Question

I have an admin app that runs with elevated privileges and I need it to store some sensitive files in a directory that only system administrators can access.

It probably has to do with the following call but I am not sure how to configure it.

Directory.CreateDirectory(@"C:\SomePath", new AccessControl.DirectorySecurity() { AccessRightType = ?, AccessRuleType = ?, AuditRuleType = ?);

If there is a better way to achieve the same, please let me know. Thanks.

EDIT: Found a good implementation here. Will leave the question open for a day in case there are any other suggestions.

Answer 1

Found a good solution here.

FileSystemAccessRule administratorRule = new FileSystemAccessRule("Administrators", FileSystemRights.FullControl, InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit, PropagationFlags.None, AccessControlType.Allow);

FileSystemAccessRule guestRule = new FileSystemAccessRule("Guest", FileSystemRights.CreateDirectories | FileSystemRights.CreateFiles, AccessControlType.Allow);

DirectorySecurity dirSec = new DirectorySecurity();
dirSec.AddAccessRule(administratorRule);
dirSec.AddAccessRule(guestRule);

Directory.CreateDirectory(@"C:\GuestTemp", dirSec);