Admin Account Accessing Other Accounts

Matt,

No.

If you check the User folder for your normal account while you are logged into it
C:\Users\%UserName%
you should be able to remove the permission that it thinks you have previously given to your admin account.
Properties, Security tab, Advanced

Denis

Matt,

And it was careless of me not to ask if you had 'relocated' your user folders. I have also relocated mine to my D drive.

It is possible to manually change the access permissions if you want to do so.
- I did not bother since, like you, my Admin account is also me & I could not see any point.
- There would be some benefit in limiting your Admin access permission if you often use the Admin account whilst online [and your Admin account might therefore be hacked one day - malware might reach every folder that the currently logged-on user has access to]. I only use my Admin account when I'm offline.

If you do want to check/change the access permissions
- right-click on each of your relocated Documents etc on your D drive
- Properties
- Security tab
- Select Administrators [plural] in the list and you'll probably see that you have these set - Full control, Modify
- Just for comparison, select Users\Authenticated users in the list and you'll probably see that you do not have Full control, Modify set for them.
- Check before changing anything that your own username in the list has a tick for all the entries Full control through to Write or else has a tick on Special permissions
- Click on Advanced
- Check before changing anything that your own username is shown as the Owner
- If you decide to proceed, use the guidance in Change Permissions - TenForumsTutorials

All the best,
Denis

Matt316 said:

I've been fiddling around with another set up. Although I can disable the Admin from initially accessing the user account's folders, the admin only has to access the admission rights though the security tab to be able to get in. No password, etc. is needed, unlike the other way round.

Yes, that's normal behaviour.

An Admin merely clicks on the Yes button to proceed.

Denis

Matt,

Matt316 said:

This doesn't seem very secure. ... If the administrator's account is hacked, then the hacker could access all other accounts. ...

That is true. I cope with it by never giving my routine Admin account access to anybody else's folders.
- MS recommend that we all use Standard user accounts for day-to-day tasks. I ignore that but I do set my UAC to full to give me some extra protection.
- If I am investigating something that will need access to another user account's folders, I disconnect from the internet then log in to my InvestigatingAdmin user account. Then I log out of it before reconnecting.

There is an undocumented exception to this permanent access rule. If you grant access to folders that Windows protects for its own integrity, such as folders within C:\Program files, that access permission will last for that access then be deleted.
- I exploit this temporary access permission for my own scripts.
- My scripts are in a folder that I've set up with the same access permissions as C:\Program files
- The scripts can run from there, just as programs can run from C:\Program files, but cannot be edited without elevation.
- All my shortcuts etc point to the scripts within that folder.
- I have a separate folder I use for drafting scripts.
- When I have a script that is ready for use, I copy it to the protected folder. I have to give myself Admin permission to proceed.
- Later on, when I have another script that is ready for use, I copy it to the protected folder. I have to give myself Admin permission to proceed again because the previous permission expired when I finished the previous copying.
- This scheme has the effect of ensuring that there is no non-elevated access to my protected folders so malware should not be able to penetrate.
- I found this scheme to be easily manageable. Copying to my protected folders becomes, in effect, the act of publication.
Set up my Tools folder ditty [post #8] - TenForums

Denis