Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to prevent regular users from accessing the C drive via Windows Explorer? they should be allowed to execute certain programs. This is to ensure that employees cannot steal or copy out proprietary software even though they should be able to execute it.

One way would be to change the option in windows Group Policy and set the "shell" to something other than "explorer.exe". I'm looking for a similar windows setting that just hides the C drive or otherwise prevents trivial access.

This is for Windows XP/7.

share|improve this question
    
Your edit, suggesting to change the shell, is not going to be reliable. No idea what else will break, plus it can be worked around. –  mfinni Jan 5 '11 at 15:06
add comment

3 Answers

So, how do they run the program if they can't read the drive that it's on?

In short - you can't do this the way that you're asking. For someone to execute a program, they have to have the credentials to be able to read it. Can you imagine what else would break if you really did explicitly deny users access to the C:\ drive? They wouldn't even be able to login.

You need a copy-protection or DRM solution, like a lot of games have. Or some sort of authentication server, such that the program can only run when it can contact a license server on the corporate network. I know that there are commercial solutions out there for exactly this.

Or, you could offer the program in such a way that the users never run it on their own PCs - hosted web-app, terminal service with no mapped drives, etc. Not all applications can be effectively run this way of course.

Edit - Also, why are you concerned about them decompiling it? You're not saving sensitive credentials within the application are you? For almost everything, that's a bad way to get things done. For example, if you ever have to change the password, now you have to recompile and redistribute the whole program.

If it's database access, you can distribute an ODBC connection that has the password saved in it so that the program doesn't need to have the creds hard-coded in.

Additional edit - you already asked this question last month on StackOverflow and got the same good answers that I just gave you. You can't do this as you're asking, because if someone can't read it, they can't run it. There are software solutions, someone mentioned Nalpeiron as a license server, which matched my answer above. Someone else mentioned splitting the business logic so that sensitive parts run on the server - you said the app was already developed. So you could host it on a TS and not let the users map drives, so they can't read the binaries from their desktop. That's about it.

share|improve this answer
    
question updated to reflect what I really meant. and it wasn't last month. just last week. –  Jarvis Jan 5 '11 at 15:04
    
Changing the shell will not prevent, for example, someone from using IE or Firefox to upload the executable to an external site and then decompiling at home. –  mfinni Jan 5 '11 at 15:10
    
Are you just voting all of these answers down? Not cool; these are all valid answers to the question you asked. –  mfinni Jan 5 '11 at 15:33
2  
@Jenko: Last week was last month (and last year). ;) –  Dennis Williamson Jan 5 '11 at 16:06
add comment

Well, If you want to allow execute, that they have to be able to read content of disk => They can copy it.

share|improve this answer
add comment

What you are proposing just wont work. If you have a look at this question on Stackoverflow and in particular this answer you will find further reading on how to go about securing your .net application.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.