Password protect a folder

[bertster]

HT wants a password protected folder on the network (Server 2003) that only certain users can access:

 

1. Folder must be password protected, and prompt user for credentials each time its used.

 

2. Only specific users can access

 

I've sorted #2 using groups and permissions - easy, but struggling with #1. Anyone know of a way to do it? Even with 3rd party software? Maybe an external encrypted HDD?

 

Thanks

[elsiegee40]

Why does it have to be password protected as well as using permissions? If you have a problem with people using staff logons that don't belong to them that needs to be sorted out first.

[bladedanny]

We have a similar setup here for management. When staff log on they all get a mapped drive to the management share but only users listed in the security tab can access it. So far it is working well.

[elsiegee40]

We only map the 'Office Admin' share to relevant staff... all 5 of them. The top secret Bursar and HT folders that they use for staff issues, etc have additional security on them so the rest of the office staff cannot access them.

[bertster]

Why does it have to be password protected as well as using permissions? If you have a problem with people using staff logons that don't belong to them that needs to be sorted out first.

 

Nope its not a problem with staff using logons that dont belong to them, thats already strictly forbidden. More a case of a new HT whos hot on safeguarding. Wants all childrens photos protected by this 2nd level of password. Doesnt want anyone to be able to jump onto a logged in machine (if the teacher has left it logged in) and just take a look into the 'photo' folder! We have already been through the options that each user already has their own password and could 'lock' the workstations when leaving them, but thats open to someone forgetting to do it...

[bertster]

Good point. What's the head trying to achieve, apart from an extra layer of delay?

 

If a file is on the network, the network/file security will take care of the access permissions.

 

Your correct it that, but if a user has logged on and left the workstation unattended then the folder can be accessed by anyone, and that is what the HT wants to prevent. Yes, they can lock the workstation, but it doesnt happen in practice.

[elsiegee40]

I have to say that this is a sledgehammer to crack a wallnut - and I'm an e-safety trainer btw.

 

If staff practice is lax and they are not locking their machines when they walk away from them, then that must be corrected.

 

Our AUP, which all staff have signed and all have been trained (it's part of new staff induction), makes it very clear that failure to ensure the security of your login is a disciplinary offence. I won't say our staff are perfect, because they aren't. But after a recent login sharing issue I happened upon at the start of this term that SLT took very seriously, things have improved hugely (and one person has ignored me for the last fortnight )

[powdarrmonkey]

Doesnt want anyone to be able to jump onto a logged in machine (if the teacher has left it logged in) and just take a look into the 'photo' folder! We have already been through the options that each user already has their own password and could 'lock' the workstations when leaving them, but thats open to someone forgetting to do it...

 

Your scheme is no better; someone forgetting to close the folder (example: jumps up to investigate sudden screaming in the next room) poses exactly the same problem.

 

Secondary authentication just inconveniences and annoys legitimate users, it does almost nothing to fix the authentication problems society already has.

[bertster]

As much as I agree with your comments, they are all already been raised in discussions with the HT and they still want it implemented. So much so that I've been allocated an extra day just to work on a solution. Its definately not a staff problem as there are strict policies in place re computer use, unattended workstations etc. Apparentley HT's previous school had this in place and he wants it here as well. My task is to implement the solution he wants, even if it still has the flaws as you all mention (HT is aware). I'm looking for technical solutions please.

[Dom_]

I've done this before, for concealing sensitive information from someone with domain admin rights...

 

Install truecrypt on any machines you want to have access to the folder, create a truecrypt container, with whatever password they choose... move the container on to a shared area, and rename it to something not very obvious (I created a 2gb container and called it "School Prospectus DVD.avi"). Show the members of staff how to mount the container within truecrypt and remind them to disconnect once they've finished!

 

You may have issues with multiple users connecting at one time, but that situation never arose for us before.

[HodgeHi]

What about using a web-based access to the folders with a password protected realm and session time outs. Would resolve most potential issues with being left unattended.

[penfold]

In addition to whatever solution you decide upon, are you going to limit the timeout so anyone who has access to this information also has a very low timeout before their screen locks in the case they are away from their desk?

[webman]

If a password prompt is what he wants, give him it. It doesn't have to be difficult.

 

Make a small program in AutoIt which prompts for a password. When compiling to an executable, give it an icon that is the one used in Windows Explorer to represent a folder. Then make your actual secure folder "hidden" so it's not visible. Users should see the "folder" (the prompt program), click on it, and up comes the prompt for a password. When someone enters the correct password, just launch Explorer and point it to the path of the secure hidden folder.

 

You could make it go full-screen, black, green text, and a nice Hollywood-style message: "Classified. Please enter authentication credentials."

[elsiegee40]

If a password prompt is what he wants, give him it. It doesn't have to be difficult.

 

Make a small program in AutoIt which prompts for a password. When compiling to an executable, give it an icon that is the one used in Windows Explorer to represent a folder. Then make your actual secure folder "hidden" so it's not visible. Users should see the "folder" (the prompt program), click on it, and up comes the prompt for a password. When someone enters the correct password, just launch Explorer and point it to the path of the secure hidden folder.

 

You could make it go full-screen, black, green text, and a nice Hollywood-style message: "Classified. Please enter authentication credentials."

 

I like this solution

[Arthur]

SecureFolder might be worth a try too, although I really like WebMan's idea.

 

Secure Folder is an easy-to-use folder security software that hide, lock & encrypts folder with a password. Folders secured cannot be deleted, renamed, moved, copied, modified, accessed.

[clareq]

Can't you just put the files in a password protected zip file? You can still browse the files within the zip, though you can't see thumbnails.

[SimpleSi]

Apparentley HT's previous school had this in place and he wants it here as well. My task is to implement the solution he wants, even if it still has the flaws as you all mention (HT is aware). I'm looking for technical solutions please.

 

Maybe get in touch with techies at previous place to see how they did it?

 

regards

Simon

[mattx]

If a password prompt is what he wants, give him it. It doesn't have to be difficult.

 

Make a small program in AutoIt which prompts for a password. When compiling to an executable, give it an icon that is the one used in Windows Explorer to represent a folder. Then make your actual secure folder "hidden" so it's not visible. Users should see the "folder" (the prompt program), click on it, and up comes the prompt for a password. When someone enters the correct password, just launch Explorer and point it to the path of the secure hidden folder.

 

You could make it go full-screen, black, green text, and a nice Hollywood-style message: "Classified. Please enter authentication credentials."

 

As Webman said - AutoIT. Did this years ago - yes the password is in the script [ but when compiled it will be hard to get ] - but for a quick and dirty approach it may help you:

 

; AutoIt Version:      3
; Language:            English
; Platform:            WinXP
; Author:              Matt 
; Script Function:     Script that Launches Fun With Texts Teacher Console

$sPass = 'PASSWORD GOES HERE'
Do
  $sInput = InputBox( "Password Prog By Matt ", "Insert password to Launch Fun With Texts Teacher Console" & @LF & "The password is CaSe SeNSiTIve.", "", ".")
  If @error Then Exit
  If $sPass == $sInput Then ExitLoop
  MsgBox(4096 + 16, 'Error!', 'Password didn''t match.' & @LF & 'Try again.')
Until 0

;What ever you want to happen next [ map to a share or drive etc ]

Edited September 27, 2010 by mattx

[SimpleSi]

@wwebman/mattx

nice idea - great for working from files from the desktop but it wouldn't be able to save into the folder from a prog without mapping a drive letter to it and then your back to square one

 

But you could add another shortcut to remove the mapping but that isn't what the head wants

 

(I actually don't believe that the thing the head thinks he had is what he says he wants now )

 

regards

 

Simon

[webman]

SimpleSi: My idea is just a placebo - give the illusion that it's secure; but essentially just opening a folder (which already has appropriate file permissions applied). So it will act like a regular folder - open, save, modify, delete, drag-and-drop as normal

 

Mattx's little script is a great solution - just launch "explorer.exe \\server\uncpath\goes\here" at the end.

[SimpleSi]

So it will act like a regular folder - open, save, modify, delete, drag-and-drop as norma

But is doesn't act as a regualr folder

Its a prog that opens up an explorer window - you can't be working in an app and find the folder on the desktop - its an executable not a folder.

 

And even if you run it from the desktop - its not available as a folder.

Simon

 

Unless you map it as a drive letter and then its available for the whole session which is prety much like any folders available to the logged on user .

[webman]

Yes - you'd need to instruct users to browse to it first, or by giving them a nice shortcut. You can't save directly to it from applications due to "security reasons"

[SimpleSi]

You can't save directly to it from applications due to "security reasons"

 

Like your thinking

 

Si

[mattx]

@wwebman/mattx

nice idea - great for working from files from the desktop but it wouldn't be able to save into the folder from a prog without mapping a drive letter to it and then your back to square one

 

But you could add another shortcut to remove the mapping but that isn't what the head wants

 

(I actually don't believe that the thing the head thinks he had is what he says he wants now )

 

regards

 

Simon

 

What Webman said or code in [ very straight forward ] - a drive mapping when the password is checked, and then a time limit on how long that drive mapping will be in place. After 5 mins the mapped drive can then be disconnected automatically.

[SimpleSi]

After 5 mins the mapped drive can then be disconnected automatically.

But how do I do that dear liza,dear liza but how do I do that ...

 

Si