folder (both of them) and on the windows folder.

But I was successful when I tried with the NVIDIA folder.

Are Program Files, Program Files (x86) and Windows folders special in that it is not possible to change permissions even as administrator?
My System SpecsSystem Spec
.

01 Mar 2014   #4
carwiz

Windows 7 Pro-x64
 
 

I was afraid of that. I didn't try it on Windows' reserved folders. I hesitate to recommend trying the Advanced options by taking ownership of the folder. (From Trusted Installer to Administrator) It may cause Windows to stop running. If it will even let you change it. Some experimenting with the location of installed programs might work. Most all installers let you choose the location of installed programs. I wonder if the "location" was created by you (Admin) that it would then let you set the folder permissions.

I see that you have Ultimate. There's a feature in Ultimate and Enterprise versions called AppLocker that can restrict users from running executables (exe, com, dll, etc) but as I understand, it takes a heavy toll on performance. I don't have any experience with it so I can't help there. And I don't think it restricts viewing of folders.
What Is AppLocker?

I'll post a help needed request for someone more informed of to the security options. I've always been a One PC-One User person and never needed it in my environment so I'm behind.
My System SpecsSystem Spec
02 Mar 2014   #5
apertotes

Windows 7 Ultimate x64
 
 

Well, in the end I managed to achieve most of what I wanted. The whole story is here: Hiding system folders on a shared computer - User+Accounts - Windows 7

Thanks for your help, carwiz.
My System SpecsSystem Spec
02 Mar 2014   #6
UsernameIssues

W7 Pro SP1 64bit
 
 

Quote   Quote: Originally Posted by apertotes View Post
Well, in the end I managed to achieve most of what I wanted. The whole story is here: Hiding system folders on a shared computer - User+Accounts - Windows 7

Thanks for your help, carwiz.
It sounds like you set the NTFS file permissions to Deny for specific folders/files in the Program Files folder(s) for your son's account. Is your account now listed as the owner of those folders/files? If so, it would be safer to return ownership to the Trusted Installer.
My System SpecsSystem Spec
02 Mar 2014   #7
apertotes

Windows 7 Ultimate x64
 
 

Can I return ownership to the Trusted Installer while still having my son denied permissions on some folders inside? And also, when I go to ownership I see only Me and Administrator accounts to select as owner's. If I click on "Other users and groups", and then "Advanced", I get a list with all the users and groups, but Trusted Installer is not there. I know that the user still exists, because it still has permissions granted on these folders, and because it is still the owner of the Windows folder. But I can not select it from the complete list of users and groups. So, how can I give him back the ownership of the folders?
My System SpecsSystem Spec
02 Mar 2014   #8
UsernameIssues

W7 Pro SP1 64bit
 
 

The NTFS access and deny permissions should be unaffected by returning ownership to the TrustedInstaller. You can test it on one folder before fixing the other ones. Here is a tutorial on how to do that: TrustedInstaller - Restore as Owner (The steps are the same in Vista and W7.)

The reason for returning ownership is: "ownership" is part of the Windows security model. This helps to prevent changes to these protected folders by not allowing user accounts (even admins ones) to change/infect files.
My System SpecsSystem Spec
02 Mar 2014   #9
carwiz

Windows 7 Pro-x64
 
 

I'm not sure about that. I drilled deep into Advanced user permissions and it wasn't listed. "TrustedInstaller" is a special group Windows uses. You'll see it appear in update and scan logs. It's not a real user per say.

Enter this command from an elevated (Run as Administrator) command prompt (CMD). SFC /scannow
If there's a problem with TI, it should show a message in the command window. This is a system file checker that verifies system file integrity and repairs it. It doesn't check permissions but if there's a permission problem it will error out.


Attached Thumbnails
Hiding system folders on a shared computer-file-permissions-advanced.jpg  
My System SpecsSystem Spec
02 Mar 2014   #10
UsernameIssues

W7 Pro SP1 64bit
 
 

carwiz,
I think that we posted at almost the same time. I'm guessing that your statement, "I'm not sure about that" was meant to be a response to apertotes asking, "Can I return ownership to the Trusted Installer while still having my son denied permissions on some folders inside".

I went ahead and tested my understanding of the relationship between item ownership and NTFS access/deny permissions. While I was at it, I threw SFC into the mix :-)


SFC does not show any "integrity violations" - even though there is a security problem. This shows the results of an SFC scan while the user account named username has ownership of what should be a protected folder.
Hiding system folders on a shared computer-deny1.png


As I expected, returning ownership to TrustedInstaller did not cause any integrity violations and the Deny permissions held.
Hiding system folders on a shared computer-deny2.png


This is what the standard user account named son sees after ownership of the IE folder (and its contents) has been restored to that special account named TrustedInstaller:
Hiding system folders on a shared computer-deny3.png


apertotes,I realize that the IE folder (and its contents) was not the target of your Deny permissions settings; it was just an easy example for my testing and screenshots.
Hiding system folders on a shared computer-deny4.png


My System SpecsSystem Spec
Reply

 Hiding system folders on a shared computer




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Shared folders on Windows 7 computer not visible to other computers
I have a homegroup with several Windows 7 and Windows 8 computers. One of them is Windows 7 PC with external My Book that contains several folders I need to share with other computers. I have been able to successfully share two of the folders but no matter what I do I can't get the other two...
Network & Sharing
Cannot access shared folders or HomeGroup shares on this computer
The HomeGroup shares have been a recurring issue that I haven't been able to solve, but the really perplexing one is the shared folder issue which just cropped up. Some of my shared folders still work, but e, g and h (music and video respectively) for some reason spit back "Access Denied" on all of...
Network & Sharing
Non-shared folders showing up and shared folders not
I have an Android tablet and my PC running Windows 7 Pro. I am using ES File Explorer on Android to see shared folders. I added some folders to the Music/Picture/Video libraries and shared them in a homegroup. I tried to make the homegroup not need a password and it'll let me access my PC from...
Network & Sharing
Homegroup folders shared, but will not expand on other computer
I've placed two computers in a homegroup. Computer 1 can access Computer 2's shared folders, however, Computer 2 cannot access Computer 1's shared folders. When attempting to access the shared folders (with read/write permissions), I get the spinning wheel and then it just eventually says 1 item...
Network & Sharing
One computer, two accounts and only a few sub-folders shared
Hello everyone, I have a problem at my work. A person from HR is leaving for a vacation and we will have her assistant working on her computer. However, due to confidentiality of most of the information we want her assistant to have access to only a few of her sub folders. I have tried using...
Network & Sharing
Files & Folders Gone Hiding
I recently upgraded my system from Win XPPro to Win 7 Ultimate. My system runs smoothly except this weird thing I hardly don't understand. When I go to "My Computer" all the partitions created with the former OS are visible. Free spaces and Used spaces are visible as well, but when I open one of...
General Discussion


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 20:22.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App