1

I have 2 users on my laptop login - "userA" "userB"

userA is an admin user userB is a standard user

I don't want userB to have access (not even read access) to C:\users\userA

Also I have some other directory c:\mydir - I don't want userB to have access to this directory also.

Currently userB has access to both of these.

I tried to open "lusrmgr.msc" to check which groups userB belongs to & change those groups to remove perms, but I get a message saying this snap-in cannot be used in this edition of Windows 10.

Next I right clicked on the relevant folders -> Properties -> Security -> Advanced Settings.

It shows

Administrators -> Full Control SYSTEM -> Full Control Users -> Read & Execute Authenticated Users -> Modify

enter image description here I thought if I remove all perms for Users & Authenticated Users, that should do the trick.

When I tried to remove permissions for "Users" & "Authenticated Users", I got a message that I need to first disable inheritance. I did that.

Then it allowed me to remove "Users" & "AUthenticated Users" from the dialog I have shown above - i.e. no permissions for them to the folder.

UPDATE: I also added all perms for userA for the folder.

After I did that I logged in as userB & userA was unable to access c:\users\userA.

However, after I relogged in back as userA. Now when I started Foxit (my PDF reader), it wasn't allow able to properly access documents in c:\userA (the logged in user). I opened a doc from the recently used menu in Foxit & Foxit seemed to open it but it was hanging & I couldn't scroll to the pages. I had to run Foxit with "Run as Admin" to get it to work well. Likewise, my firefox also hung when I started Firefox. I would think a lot of applications may have a problem but I haven't tested.

So I now Enabled Inheritance again in the same dialog. Now Firefox & Foxit runs fine. However, when I go back to Advanced Security Dialog I see that just by Enabling Inheritance, both Users & Authenticated Users have permissions for c:\users\userA !!! So again now userB can access c:\users\userA.

So what do I do to disallow userB from accessing particular directories?

I am running Windows 10 Home Single Language OS Version 22H2 (Build 19045.3324).

Improve this question
7
  • 1
    By removing Users you run, which the actual owner of the profile belongs to, you are making the directory inaccessible to everyone but an Administrator including the actual user the profile belongs to. Stop modifying the permissions of a User’s profile directory
    – Ramhound
    Commented Aug 17, 2023 at 12:29
  • @Ramhound - so how should I prevent userB from accessing c:\users\userA directory - that is my question
    – user93353
    Commented Aug 17, 2023 at 12:32
  • Explicitly deny that single user’s access to the directory but by default, the normal permissions of another user’s directory, does not allow a user who isn’t explicitly allowed access to the folder to access the folder (by default that’s the owner and Administrators). Denying the permission will override their access, which again should only be possible, if they are an Administrator. So my guess you have two administrators
    – Ramhound
    Commented Aug 17, 2023 at 12:45
  • You can determine which user group each user is in by going to Settings->Accounts->Your Info
    – Ramhound
    Commented Aug 17, 2023 at 12:55
  • @Ramhound - Explicitly deny that single user’s access to the directory - this worked. Now I am able to deny that user access without causing other issues. If you want to write this as an answer, I can accept it. And they weren't an administrator - just standard user.
    – user93353
    Commented Aug 17, 2023 at 22:42

1 Answer 1

Reset to default
1

By default, only the user itself, user SYSTEM and group Administrators has access to C:\Users\ username. These are special permissions, required to ensure that a profle works correctly. Administrator users can still access them after accepting the UAC dialog prompt when entering the folder of another user.

Standard users cannot access folders of other users, only their own.

The rights on C:\Users is set for all users to have read access. This is required. Subfolders have inheritence disabled, and the user itself is both owner and has full control. Other users are groups and users such as SYSTEM which need rights in order to perform functions such as backup and Windows Update.

So in order to fix this, Change the user permissions for C:\Users\UserA, disable inheritance and copy the permission, then add your own user back (UserA) and give it full control. Now remove Authenticated users and Users.

Do the same for C:\Mydir

Improve this answer
6
  • I did the above - read through my description. I had to change it back because it caused other problems.
    – user93353
    Commented Aug 17, 2023 at 12:03
  • You did not add userA. i did read it. Also, you must set it on the subfolder UserA, not Users.
    – LPChip
    Commented Aug 17, 2023 at 12:05
  • I did add userA also though I haven't mentioned it there. And I did everything on the folder UserA & not Users
    – user93353
    Commented Aug 17, 2023 at 12:21
  • @user93353 - If you didn’t mention something then edit your question. By default you only the actual user can access their user profile unless they are an Administrator, even then, by default they still can’t access another users profile directory without jumping through hoops.
    – Ramhound
    Commented Aug 17, 2023 at 12:27
  • 2
    Please read my comment carefully “Users” and “Authenticated Users” are two groups the actual owner of the directory are a part of, and they must for the profile directory, have access to the folder. So stop removing necessary user groups from the ACL for the directory that contains the profile directories for all Users. The correct way to block a specific user is to create a new user group or and explicitly remove their permissions (again this shouldn’t be necessary since they already have zero access as an non-Administrator user) explicitly deny their access
    – Ramhound
    Commented Aug 17, 2023 at 12:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .