Windows Tips

Securing Files and Folders

When two or more people use the same computer, how do you keep each user from snooping in files and folders that should be private? How do you allow easy access to files that should be shared? And how do you keep untrained users from accidentally wiping out important files? Out of the box, anyone with a user account on a Microsoft Windows XP computer has virtually unlimited access to files and folders. In either edition of Windows XP, you can lock up your personal files and folders by selecting a single check box, even if you know nothing about security. Or, with Windows XP Professional and some advanced access control options, you can exercise precise control over who gets to access any file or folder on any drive.

If the bulk of your previous computing experience is with Windows 95, Windows 98, or Windows Me, the entire notion of file and folder security is probably an alien concept. Those consumer-based operating systems offer only the most rudimentary security. On the other hand, if you’re a seasoned Windows NT or Windows 2000 user, you probably already understand the basics of access control; your challenge with Windows XP is understanding its new and radically different Simple File Sharing interface.


How Setup Decisions Dictate Your Security Options

Three factors dictate how much control you have over access to shared files and folders on a computer running Windows XP:

Disk format.
Access controls, which determine whether a given user can open a folder, read a file, create new files, and perform other file operations, are available only on NTFS-formatted drives. On drives formatted with FAT32, most local security options are unavailable. Any user can access any file without restriction.

Windows XP edition.
By default, Windows XP Home Edition and Windows XP Professional share a simplified security interface that allows you to set a limited number of access controls based on built-in group memberships. If you use Windows XP Professional, you can configure your system to use more complex security options that closely resemble those found in Windows 2000. We discuss the differences between these options fully in this section.

User account settings.
During setup, Windows XP creates a group of shared folders specifically designed to hold files for all users of that computer. (If your computer is joined to a Windows domain, these shared locations are unavailable.) In addition, each user with an account on the machine can designate certain folders as private.

NTFS vs. FAT32

When it comes to security, the single most important factor is the file system you’ve chosen for the drive containing the Windows system files and user profiles. If the drive is formatted using the FAT32 file system, none of the options discussed in this section apply to you. The only way to enable file system permissions is to convert the drive to NTFS format.


Simple File Sharing vs. Advanced Permissions

On a clean installation or an upgrade over Windows 98/Me, Windows XP assigns default security settings that work like on/off switches. This Simple File Sharing interface initially makes all the files in your user profile (including your My Documents folder, desktop, Start menu, and Favorites) visible to anyone who has an admini-strator’s account on your computer (users with limited accounts are restricted from viewing files in other profiles). As Figure 13-1 shows, opening the My Computer window displays a separate icon for the folder that holds each user’s personal documents, along with an icon for a Shared Documents folder. (See the following section for a full discussion of how the Shared Documents folder works.)

This low-security configuration is similar to the standard setup on a machine running Windows 95/98/Me. In an environment where all users trust each other completely, it makes collaborating easy: If you and a coworker share a computer, you can each keep your personal files organized in your My Documents folder for convenience; if you need to look at a file that your coworker created, you open his or her My Documents folder. Likewise, at home, you and your spouse can browse each other’s files.

But some environments demand less trust and more protection. On a home computer, for example, parents might want to keep financial data and other private files locked out of the reach of children—not just to ensure privacy, but also to protect them from accidental changes or deletion. By selecting a check box on the Sharing tab of a folder’s properties dialog box, you can designate as private all or part of your user profile. After you’ve selected that option, your files are visible only when you log on using your account.

It’s certainly easy to make a folder private—all you do is right-click a folder, choose Sharing And Security, and select the Make This Folder Private check box—but this Simple File Sharing option suffers from some significant limitations:

The Make This Folder Private option is available only within your user profile. If you use a program that stores its user data in any other location, you cannot protect that folder from unauthorized access. Likewise, if you’ve created a second partition on which you store digital images, media files, or other space-gobbling data, you have no way to protect those files from unauthorized access or accidental deletion.

Protection applies to all files and subfolders within a folder where you select this option. You cannot protect an individual file, nor can you single out files or subfolders within a protected folder and make them available to others.

The "private" setting is an all-or-nothing proposition. When you select the Make This Folder Private check box, Windows sets permissions on that folder so that you and only you can access files stored in that location. Clear the check box, and any user who logs on to the computer can view the files stored there.

When Simple File Sharing is enabled and you move or copy files or folders between a private folder and a shared location, the moved or copied objects always take on the security attributes of the destination folder. This behavior changes if you disable Simple File Sharing.



Keeping Your Own Files Private

If you create a new account during setup, or if the Windows Setup program automatically creates your user account when you upgrade from Windows 98 or Windows Me, your account starts out with no password. As the final step when you add a password to your own account from User Accounts in Control Panel, Windows displays the dialog box , which offers to help you make your files and folders private. (This option does not appear if your user profile is stored on a FAT32 drive.)

Using this option to make your files private is convenient, but it’s not the only way to exercise your right to privacy. Regardless of which choice you make when presented with this dialog box, you can change your mind later. You can add or remove protection from your entire profile, or apply the Make This Folder Private option to selected subfolders in your profile.

If you choose this option, Windows resets the permissions on your user profile so that only you can view or open your files and folders.

To protect your entire profile, follow these steps:
In the Run box or from any command prompt, type %systemdrive%\documents and settings.
Right-click the icon labeled with your user name and choose Sharing And Security.
Under Local Sharing And Security, select the Make This Folder Private check box.

Select the Make This Folder Private check box to prevent other users from accessing files in your user profile.

Click OK to close the dialog box and apply your changes.

Other users who log on to the same computer and open the My Computer window can no longer see the folder icon that represents your My Documents folder if you’ve made your user profile private. Other users who try to access your profile by opening the Documents And Settings folder will receive an "access denied" error message when they double-click the folder that contains your profile. The result is the same if another user tries to open a subfolder that you’ve made private.

You can apply protection to selected subfolders within your user profile. For instance, you might want other users to be able to work with some files in your My Documents folder while keeping other files protected. To set up this sort of partial protection, create a subfolder and give it a descriptive name like Private. Then move the files andfolders you want to protect into that subfolder, and select the Make This Folder Private option for that folder only.