Drive restrictions in dual boot system

[papppp]

Hello!

I have a single hard drive split in two primary partitions, C and D.
On partition C: I've installed WinXP Pro SP1
(The system directory is C:\Windows, swap file is on C.)

On partition D: I've installed WinXP Pro SP1 (new fresh installation)
(The system directory is D:\Windows, swap file is on D.)

My problem is:
Users who are working on WinXP #2 sometimes, while installing software, they
select C: as the target directory. After that, you see all kinds of programs
registered in the 2nd WinXP's registry but their program files and
executables are in drive C: !

Is there a way to deny access to drive C: for everybody using the 2nd WinXP,
even the SYSTEM account? I tried to change the drive letter into something
else (E but it wouldn't let me do it because in WinXP #2 Drive C: is
reported as "system" drive.

Thank you.

 

[Roger Abell [MVP]]

You cannot deny the System account, as you would probably
loose bootability.
What you could do is as follows.
In XP2, log in as admin, define a custom group, add all accounts
defined in XP2 into this custom group. Then, add a deny to this
custom group at the root of XP1 partition, and at each place
where inheritance is broken within XP1 partition. There will
probably be about 5 or 10 such places, more if you have many
accounts defined in XP1. Even then, there are many, many
files within .\Windows\System32 that do not inherit their perms
but have them set directly file by file, and these would not be
covered by the above.

When you boot into XP1 and look at permissions you will see
a SID for the untranslatable (to its name) custom group.

If you attempt to do this without defining a custom group,
you would be using a pre-defined, such as Users, or Administrators,
and these will be seen and understood by XP1 as the groups in XP1
and that would be tragic.

 

[papppp]

That solved my problem.
Thanks for your help!

 

[Roger Abell [MVP]]

That solved my problem.
Thanks for your help!

You are welcome. Glad it worked.
I seem to have forgetten to mention a warning for others
reading this thread, that
we were speaking of adding the custom group, not of
changing in any other way the settings where added
(which should not be done).

Roger