Windows UAC Protected folders

Question

By default, C:\Program Files, C:\Windows are UAC protected. How to make additional folders to be UAC protected?

Solution

Change the folder permissions.

1. right click on the folder
2. select Properties
3. in the Security tab
4. click Advanced
5. under Owner tab click Edit
6. Select Admin

To keep non-Admin users from accessing the folder:

1. Go to the same Security tab
2. Click Edit
3. Deny Full Control by checking the deny box

Comments

[Harry Johnston]

What exactly do you mean by "UAC protected"? What is the behaviour you're trying to replicate?

[linquize]

When you need to make changes inside that folder, such as overwriting a file, creating a folder, deleting a file, etc..., UAC prompt will show up and the user confirm the action

[Harry Johnston]

This will happen for any folder that doesn't grant write permissions to the user in question or to all users. Remove write access for groups like "Users", "Everyone", or "INTERACTIVE". Secure folders typically only grant write permission to the Administrators group, CREATOR OWNER, and SYSTEM.

[Harry Johnston]

Deny Full Control will deny all access, including read access, and typically will block administrators as well as non-administrators; e.g., if you Deny Full Control to Users, you'll block out everyone, because Users includes Authenticated Users and deny entries take precedence.

[WikiWitz]

@HarryJohnston: Deny Full Control only applies to the user in question. Actually I suggested blocking non-Admin users. He can select them at his own discretion.

[Harry Johnston]

What, you mean give each user you don't want to have access an individual deny entry? That would work, I suppose, on non-domain-joined machines, provided you remembered to update the permissions every time you added a new user. But blacklists aren't good practice except in special cases. Instead, you should grant access only to the specific users you want to have it, which in this case would be the Administrators group.

[Harry Johnston]

Also, deny entries won't work at all in this case, because the user wants to be able to gain access via the UAC approval dialog. Since the elevated token contains all the security primitives contained in the non-elevated token, any deny entry that applies to the non-elevated user will also apply to the elevated user.

[WikiWitz]

At least not as you say, "..typically will block administrators..." We would appreciate it if you will offer a workaround in Windows 7 to do this "Only allow Admins" settings.

[WikiWitz]

I tried this in my machine before posting the answer. The Admin will have no problems accessing the file.

[WikiWitz]

let us continue this discussion in chat