Protecting programs on external drives with the same priviledges as in Program Files

Question

I moved some of my programs from Program Files and Program Files (x86) to another folder on my secondary drive to save space. However, any program with user-level permissions is now able to write to the folder and therefore modify/backdoor my programs. That's not possible with Program Files, as Program Files is writable only by administrators.

How do I apply the same level of protection that Program Files has to my folder? Thanks

Answer 1

The drive must be using NTFS. You cannot do this on FAT/exFAT.

On an NTFS volume, all such protections are based on ordinary file ACLs which you can change through icacls.exe, Set-Acl, or the "Security" tab in the folder's "Properties" window.

An easy way to clone the existing ACL is via PowerShell (which produces the same effective ACL but in a slightly different order):

PS> Get-Acl "C:\Program Files" | Set-Acl D:\Games

...or using the backup/restore feature in icacls (produces exact copy):

CMD> cd/d "C:\Program Files"
CMD> icacls . /save C:\theacl.txt
CMD> cd/d D:\Games
CMD> icacls . /restore C:\theacl.txt

Alternatively, you could disable inheritance on the main folder, remove existing access entries and build up the ACL from scratch:

> icacls D:\Games /inheritance:r
> icacls D:\Games /grant SYSTEM:(OI)(CI)F
> icacls D:\Games /grant "NT SERVICE\TrustedInstaller:(OI)(CI)F"
> icacls D:\Games /grant Administrators:(OI)(CI)F
> icacls D:\Games /grant Users:(OI)(CI)RX
> icacls D:\Games\Foo\Screenshots /grant Users:(OI)(CI)M

In icacls 'I' means "inherited", 'OI' means "inheritable by files" (objects), 'CI' means "inheritable by subfolders" (containers), 'IO' means "inherit-only" (applies to children but not to the object itself). It doesn't matter if you use icacls or the "Security" window, they both have the same options.

Don't forget to check whether all subfolders are using inherited permissions – if any subfolder has inheritance disabled, it won't automatically receive the protection you've set up. icacls D:\Games\Foo /reset /t would do the trick.

As the last step, give away the directory's ownership to e.g. Administrators or even TrustedInstaller, as the owner is always allowed to edit permissions (so malware running as you could technically grant itself full access):

> takeown /f "D:\My Programs" /a /r