On a *nix system I can use a chroot to isolate two processes from each other and from the rest of the system. Is there any similar security system under windows? Or is there any way to prevent two processes from reading/writing to each others files?

  • 1
    I'm not sure the security tag is warranted here. kerneltrap.org/Linux/Abusing_chroot – MDMarra Jul 18 '10 at 16:54
  • 1
    @The Rook - In that kerneltrap discussion, kernel devs discuss the fact that chroot was never intended to be a security device/ – MDMarra Jul 18 '10 at 18:12
  • 1
    @The Rook - Right, I was simply saying that you may want to rephrase the question. There have been extensions to chroot or spins on the concept (like jails) that have been designed with security in mind. In your post, you refer to chroot as a security device, which it was never intended to be. – MDMarra Jul 18 '10 at 19:57
  • 1
    @Nathan Adams I agree, but "security in layers". – Rook Jul 18 '10 at 23:37
  • 1
    Looks like I've asked something fairly similar here. Did you ever manage to set this up on Windows Server? The answer you accepted neither explains how to do this, nor says that it's not possible... – RomanSt May 13 '13 at 19:13

I'm not sure you will gain anything on Windows by chrooting - do you have a specfic need?

In case any the top result on google is http://www.winquota.com/wj/.

Perhaps application virtualization might be an option? Microsoft has the following to say about it:

In a physical environment, every application depends on its OS for a range of services, including memory allocation, device drivers, and much more. Incompatibilities between an application and its operating system can be addressed by either server virtualization or presentation virtualization; but for incompatibilities between two applications installed on the same instance of an OS, you need Application Virtualization.

  • 5
    One of my processes was poorly written and very insecure, management doesn't want to fix it because it would be "too expensive". I expect this process to get owned eventually and i want to limit the impact on my system. If you really believe there is nothing to gain, then you must read more about chroots. – Rook Jul 18 '10 at 17:49
  • 1
    "I'm not sure you will gain anything on Windows by chrooting" Why? Is this like trying to patch one hole in a net? I am well aware that windows is one of the least secure platforms used in modern times, are you saying that fixing architectural security flaws in windows is just hopeless? – Rook Apr 3 '15 at 19:42
  • @Rook Because on Windows you can have access rights divorced from filesystem layout. Your chestbeating in the comments section of this answer aside, that is the approach most people take to insulate portions of the file system from a process that is not authorized to access it; simply give the user the process is started under access to the subset of the filesystem and services that it needs. – Asad Saeeduddin Feb 28 '16 at 2:36
  • @Asad Saeeduddin Speaking of filesystems, doesn't windows just autorun untrusted executables found on a USB sticks? What year is it? – Rook Mar 1 '16 at 3:06

Sandboxie http://www.sandboxie.com/

Not exactly like chroot. It does setup a sandbox for each program you specify. It can easily keep processes isolated.


I wouldn't use anything like this, you are running under Windows mate.

NTFS has the most fine grained access rights you can find. Its not hard to let a prozess start with lower privileged user, and only giving that user access to the files of this single application.

No need to use something like chroot, which is not a security tool, when you can already define what user is allowed to do what in what directory.

Its no different than like giving the Apache under Linux its own user, only allowed to work inside his folders.

  • 5
    Windows is one of the least secure platforms i have ever had the privilege to hack. No one should be using anything by Microsoft if they care about security. A chroot is the "bare minimum" security system we can use to try and lock down this joke of a platform. – Rook Apr 3 '15 at 19:47
  • 2
    This is the correct answer as to why chroot isn't needed – Jim B Jan 5 '16 at 18:41
  • @Jim B I eat domain administrators for breakfast and wash them down with golden tickets. – Rook Jan 5 '16 at 19:24
  • @rook, then they failed to follow the BPSAD and PTH whitepapers to eliminate golden ticket attacks. As far as I know that only still works on *nix based kerb. – Jim B Jan 5 '16 at 22:23
  • @Jim B compartmentalization may sound foreign in a platform that routinely grants administrative rights to the browser, database, and web server. however, sandboxes are a quint essential defense-in-depth measure irregardless of platform. – Rook Jan 5 '16 at 23:26

There is a chroot.exe included in Gow (Gnu On Windows)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.