How to really hide accounts/files from other users?

[Peter Wilkins]

I'm renting my home for 6 months and am leaving my computer available
to the tenant as part of the deal, but I want to hide my data files
(mainly those in My Documents) from the tenant and prevent him
reading, changing or deleting them.

My account is password protected. I created a tenant user account for
the tenant, installed a few necessary programs like on-line ADSL
access and then converted it to a limited account. I made my account
folders private/not shared so my data doesn't appear if the tenant
opens his My Computer. So far so good - he can't access my data files
that way without my password.

However, if he just opens up Windows Explorer from his limited
account, and goes to C:\Documents and Settings\, my account folder is
listed there, as well as the Administrator and tenant accounts. All
the account data under my name including all the files in my My
Documents are accessible from the tenant account. He can read them,
modify them, but at least he can't delete them. Not what I wanted!

Is there any way I can prevent the tenant accessing my My Documents
data under Windows Explorer? (apart from backing it all up to CD and
deleting it from the computer until I return, which is a last resort)

I have been able to hide from the tenant account a second HDD with
backups and archives from Windows Explorer by unticking it under
TweakUI, and once the tenant account is changed to limited he can't
change it back under TweakUI, but I guess he could do it in the
registry if knowledgable. But I can't hide My Docs on C:

Any advice appreciated
TIA

 

[Jupiter Jones [MVP]]

Peter;
If the tenant can read and modify data, the data are NOT private.
http://www3.telus.net/dandemar/Private.htm

Also if the tenant has physical access, the tenant has access to all
your data.
If your data is important, the only option you have is to remove it
from the computer.

See law #3:
http://www.microsoft.com/technet/tr.../technet/columns/security/essays/10imlaws.asp

--
Jupiter Jones [MVP]
An easier way to read newsgroup messages:
http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
http://www3.telus.net/dandemar/


message I'm renting my home for 6 months and am leaving my computer available
to the tenant as part of the deal, but I want to hide my data files
(mainly those in My Documents) from the tenant and prevent him
reading, changing or deleting them.

My account is password protected. I created a tenant user account for
the tenant, installed a few necessary programs like on-line ADSL
access and then converted it to a limited account. I made my account
folders private/not shared so my data doesn't appear if the tenant
opens his My Computer. So far so good - he can't access my data files
that way without my password.

However, if he just opens up Windows Explorer from his limited
account, and goes to C:\Documents and Settings\, my account folder is
listed there, as well as the Administrator and tenant accounts. All
the account data under my name including all the files in my My
Documents are accessible from the tenant account. He can read them,
modify them, but at least he can't delete them. Not what I wanted!

Is there any way I can prevent the tenant accessing my My Documents
data under Windows Explorer? (apart from backing it all up to CD and
deleting it from the computer until I return, which is a last resort)

I have been able to hide from the tenant account a second HDD with
backups and archives from Windows Explorer by unticking it under
TweakUI, and once the tenant account is changed to limited he can't
change it back under TweakUI, but I guess he could do it in the
registry if knowledgable. But I can't hide My Docs on C:

Any advice appreciated
TIA

 

[John A]

If XP Home edition he can get in as Admin anyway.

You could password protect the sensitive files individually using the
software that created them, eg Word / Excel.

Better to put your files on CD and remove from computer

John Allen

 

[Grant]

It sounds like your hard drive is using FAT32. If you upgrade it to NTFS you
should be able to encypt the files and restrict their access better.

 

[wayne]

Ideally you should invest in a cd burner and get the files off or at the
least spend 60 bucks on a new hard drive that comes with drive copying
software. Copy the drive and take your stuff off it!

If you convert the drive to ntfs you can change the folder to hidden and
then it will not show up to a casual user. You can encrypt the data using
WinZip that is the only program that I have found to be fairly secure. Word
and Excel files takes less than 30 seconds to hack PDF files the same. I
have searched for zip file password hackers and have no luck. You could zip
your whole folder then give the tenant NO ACCESS to the file. Still
possible they could delete it so really best way is to get it off the
computer as a security measure!


Wayne


I'm renting my home for 6 months and am leaving my computer available
to the tenant as part of the deal, but I want to hide my data files
(mainly those in My Documents) from the tenant and prevent him
reading, changing or deleting them.

My account is password protected. I created a tenant user account for
the tenant, installed a few necessary programs like on-line ADSL
access and then converted it to a limited account. I made my account
folders private/not shared so my data doesn't appear if the tenant
opens his My Computer. So far so good - he can't access my data files
that way without my password.

However, if he just opens up Windows Explorer from his limited
account, and goes to C:\Documents and Settings\, my account folder is
listed there, as well as the Administrator and tenant accounts. All
the account data under my name including all the files in my My
Documents are accessible from the tenant account. He can read them,
modify them, but at least he can't delete them. Not what I wanted!

Is there any way I can prevent the tenant accessing my My Documents
data under Windows Explorer? (apart from backing it all up to CD and
deleting it from the computer until I return, which is a last resort)

I have been able to hide from the tenant account a second HDD with
backups and archives from Windows Explorer by unticking it under
TweakUI, and once the tenant account is changed to limited he can't
change it back under TweakUI, but I guess he could do it in the
registry if knowledgable. But I can't hide My Docs on C:

Any advice appreciated
TIA

 

[Peter Wilkins]

I'm renting my home for 6 months and am leaving my computer available
to the tenant as part of the deal, but I want to hide my data files
(mainly those in My Documents) from the tenant and prevent him
reading, changing or deleting them. snip
Is there any way I can prevent the tenant accessing my My Documents
data under Windows Explorer? (apart from backing it all up to CD and
deleting it from the computer until I return, which is a last resort)
snip>
Any advice appreciated

Thanks everyone for all the replies and advice. All very good.

I did forget to mention that I was using XP Pro and NTFS with
encrypted data folders, but even with all the security provisions in
place, I can't stop him looking at the files, or possibly booting from
a DOS floppy and deleting everything.

I did recheck and found that although under the tenant account he can
view the names of all the encrypted data files, he can't actually read
or change them. I originally checked this with a Winword file, and I
somehow hadn't encrypted the Winword sub folder and files. Once it
was encrypted, those files couldn't be read.

So I now feel reasonably happy leaving them on the computer, but will
do a last minute Ghost system backup of everything to CD before I
leave, and will take the CD's with me, so I can reinstate everything
if he somehow deletes all my files from the computer.

Thanks again. Your advice really clarified my mind.

 

[Peter Wilkins]

Ideally you should invest in a cd burner and get the files off or at the
least spend 60 bucks on a new hard drive that comes with drive copying
software. Copy the drive and take your stuff off it!

If you convert the drive to ntfs you can change the folder to hidden and
then it will not show up to a casual user. You can encrypt the data using
WinZip that is the only program that I have found to be fairly secure. Word
and Excel files takes less than 30 seconds to hack PDF files the same. I
have searched for zip file password hackers and have no luck. You couldzip
your whole folder then give the tenant NO ACCESS to the file. Still
possible they could delete it so really best way is to get it off the
computer as a security measure!

Thanks Wayne,
Already have the burner and software.
That's all good advice and I had already done most of it - I was just
hoping to be able to leave my stuff on the system so it would be
immediately available when I got back.

I have checked again, and I find that under the tenant account he can
read the titles of the encrypted files, but not the content, so I can
leave them on the system with relative safety - unless he deletes them
all from DOS. I had just one of my data folders unencrypted and did
my initial test on that - Murphy's Law - but just as well I found it.
I should have noticed that it was the wrong colour in the Windows
Explorer listing, but I missed it.

I already had some especially sensitive stuff zipped up under WinZip
and password protected, so as it is encrypted on top of that, it
should be OK.

So I feel reasonably happy at leaving the data on board. But I am
going to do a complete Ghost system backup to CD in any case, just
before I leave, so I can reinstate everything just in case the tenant
deletes everything or stuffs up my computer completely.Thanks again