Home/ Questions/Q 101169
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T00:43:10+00:00

Let me state first: I know that any user that wants to run a

  • 0

Let me state first: I know that any user that wants to run a program (or even log in), has to have access to (probably at least) the Windows system directories and the shared libraries in %ProgramFiles%, but I’d like to be able to access Skype, for example, by running it with an unprivileged user and make sure that it can’t access any unnecessary files.

I fear that the only way to do this would be to identify all of the gazillion directories where I store files that I don’t want this user to access and then create a new user group that can access these directories, or run Skype and Azureus in a VM.

Is there a better way?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Normally, accounts are members of the Users group at least, which does have access to many things. You could make the account a member of no groups, or the Guests group which is very restrictive.

    The real issue is that the program’s token (an internal security object that keeps track of what security identities a running process has) will contain the Everyone and Authenticated Users groups, which also have read access to lots of stuff. There is no way to create an account without those groups. You could remove the access that Everyone and Authenticated Users groups have to most everything, but it would be a lot of work to track all those down.

    I would say that creating a standard user or guest access account for untrusted programs would be plenty secure enough. To support self-updates and to keep related files in the same place, I suggest you install those programs directly in the profile of the user account they will be running as, e.g. C:\Documents and Settings\skype\Program Files\Skype

    If you want to get really fancy, you can use a restricted token to either make the Everyone, Authenticated Users, etc. groups deny only (so they can’t grant any access) or create a Restricted SID list. This will be difficult to implement because there are global objects that programs will expect to access that the Everyone group has access to, which is normally a safe choice.

    See CreateRestrictedToken Function.

    There is also an open-source command line program I created a program for creating restricted tokens and job objects on the fly for that purpose: UlimitNT

    • 0