Restricting Drives to specific Users

[Seanbg]

Hello all

 

I have recently just bought a new drive for my PC to store all of my media backup but I do not want anyone else to be able to access that drive other than me. As I am not the only one using the computer I would just like to restrict drives to specific users (ie non admin users). I have tried going to properties-security-security permissions and tried to change the permissions of non administrators to no access but because even as an administrator I still fall under the standard user group policy for some reason and when I set the permission it also denies me access to the drive. I have taken ownership of the drive and still no luck. I wonder if any of you fine people would know how to get round this.

 

thank you in advance

 

Sean

[Void Master]

Try using BitLocker.

[Seanbg]

I wasn't aware bitlocker was able to restrict drives to certain users, I'm not looking to encrypt the drive

[vanished]

Just now, Seanbg said:

I wasn't aware bitlocker was able to restrict drives to certain users, I'm not looking to encrypt the drive

It restricts access by the fact that only those with the password can access it.  Any other method is easily defeated if it's a locally shared computer that everyone has physical access to.  Permissions are a pain to setup and can be bypassed in minutes by anyone with even a slight amount of computer knowledge.

[Seanbg]

I don't want to put in a password every time I want to access that drive (which will be a lot actually). It is honestly just to stop my 3 year old sister from moving and/or deleting files on that drive. I don't mind it being a pain to setup, after all I'm doing a lite touch deployment tomorrow and I don't even have an answer file made up yet and unless doing this is more complicated than that I am happy to do it. Also just tried to use bitlocker and it won't let me not encrypt it.

Edited September 9, 2018 by Seanbg
additional information

[vanished]

10 hours ago, Seanbg said:

I don't want to put in a password every time I want to access that drive (which will be a lot actually). It is honestly just to stop my 3 year old sister from moving and/or deleting files on that drive. I don't mind it being a pain to setup, after all I'm doing a lite touch deployment tomorrow and I don't even have an answer file made up yet and unless doing this is more complicated than that I am happy to do it. Also just tried to use bitlocker and it won't let me not encrypt it.

Bitlocker can only be used with encryption as that is how it ensures the password is necessary.  But I guess in this case that much protection is overkill   You should be able to change access at the drive level in group policy, or if that isn't an option, my recommendations for permissions would be to specifically disallow the other users at the drive level, rather than trying to only allow yourself.

[Seanbg]

I have tried setting the drive permissions to admin only but windows being windows also sees myself as a standard user so it defaults to not giving me access even though I have taken ownership of the drive. I am not sure how I would get round this.

 

I believe I have solved this by allowing the drive to be shared locally and then setting my sister's access to deny all. This does have the effect of windows popping up the 'you need administrative rights to do this' every single time the I want to do something to the drive but it is less annoying then having to put in a password all the time. 

 

And yes I do not want it encrypted because if the drive fails I want to be able to recover it if I so need to do so (even though it is backed up)

[vanished]

On 2018-09-11 at 11:07 AM, Seanbg said:

I have tried setting the drive permissions to admin only but windows being windows also sees myself as a standard user so it defaults to not giving me access even though I have taken ownership of the drive. I am not sure how I would get round this.

Restricting permissions by granting them to only certain users tends to cause problems in my experience because there are many system accounts that also need access and it can really make a mess of things.  That's why I'd advise leaving it at default but then just denying access to specific users on an individual basis (at least for your situation).  In theory that should work (ie, not break things, allow you to use it, and not allow anyone else to)

On 2018-09-11 at 11:07 AM, Seanbg said:

I believe I have solved this by allowing the drive to be shared locally and then setting my sister's access to deny all. This does have the effect of windows popping up the 'you need administrative rights to do this' every single time the I want to do something to the drive but it is less annoying then having to put in a password all the time. 

So you're accessing it as a network shared folder on the host machine?  What stops people from just accessing the drive by its letter?

On 2018-09-11 at 11:07 AM, Seanbg said:

And yes I do not want it encrypted because if the drive fails I want to be able to recover it if I so need to do so (even though it is backed up)

I would never rely on the ability to recover it once failed as a backup strategy; that's just asking to lose all your data.

[Seanbg]

@Ryan_Vickers no no I have data backed up on external drives I just want to be able to get them back if for some reason all my drives fail at the same time so that is why I don't want to encrypt them

[vanished]

1 minute ago, Seanbg said:

@Ryan_Vickers no no I have data backed up on external drives I just want to be able to get them back if for some reason all my drives fail at the same time so that is why I don't want to encrypt them

I still fear your strategy might not be completely sound.  If you care at all about the ability to recover a dead drive, that tells me your backups aren't sufficient.  But that's another topic... did the permissions thing work out in the end?  I don't quite understand how accessing the drive through the network sharing mechanism helps since it would still be available locally.