SOLVED Hiding Partitions from Guest Account

[Shintaro]

This is just a suggestion, so feel free to ignore this.

But have you tried Group Policies?
http://superuser.com/questions/238235/how-to-hide-drive-for-specific-users-in-windows-7

 

[TrainableMan]

OK, now in Windows Explorer, right-click on F-Patti under Data(F: ), go to the Security Tab, hit EDIT, then select Users (Patti-PC\Users),. The three entries that are marked Allow, check Deny instead, then click OK and OK again.


Log on as Guest and I believe you will see F: but not your data folders. Log on as Administrator and I believe you should see and have access to F: including your the data.

From what I have read, Shintaro's link may visually prevent the Guest from seeing the drive letter in Windows Explorer, but they can still access the drive if they know it is there and, if permissions are not set, they could access the data. So I think it is important to get permissions correct above, then you could potentially go even further and hide the drive.

 

[Patti]

Ok, did what you suggested above (while logged in as Patti (Administrator). Shut down and started up again. Found I could not access F as Patti (Acministrator). Switched user into Guest Account and it worked ok, F not accessable but everything else was.

Switched User back to Patti (Admin) and changed Security back again to as it was and was able to access it again.

Guess the thing for me to do if I am going away is to deny access to F from Guest as you said, and when I get home change it back again so I can access it from Patti(Admin).? Anyway thank you for sticking with me on this

 

[TrainableMan]

Nope, that's not acceptable, let's try something else. We will specifically add YOU to the list and give you access while denying access to Users.

Do you have two logons for yourself? One as an administrator and one as a user or do you always logon as an administrator? If you have two IDs then when I say "normal" or "usual" LoginID below that would be the ID where you are a user.

Log in as Patti (Administrator), in Windows Explorer, right-click on F-Patti under Data(F: ), go to the Security Tab, hit EDIT, Click Add ...

you will get a window like this:

Type in your normal login-ID in the bottom box (I assumed your normal logon is "Patti", so that's what I put there but if that is not correct, then you need to specify your usual logon there).

Then hit the Check Names button and if you typed it wrong it will tell you "Name Not found, The object named ???? cannot be found". In which case, correct the spelling and hit OK.

Hit OK till you are back to the Permissions for F:\F-Patti window. You should now see Patti (Patti-PC\Patti) in the list. Select Patti (Patti-PC\Patti) and set everything to ALLOW except the last item: Special Permissions. Then select Users (Patti-PC\Users) and set it back to DENY like in the post above.

Logoff and log on as Guest, make sure Guest does NOT have access. Logoff and login with your usual logon (I assume Patti) and verify it DOES have access.

Let us know the results.

 

[Patti]

Tried to follow inst. Succeeded in logging into Guest and all was fine, no access to F.
Then I got lost ---- now I cannot get access to F from the Administrators account - that is the only one I have.

Attachments show none of the permissions are highlighted as Full except Patti(Patti-PC\Patti). I don't undersstand why there are so many users when I have only an administrators account.

Except, I did not mention it before to keep thing simple (for me) but I do have a dual boot system with XP (set up years ago when grey cells worked better) and I have a password for it. I hope that is not what is complicating things.

I am not sure I am up to this but what now?

 

[TrainableMan]

It looks like you did it perfectly. Are you able to regain access, restore USERS settings, like you did the times before?

I knew you had a dual-boot, but F-Patti was created in Win7 wasn't it? And everything you did above was in Win7 right? Then it should not be a problem. The only time XP might be a factor is if the files/folders are created in XP; in that case you may need to "Take Ownership" like in your other "cannot delete folders created in XP" thread.

Did a little more research and learned something new (I did mention I'm no expert on permissions). I think it explains why it is working the way it is.

Permissions can also be explicitly denied. For example, Alice might not want Bob to be able to read her file, even though he is a member of the Marketing group. She can exclude Bob by explicitly denying him permission to read the file. This is normally how explicit denies are used — to exclude a subset (such as Bob) from a larger group (such as Marketing) that has been given permission to perform an operation. Note that use of explicit denials, while possible, increase the complexity of the authorization policy and can create unexpected errors. For example, you might want to allow domain administrators to perform an action but deny domain users. If you attempt to implement this by explicitly denying domain users, you also deny any domain administrators who are also domain users. Though it is sometimes necessary, you can and should avoid the use of explicit denies in most cases.

So it doesn't work quite the way I thought it would and the opposite of ALLOW is not DENY, it is simply to uncheck Allow.

So once you regain control let's try again.
In Windows Explorer, right-click on F-Patti under Data(F: ), go to the Security Tab, hit EDIT, then select Users (Patti-PC\Users),. The three entries that are marked Allow, uncheck ALLOW (and make sure DENY is not checked either), then click OK and OK again.

NOTE: This is still a test; there may be even more to do. It depends if Guest is a member of Authenticated Users; though what I could find says it shouldn't be.

 

[Patti]

No, I did not do any of our work using XP..
Followed your inst above and have regained control in F-Patti Patti(Patti-PC\Administrators) However all the other users including Administrators is still greyed out. At least I can get to my data until it says I need Administrator control.

From within Guest the same applys. Guest can access F-Patti again so we are back where we started - almost, except no Adminitrator for F-Patti.

I do have Admin control from within C, also System. The permissions for Users(Patti-PC\Users) for C is Allow Read & Execute, List and Read.
I don't feel I am getting the hang of permissions, still a scary place.

 

[TrainableMan]

Followed your inst above and have regained control in F-Patti Patti(Patti-PC\Administrators) However all the other users including Administrators is still greyed out. At least I can get to my data until it says I need Administrator control.

Not sure I understand what you mean by this, could you show me what you have in screenshots of the permission settings for Administrators and Users for F_Patti?

 

[Patti]

Here are screenshots of the permission settings for Administrators and Users for F_Patti. Although you can see the checks under allow, they are greyed out. Only the Patti(Patti-PC\Patti) has the checks in Bold.

 

[TrainableMan]

OK, so you never got a chance to try turning off ALLOW in users because they are grayed out and you don't have control. I think you should try restoring your system to a restore point 4 days ago.

Type in system restore into the start-search box. Select System Restore to run. When the box opens up, choose the second option "choose a different restore point". Find one about Aug 17th, before we started all this. Hit the Scan for affected programs button. Note that if you installed any programs, drivers, windows updates in the last few days they should show up as affected and you will have to reapply them, but I think it is worth it for you to regain control. It might be a good idea to take a screenshot of the affected programs and post it with your next post.

If it works as I hope it does, you should have control again, not grayed out. Note Patti(Patti-PC\Patti) will likely be gone after the restore but it's OK because I don't think you need it, I think what you needed all along was just to uncheck ALLOW on USERS but not check DENY. So if you do have control again, try unchecking ALLOW in USERS ... before you bother reapplying anything that restore said was affected, because if it doesn't work you may have to restore again.

If Guest and your account work correctly after you regain control, then reapply anything the "scan for affected programs" said was done.

Sorry this is taking so long but you are doing fine, really. I know it can be frustrating or scary at times and us being an ocean apart makes the timing difficult because I'm usually asleep when you are online but I do think we can get this where it should be if you hang in a bit longer. I'm really hoping this is the one.

 

[Patti]

Ok, I went Sys Restore back to 17-08-12 (the next one is 12-08-12)
and now have F-Patti with NO permissions but I can access it. I still have Authenticated Users, System, Administrators(Patti-PC/\Admin), Users (Patti-PC\Users) all greyed out.

Guest has full access to F-Patti with permissions all greyed out.

 

[TrainableMan]

OK. That's fine, now you are back to "normal" we will DENY Guest ...

Logged on as Patti (Administrator), in Windows Explorer, right-click on F-Patti under Data(F: ), go to the Security Tab, hit EDIT, Click ADD, In the bottom box type Guest. Then hit the CHECK NAMES button (it will change it to Patti-PC\Guest) and then hit OK.

Now in that Permissions for F:\F-Patti window, you should now see Guest (Patti-PC\Guest) in the list. Select Guest (Patti-PC\Guest) and set DENY on Full Control (it should set everything to DENY but special permissions). Double check you are changing Guest not one of the others by mistake ... and Click APPLY. It will give you a warning about the dangers of DENY ... click OK.

Now change users and logon as Guest to verify the account can't access F-Patti. Then you come back here and tell me it's all working perfectly (I hope! )

 

[Patti]

hey I can call you MiracleMan today! It all works perfectly - I think.
Guest has all the permissions deny in bold. All of the other permissions for F-Patti are checked under Allow but are greyed out still. Is that what we want?

I can access F-Patti fine from my log in as Patti-Administrator.

 

[TrainableMan]

From what I researched, when they are grayed out it means they are inherited from somewhere else and that's why you can't remove them but that you can override them with a DENY. I was trying to do it without DENY because another thing I read initially said to avoid that if possible, but then yesterday I found an article by "How to Geek" and his solution was to do just what we did. So since we couldn't just NOT ALLOW maybe that is the way it has to be done.

Anyway, I',m glad it's working. I will mark this solved.

 

[Patti]

Great and many thanks:ciao: