Question

I am trying to create a program similar to Folder Lock which prevents users from accessing a particular folder. I tried using DirectorySecurity class and AccessRules to change the AccessControl for folders.

However, the settings which i assign can easily be changed by going to “Security Tab” and changing the permissions.

Is there any secure way of preventing access to directories ?

Answer 1

I think my answer to this question: “How could I prevent a folder from being created using a windows service?” is probably what you’d need to do to achieve what you want:

Unfortunately I don’t know anywhere
near enough about the how to help you,
but I’m fairly sure that you’ll need
to either write or obtain a File
System Filter Driver that can
communicate with your windows service
to tell it that someone has attempted
to create a directory/file so that
your service can make a decision for
it. This way when someone/something
attempts to create a file or folder
that’s not allowed they could be
returned “Access Denied” or another
Win32 error of your choice.

If you did go down the route of using
a driver, I’d guess it’d still be best
to do the heavy lifting of deciding if
the creation/modification in the
service, i.e. outside of Kernel mode.