Permissions / Childproofing computer

I want to have my kids be able to use my pc, with it as secure as practicable. I made them a Kid account, in just the User Group. However, I see that they had modify/delete access to places that I don't want. (like my D: drive with our photos and other things).

So I thought to take away Modify access for Authenticated Users in those areas, which worked. And then give Modify permission to Power Users, and then add myself to the Power User group.

But now, on all those folders, it's requiring admin permission to edit anything now. I don't want this.

So what am I missing? Maybe there is something in Group Policy that I need to change?

Bazillions of google results but can't find one for this. Sorry if it's out there!

Thanks!

Winver: 22H2 19045.3930

Had you thought of adding your picture folders to one of your libraries?

For example, your kids can't see your Documents, or your Pictures.

You can Include folders into an existing library:
Include Folder or Drive to Library in Windows 10

or if you wish create a new one:
Create New Library in Windows 10

If your computer has multiple user accounts, each account usually has its own private set of files and libraries. Other users generally cannot access your libraries unless you explicitly share them or place them in a shared location.

Worth trying.. and then check it works, of course!

I have never seen a Power user or a Power users group.
Perhaps you mean Admin users.
What you have written makes me think you have limited Modify permissions to Admin group users in which case the computer is quite rightfully asking for Admin permission to modify anything in that folder i.e. it is doing exactly what you have told it to do.

There are many ways of approaching this problem but, personally, I would
1 Undo all the changes you have done. I hope that you made a system image beforehand so you can simply restore that.
2 Explicitly Deny

- Modify
- Read [and Read-execute]
- List
- Write

permission to those specific named user accounts you gave your children.

Change Permissions - TenForumsTutorials

xanderax said:

Maybe there is something in Group Policy that I need to change?

You have Windows Home. You do not, therefore, have a Group policy editor [and cannot add one that works so ignore any suggestions to that effect].


Best of luck,
Denis

---

Welcome to TenForums.

It's really worth making time to browse through the Tutorial index - there's a shortcut to it at the top of every page.

- At the foot of the Tutorial index is a shortcut to download it as a spreadsheet.
- I download a new copy each month.
- By downloading it as a spreadsheet I can benefit from Excel's excellent filtering capabilities when I search for topics of interest.

- Tutorials are also listed by category at Tutorials - there's also a shortcut to that at the top of every page.
- Both tutorial lists are searchable.
- You can also search for TenForumsTutorials in many general search engines, such as Google, by adding site:tenforums.com/tutorials after your search term. For example,
taskbar toolbars site:tenforums.com/tutorials

You can search TenForums using the search box in the top-right corner of all TenForums webpages or using Advanced Search - TenForums
- You can also search TenForums threads in many general search engines, such as Google, by adding site:tenforums.com after your search term. For example,
Search for drivers by HardwareID site:tenforums.com
- [This is what the search box in the top-right corner of TenForums webpages does automatically]

dalchina said:

Had you thought of adding your picture folders to one of your libraries?

Thanks, yes I could do that, but I also share them with my wife. I've also got tons of other stuff (hobby web server, backups, etc). I like having it all on it's own drive.

- - - Updated - - -

F22 Simpilot said:

Messing with permissions and whatnot can be a PITA. If it were me I'd run some kind of parental control software instead. You may also want to change your DNS to NextDNS. In NextDNS you can restrict all kinds of Internet things. Also, a very old program called Time Freeze may come in handy, but it's not for everyone and can be cumbersome.

Download Toolwiz Time Freeze - MajorGeeks (Use the Major Geeks mirror because the original website doesn't appear to work anymore).

Using Toolwiz Time Freeze by Majorgeeks.com - YouTube

Yes thanks you're right I need to do stuff like that to protect them... still want to protect my files. Would love to do it in a built in way though.

- - - Updated - - -

Try3 said:

I have never seen a Power user or a Power users group.
Perhaps you mean Admin users.
What you have written makes me think you have limited Modify permissions to Admin group users in which case the computer is quite rightfully asking for Admin permission to modify anything in that folder i.e. it is doing exactly what you have told it to do.

Power Users is a built-in group in Windows Pro... though now I'm seeing it has been somewhat depreciated. Maybe that's the problem... I'll try creating another group.

We use groups at my work for everything.. I want to get it working at home..!

- - - Updated - - -

Try3 said:

You have Windows Home. You do not, therefore, have a Group policy editor [and cannot add one that works so ignore any suggestions to that effect].

I have windows pro, apologies for not listing this.


- - - Updated - - -

This link you posted...

Try3 said:

Change Permissions - TenForumsTutorials

Thanks for the tutorial link. We use permissions extensively at work. I noticed your comment on that link, where for some folders, it constantly asks for admin permission, while on others it doesn't. That is essentially the same problem I have!

Thanks, yes I could do that, but I also share them with my wife. I've also got tons of other stuff (hobby web server, backups, etc). I like having it all on its own drive.

1. Own drive/other drive it doesn't matter

2. Rt click library, Give Access to, Specific People.

=============================================
Far better surely - get the kids a separate PC. 2nd hand if cost is an issue.

Keep a current disk image of all partitions.
Then when it's messed up, simple restoration job.

=> No risk to your PC
=> Easy control
=> No competition for use

I'm glad the matter has been resolved.
I suspect that you could have used an Admins group but, not having Pro, I can only speculate.

I have still not solved my tutorial comment about the need for repeated permission to proceed for some folders but not others.
- If, as Admin, I give my user account permission to modify something in a folder within, say, C:\Program files [or my own C:\Tools folder] then that permission lasts for that visit only. I have to give myself permission again the next time I want to modify anything.
- If, as Admin, I give my user account permission to modify something in a folder within, say, C:\Users\Fred then that permission lasts forever. I do not have to repeat giving myself permission the next time I want to modify anything.
I do not know how to control the difference.
It does not depend on Ownership. I tested that notion and it made no difference.

Just as I wrote that, it occurred to me that I have never tested the combination of restricted Permissions-Ownership for folders on the C:\ drive. All my tests have been on other drives. Perhaps there is an undocumented property that only affects folders on the C:\ drive [just as the prohibition on creating files in the C:\ drive root folder is undocumented]. That would certainly fit the observed symptoms.
Nope, it's not that.


All the best,
And thanks for the rep,
Denis

xanderax said:

Yes I could just have easily called the group Admins

You already have a default group called Administrators, I'd expect. I can't see Pro differing in that regard.
But If you wanted to achieve your objective without giving your wife Admin permissions then I think you have done the right thing by creating a specific group.

xanderax said:

Maybe that is the answer to your question - if a folder *only has permissions for an admin* to access, then it asks for admin confirmation every time you want to use it. But if you give it an additional group or person permission, maybe that will solve your issue. And maybe thats why access to other user folders "sticks", as those folders have permission for other users...

No, it's not that. I have tested various theories but nothing fits the observed behaviour. Brink experimented as well without success.

All the best,
Denis