Windows 10: Prevent executable from being deleted/modified (but still read/write)?

I have spent literally days trying to figure this out on my own, and thought I'd finally solicit some advice.

I have a program that I want to prevent *anyone* (including me, as an administrator) from moving, deleting, or otherwise disabling.

The program is called Cold Turkey, and it is the best access restriction program for "internet addiction" that I've found. Despite its relative strength, I am still able to get around it by renaming and moving the file or deleting it in safe mode. I know I should just get some self control, but this is what I'm doing now. I'm fairly tech savvy and can unfortunately get around most means of locking the computer. I am looking to be able to:

• run it without a password and give to a friend to safekeep;
• have access to the interface to change time and other settings (so read/write/modify, right?)
• prevent my ability to delete or otherwise disable the program.

So I then tried a few file "hiding" softwares.

Wise Folder wasn't good enough for me--no safe mode protection, etc., and I don't believe it played nice with executables.

Folder Protect did not recognize my password and I spent a good amount of time figuring out how to delete it. Pretty much the same with File Lock Pro. I tried another one that looked promising, but I found that it was freeware and had no customer support whatsoever, which after my bad experiences with FG and the other. Literally, and absolutely, they forgot my pw, and I'm not going through that again.

All the "lock file" programs generally require a password every time you want to access a program--they're designed to lock down a file rather than just modify permissions. The simpler programs (like Wise) are easy to get around through task manager or safe mode.

It seems to me that the best surefire way is to modify permissions, but I'm a little scared to do so.
I initially thought that was the best way to go and read about permissions, but that was way out of my depth. I was able to change permissions, but when it came to changing ownership to another and disabling MY administrative permissions to prevent me from deleting, etc. I couldn't figure it out (apparently not tech savvy enough for that). Plus I think there are some characteristics of this program that prevent this route (NET dependency? PCAP?), although I am not sure. I ended up basically blue-screening and having to use the Tweaking.com repair tool to fix permissions etc.

So does anyone have advice for this computer addict? A program that will let me run a program and access its interface w/o being able to disable it and/or delete it?

Appreciate it. Understand some might think this is silly, but I really need to get this under control.

Oh, and here is a clip of the basic files in this program:





:)

 

Understanding Read-only folders

Keith,

Thanks for your reply! So I've been experimenting with permissions now instead but still can't get the results I want. If I deny write, that works but only one way. It seems to still let me delete or remove a file from the folder but it won't let me
add a file. If I deny read, well that doesn't work because then I can't even open the folder. I still want to be able to see its contents but just not be able to remove, delete, or add to the folder. I've been trying various checkbox combinations and not
quite getting there. The only options I seem to have are Full Control, Modify, Read&Execute, List folder contents, Read, Write. Honestly it seems like anything other than denying write, will not let me see the folder. But only denying write still allows
you to modify the folder to some extent by either removing files or deleting. I would greatly appreciate any suggestions?

thanks!

 

Why did my C: drive become read only after the Windows 10, version 1709?

Exactly. Here is what the users can do on Program Files folder on C:/

https://i.imgur.com/fHdmbg6.png\

Notice the Users can only read and execute, not write.

This actually has a reason-The folders are write protected to prevent misuse(Example, you accidentally delete some folder from there and as a reason the PC screws up at next boot)

 

You can't completely achieve what you want, I fear. It is always possible to boot your machine from a Linux CD and delete the file. This will bypass any locker imaginable. This can't technically be prevented.

 

Thank you *Sad. Is it possible to modify permissions? This seems like it should be... and is probably the best way. No?

 

You set permission via the usual security tab (right click on the file and select security). You have to keep in mind that these are security enforced by Windows. If you have sufficient privilege, you can always do what your want. In a normal administrator account, Windows might prevent to do some things but it usually does not prevent to change the permissions to do these things. So you have some indirect permissions to do (almost) everything (change the permissions then do the things you want). If you boot in safe mode you disable many check and you have more permissions. But if you have not secured the boot process, you can always boot from a special CD that enforce no permissions at all. This is the case with some Linux CD. Boot them and do what you want with your file (the purpose is most often legitimate, you can recover files from a completely corrupt and unusable system in this way).

 

Thanks. I was told by someone in another forum that you can never remove your access rights as administrator. So you can do this in safe mode? Should I just proceed to change the access rights in safe mode as an administrator, and then replace the administrator with system as owner?

I would just have to find a program or otherwise disable safe mode and then have a boot disk. That sounds good.

The other thing I've read is that it is possible to change 3rd party executables to system files by assigning them to TrustedInstaller. But I take it that this is probably risky?

Thank you!

 

What do you mean "remove your access rights" (you can easily mark a file as non-readable, writable, etc. even by administrator) would you not mean "grant access rights". Frankly I don't know the details but I know there way to launch something in system mode if you are an Administrator. So you can indirectly do it anyway...

I don't understand your real goal. What do you want to achieve? To protect you from yourself? Frankly you can't really do that. Safe mode is used to troubleshot the computer in special situation; it is normal that it is not "protected". Even if it was, it would not "prevent" anyone doing what he wants (as I said, boot from a Linux CD, put the hard disk in another machine, etc...), it would just make more difficult for an honest user to troubleshot problems. If you want to protect your system from an accidental mistake, just run as a normal user with no administrative privilege. Modifying your system in unattended way is not very safe, but it is just my opinion.

 

Yes, my goal is to "protect myself from myself" without screwing up my software. As I noted above, I am basically a computer addict and it is really concerning. None of these lock programs adequately prevent me from disabling it.

Going to the length of removing a hard drive or reassigning permissions (which I am now very confused about: can I reassign ownership to the system or not, preventing administrative delete/modify controls? hearing conflicting things) in safe mode, etc. is not something I am going to undertake to disable the software. I just want something to prevent me from doing the easy things, like deleting the file or moving it, etc.

I understand your admonitions about safety, and I do understand; I feel like if I use Macrium backup and a recovery drive I would be secure enough.

Now I just need to understand how to 1) take away permissions from users and the administrator; and 2) give them to the system. That's the essence of what I'm asking here.

So any ideas would be welcome, and thank you!