I have a Windows 8 machine. All domain accounts are local administrators.

Currently, it is very easy for one administrator to look at the other users personal files simply by browsing to their personal folders and confirming that they want permanent access in the UAC prompt.

How do I prevent that, and restrict access for each administrator to their individual folder only?

Is there any official Microsoft way of keeping private between local administrators?

  • 12
    Don't give people you don't trust admin access. – ceejayoz Apr 24 '14 at 21:07
  • Don't make them Administrators? – joeqwerty Apr 25 '14 at 1:25
  • Can the thread be moved to Superuser? – Mikael Dúi Bolinder Apr 25 '14 at 9:26
  • @MikaelDúiBolinder You'll get the same answer there. – ceejayoz Apr 25 '14 at 20:51
  • Your edit does not change the answer, either. – Michael Hampton Nov 27 '14 at 15:26

You can't.

It is the nature of Administrator accounts to be able to do essentially everything. Even if you change the file permissions to block "other" Administrator accounts from accessing certain files, they will be able to take ownership and give themselves permissions to access whatever files they want to.

Your only real option is to give everyone limited (non-Administrator) accounts.

Alternately, it is possible to enable file access auditing, and have those logs forwarded to another computer, so you can see who is accessing what, and that is usually sufficient to prevent people from snooping where they are not allowed, but when it gets right down to it, an Administrator account is an Administrator account. It has, or can give itself, full access to everything, because that's what it's designed to do.

  • And there's this too... agree 100%, but at least if he uses my recommendation below, I'm assuming the users aren't smart enough to take ownership, although that doesn't mean that they won't someday. – Brad Bouchard Apr 24 '14 at 21:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.