Admin Account Accessing Other Accounts  

Page 1 of 2 12 LastLast

  1. Posts : 205
    Windows 10 Home
       #1

    Admin Account Accessing Other Accounts


    Hi,

    Why is it that when I log off from my account and log into the Administrator's account, I can still access my own data. As far as I can recall, I have never given the Admin account permission to access mine. Is this normal?

    Matt
      My Computers


  2. Posts : 15,944
    Windows 10 Home x64 Version 22H2 Build 19045.3324
       #2

    Matt,

    No.

    If you check the User folder for your normal account while you are logged into it
    C:\Users\%UserName%
    you should be able to remove the permission that it thinks you have previously given to your admin account.
    Properties, Security tab, Advanced

    Denis
      My Computer


  3. Posts : 205
    Windows 10 Home
    Thread Starter
       #3

    I think I've figured out why I can access the data from other accounts. My data is stored on a D: drive with simple folders created "documents", "pictures", etc.
      My Computers


  4. Posts : 15,944
    Windows 10 Home x64 Version 22H2 Build 19045.3324
       #4

    Matt,

    And it was careless of me not to ask if you had 'relocated' your user folders. I have also relocated mine to my D drive.

    It is possible to manually change the access permissions if you want to do so.
    - I did not bother since, like you, my Admin account is also me & I could not see any point.
    - There would be some benefit in limiting your Admin access permission if you often use the Admin account whilst online [and your Admin account might therefore be hacked one day - malware might reach every folder that the currently logged-on user has access to]. I only use my Admin account when I'm offline.

    If you do want to check/change the access permissions
    - right-click on each of your relocated Documents etc on your D drive
    - Properties
    - Security tab
    - Select Administrators [plural] in the list and you'll probably see that you have these set - Full control, Modify
    - Just for comparison, select Users\Authenticated users in the list and you'll probably see that you do not have Full control, Modify set for them.
    - Check before changing anything that your own username in the list has a tick for all the entries Full control through to Write or else has a tick on Special permissions
    - Click on Advanced
    - Check before changing anything that your own username is shown as the Owner
    - If you decide to proceed, use the guidance in Change Permissions - TenForumsTutorials

    All the best,
    Denis
      My Computer


  5. Posts : 205
    Windows 10 Home
    Thread Starter
       #5

    Thanks for the quick reply.

    When I got this computer, it came with a 128GB SSD C: drive and a 3TB D: drive. Windows was finding it a problem updating (long story and not relevant) with just 128GB and some of my data on it, so I moved it all (and also my own created "Program Files" folder, which now contains all non-essential or slow-needed programs - fast-needed or often-required programs are installed in the C: drive) to the 3TB D: drive. After updating to 2004, I decided to follow my own advice that I had been giving out to other people and created a password protected Administrator account. It obviously created more security, but I had forgotten about the way I had transferred the data to the D: drive. I will certainly consider your suggestion.

    Matt
      My Computers


  6. Posts : 205
    Windows 10 Home
    Thread Starter
       #6

    I've been fiddling around with another set up. Although I can disable the Admin from initially accessing the user account's folders, the admin only has to access the admission rights though the security tab to be able to get in. No password, etc. is needed, unlike the other way round.
      My Computers


  7. Posts : 15,944
    Windows 10 Home x64 Version 22H2 Build 19045.3324
       #7

    Matt316 said:
    I've been fiddling around with another set up. Although I can disable the Admin from initially accessing the user account's folders, the admin only has to access the admission rights though the security tab to be able to get in. No password, etc. is needed, unlike the other way round.
    Yes, that's normal behaviour.

    An Admin merely clicks on the Yes button to proceed.

    Denis
      My Computer


  8. Posts : 205
    Windows 10 Home
    Thread Starter
       #8

    This doesn't seem very secure. If the user wishes to have secure data on their account, they should be able to restrict that, even from the administrator. If the administrator's account is hacked, then the hacker could access all other accounts. The access should at least be only accessible with the user's p/w, as it is the other way round.
      My Computers


  9. Posts : 15,944
    Windows 10 Home x64 Version 22H2 Build 19045.3324
       #9

    Matt,

    Matt316 said:
    This doesn't seem very secure. ... If the administrator's account is hacked, then the hacker could access all other accounts. ...
    That is true. I cope with it by never giving my routine Admin account access to anybody else's folders.
    - MS recommend that we all use Standard user accounts for day-to-day tasks. I ignore that but I do set my UAC to full to give me some extra protection.
    - If I am investigating something that will need access to another user account's folders, I disconnect from the internet then log in to my InvestigatingAdmin user account. Then I log out of it before reconnecting.

    There is an undocumented exception to this permanent access rule. If you grant access to folders that Windows protects for its own integrity, such as folders within C:\Program files, that access permission will last for that access then be deleted.
    - I exploit this temporary access permission for my own scripts.
    - My scripts are in a folder that I've set up with the same access permissions as C:\Program files
    - The scripts can run from there, just as programs can run from C:\Program files, but cannot be edited without elevation.
    - All my shortcuts etc point to the scripts within that folder.
    - I have a separate folder I use for drafting scripts.
    - When I have a script that is ready for use, I copy it to the protected folder. I have to give myself Admin permission to proceed.
    - Later on, when I have another script that is ready for use, I copy it to the protected folder. I have to give myself Admin permission to proceed again because the previous permission expired when I finished the previous copying.
    - This scheme has the effect of ensuring that there is no non-elevated access to my protected folders so malware should not be able to penetrate.
    - I found this scheme to be easily manageable. Copying to my protected folders becomes, in effect, the act of publication.
    Set up my Tools folder ditty [post #8] - TenForums

    Denis
      My Computer


  10. Posts : 205
    Windows 10 Home
    Thread Starter
       #10

    Thank you for your very detailed reply. I have to admit that most of it goes straight over my head. But thank you anyway. Hopefully, it will help someone who does understand it. Fortunately, the system I am operating only has me as user and Admin, so it's not vitally important. It was more confusion as to an apparent obvious security risk.
      My Computers


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 15:47.
Find Us




Windows 10 Forums