Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What i'd like to do is to set up such folder permissions so the folder can be accessed only by a user who created it (or one, who knows his password).

Is it possible? Is it secure?

I tried to set such permissions, but as local admin i simply can go to local users and groups and reset password of that user. So then i get access to his "protected" folders.

Although, when i do reset the password a warning comes up, telling me that some protected information (i thought it's exactly about folders) will be lost. So i'm guessing there should be some way of doing this?

I googled for it, and searched here, but no luck.

p.s: what i'm essentially trying to do, is to protect a subfolder in "My Dropbox" folder, so it will be protected and still synced to the cloud. That's why simple encryption does not fit.

share|improve this question
up vote 4 down vote accepted

As far as permissions are concerned -- an administrator of one type or another (Local/Domain) can always 'take ownership' of files/folders so you cannot use this to secure your files.

As other people have mentioned, encryption is the way to go...

share|improve this answer
Thanks for the answer. A very strange naming of a "permission" system than. They should clearly state than that admins always have access and i should not get any permission errors at all, if i'm under admin account. So unintuitive :( – Alexander Gornik Apr 20 '11 at 8:40

I think simple encryption is exactly what you need. You're never going to be able to secure a directory on a system where another user has administrator privileges using file system permissions - as you noted, the admin can simply remove the permissions or reset your password to a known one.

So why not encrypt the subfolder you want to protect with some third party utility (ie, not included with Windows). Dropbox should still sync the encrypted version and then you can just decrypt it as required. The advantage here is that even if the admin change the file system permissions they won't be able to decrypt the subfolder without the correct key.

share|improve this answer
I will loose change tracking and parallel editing would always generate unresolvable conflicts :( – Alexander Gornik Apr 20 '11 at 8:41

Encrypting Filesystem (EFS) is the Microsoft "answer" to what you're looking for. EFS allows for application-transparent encryption / decryption of files stored on NTFS volumes. Application software is unaware that encryption is occurring because it's handled by the filesystem. Assuming you've got a properly configured file recovery agent key (i.e. not one known by the "Administrator") files encrypted with EFS can only be decrypted by the user who encrypted them.

share|improve this answer
Thanks for the hint, i will try that. – Alexander Gornik Apr 20 '11 at 8:41
Great, it's exactly the thing i needed. Thank you! – Alexander Gornik Apr 22 '11 at 6:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.