Basic security question

[keithr]

Hi all,

My Win7 desktop has admin plus user accounts for myself (Keith) and wife (Jean). The HDD is partitioned with all progs on C: and data on D:

I recently lost a file and dont remember deleting it, so thought I would check if it were possible for Jean to delete it. (Yes I have backup, so was able to restore it).

I was under the impression that any file that I originated and saved within D: would be safe from accidental deletion by Jean, but have just proved to myself that under her login, she can delete files without UAC asking for the admin password. How do I set things up so that my files will be protected from accidental deletion by Jean? I am quite happy for her to view any file.

 

[gregrocker]

From the Admin acount, under the file or folder Properties box, on Security tab, Edit the secondary account's Permissions to dis-allow Full Control. I don't think with Modfy or Read-Execute, Read or Write the account holder can Delete the file but you may need to test to be sure.

 

[keithr]

From the Admin acount, under the file or folder Properties box, on Security tab, Edit the secondary account's Permissions to dis-allow Full Control. I don't think with Modfy or Read-Execute, Read or Write the account holder can Delete the file but you may need to test to be sure.

Hi gregrocker
Looking at my D: drive security tab, I see:
Authenticated users
SYSTEM
Administrators (Keith-PC\Administrators)
Users (Keith-PC\Users)

Which I find confusing since I expected to see users Keith & Jean listed separately. By "secondary accounts permissions" are you referring to user account Jean which I dont see?

Please explain whats the difference between Authenticated users and Users (Keith-PC\Users)?

 

[Brink]

Hello Keith,

If you like, you should be able to add the other user accounts that you don't want to have full access, and set their permissions to say allow "Read & execute" only, and deny "Modify" and "Write".

http://www.sevenforums.com/tutorials/122666-permissions-allow-deny-users-groups.html

Be sure to NOT "deny" "everyone" or everything. If you do, you'll find that you denied yourself as well.

Hope this helps,
Shawn