Restrict reading/editing of certain file types in Windows XP?

[Antoneo]

I'm trying to figure out a way to restrict the opening of certain files for all users except the ones in the Administrator group in Windows XP. Is this possible using the group policy editor or registry? I don't know of any other tools (except maybe third party programs)... Also, is the login profile useful for anything?

 

[singh]

Just assign the appropriate security permissions.

 

[bsobel]

I read this as he wants to do it by file type (.doc, .xls, etc). No native support (other, than as you said, setting permissions on each file).

 

[VirtualLarry]

No way to set up a per-user HKEY_CLASSES_ROOT? Possibly by cloning the system one, storing the modified one in the user's profile like NTUSER.DAT, and pointing another system registry key at it? I've never tried that, just a hypothetical off of the top of my head, knowing that HKCL is a seperate hive under NT OSes now. Strange that you couldn't do this via per-user GPOs though.

I suppose an in-depth and evil way would be to implement a filesystem filter driver, that would check a security-permissions database for that user and filetype, but that would be a lot of bother. (Could be a new idea for a Symantec security product though.. )

 

[Antoneo]

Stinks... Yep, I did mean exluding the opening of certain filetypes so bsobel was correct. I guess MS saw no need to implement that in the group policy editor .