Question Trying to edit folder permissions for an alternate user account

[royrichard1290]

I'm trying to create basically a guest account, but since Windows 10 doesn't have a guest account setting I am having to set up a normal account for this. I'm having trouble blocking access to my external hard drives for this account though.

When I go into Windows settings to change an account type in the "Family & other users" section, I can only select "Standard User" or "Administrator". So this guest account is a standard user, and my own login is an administrator, but I cannot change folder permissions for one and not the other.

When, for a folder, I go to properties > security > under "Group or user names", and try to edit "Users", it doesn't affect either account. If I edit "Authenticated Users", it affects both my own account and the guest account, even if I don't touch the "Administrators" group.

So I'm stuck. How do I edit permissions for that guest account and not my own?

 

[USAFRet]

What you're actually trying to do is prevent a local Standard Account from accessing your external drive?

 

[royrichard1290]

What you're actually trying to do is prevent a local Standard Account from accessing your external drive?

Yes.

 

[USAFRet]

Yes.

A secure way to do this is to encrypt that external drive. No access at all, from anyone or any OS, without the password.
VeraCrypt would do this easily.

 

[royrichard1290]

A secure way to do this is to encrypt that external drive. No access at all, from anyone or any OS, without the password.
VeraCrypt would do this easily.

Yes, I know I can do that, but I would have to format my hard drives to encrypt them, and also open up Veracrypt to open the hard drives every time I rebooted my PC. And my drives have like 12 terabytes of data on them, so it wouldn't be easy to recover all my files. I would much prefer to remove permissions to access the hard drives at the moment.

 

[USAFRet]

Yes, I know I can do that, but I would have to format my hard drives to encrypt them, and also open up Veracrypt to open the hard drives every time I rebooted my PC. And my drives have like 12 terabytes of data on them, so it wouldn't be easy to recover all my files. I would much prefer to remove permissions to access the hard drives at the moment.

Sorry, I was just proposing a method that cannot be circumvented by the user.

 

[royrichard1290]

I see, but I'm not sure it matters too much if it can be circumvented. Right now it's very easy for someone on that account to access my files and modify them. I just want to prevent that for now, I don't think anyone who uses that account will be computer-literate enough to circumvent these measures, and they probably won't really care; the problem is that it's just too easy to do these things right now and that is what makes me scared that something could happen.

 

[royrichard1290]

Also I just realized that it would be nice to let them access some of the folders without being able to modify them.

 

[USAFRet]

Also I just realized that it would be nice to let them access some of the folders without being able to modify them.

Introducing another level of complexity.

 

[royrichard1290]

Introducing another level of complexity.

Yeah but it seems like it would be easy if the permissions settings worked, but they don't seem to work at all. I don't know why those settings even exist. Maybe because they worked in older versions of Windows? I even found the specific account I wanted to edit permissions for in those settings but they did nothing. Nothing I toggle in that menu makes any difference at all.

 

[royrichard1290]

Can someone confirm or deny what I'm saying? How come the permissions settings are like that? I will probably look into setting up VeraCrypt at some point but I would like to know definitively why those settings don't work for me.

 

[BFG-9000]

I would plug the external drive into a NAS. You could share it with a password and/or set it to read-only in there, no encryption needed.

Surprisingly, even the USB ports of recent routers can serve up USB storage at near gigabit line speed, albeit at near 100% CPU load on the router when moving data that fast.

 

[EggShell]

NTFS permissions do work correctly if they've been set correctly, have you ensured that the files and/or directories aren't inheriting permissions from an ancestor directory? The easiest method to check for which permissions have been set is to use icacls.

 

[SkyNetRising]

When, for a folder, I go to properties > security > under "Group or user names", and try to edit "Users", it doesn't affect either account. If I edit "Authenticated Users", it affects both my own account and the guest account, even if I don't touch the "Administrators" group.
So I'm stuck. How do I edit permissions for that guest account and not my own?

Edit security properties.
Add access to your user account only.
Remove access for all other users and groups. You can leave access for Administrators group.

Also I just realized that it would be nice to let them access some of the folders without being able to modify them.

Add access for Users group and set it to read/execute.