Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In Windows Server 2008 R2, can I grant permission for a specific application to access a drive, while at the same time blocking users from viewing/browsing/reading that drive?

Edit: Additional Info:

Users are logged in to a terminal server.

The application is a 3rd party rich GUI .exe, launched by the user. It stores large images files on the hard disk. I would like the user to only be able to access these files through the application, not by browsing the disk.

The application does not have a service component.

share|improve this question
You might be able to pull that off if the program is using a process running as a service on a server. Grant the account that is running the process access to the folder – Nixphoe Jun 21 '11 at 19:39
Are you talking locally logged in users, as in RDS sessions? – joeqwerty Jun 21 '11 at 19:46
up vote 0 down vote accepted

There are 2 GP settings that block visibility and access to drives. These settings do not inhibit the ability of programs to access said drives.

The settings are:

  1. User Configuration|Administrative Templates|Windows Components|Windows Explorer|Hide these specified drives in My Computer

  2. User Configuration|Administrative Templates|Windows Components|Windows Explorer|Prevent access to drives from My Computer

share|improve this answer

As long as the application launches using specfic credentials (such as a service, or task) you should be able to modify the NTFS ACLs on the system to allow only that credential and not other users. Would need more info on your specific application to comment further.


Here's what to do to get your app to run as a service (this was taken from the technet forums)....

At the time of this posting, there is no Windows Server 2008 Resource Kit Tools, so get the "srvany.exe " from the "Windows Server 2003 Resource Kit Tools " and copy it to a suitable location on your Win2008 server (e.g. C:\Windows\System32\ ).

Use "sc " to create a new service that launches "srvany " (e.g. sc create MyService binPath= C:\Windows\System32\srvany.exe DisplayName= "My Custom Service" )

Using RegEdit : create a "Parameters " key for your service (e.g. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MyService\Paramaters\ )

Using RegEdit : within the newly created "Parameters " key , create a string value called "Application " and enter the full path to the application you are wanting to run as a service.  (No quotes required.) 

And that should do it.

Note : some applications store their settings in a user hive, not under HKEY_LOCAL_MACHINE, so you will need to run the application to configure it, and then configure the service to run as that user.


share|improve this answer
The application is a standard .exe, launched by the user. Is there a way I can force it to run with specific credentials? – Justin Hawk Jun 21 '11 at 21:27
It looks like the srvany.exe tool from the 2003 Resource kit will still work in server 2008. I updated my original post with some steps on how to do it. – Tatas Jun 22 '11 at 16:25
Thanks, that's a clever workaround. To give launch control to the user, I can add a bootstrap application that starts the service. Hopefully that wouldn't alter the service's security context. – Justin Hawk Jun 22 '11 at 17:42
Well it will, but you're going to be running the service as a low-privileged user (I hope) so in theory your security is still tight. – Tatas Jun 22 '11 at 20:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.