使用 C# 阻止访问目录
我正在尝试创建一个类似于文件夹锁定的程序，它可以阻止用户访问特定文件夹。我尝试使用 DirectorySecurity 类和 AccessRules 更改文件夹的访问控制。
但是，通过转到“安全选项卡”并更改权限，可以轻松更改我分配的设置。
有没有安全的方法来阻止访问目录？
I am trying to create a program similar to Folder Lock which prevents users from accessing a particular folder. I tried using DirectorySecurity class and AccessRules to change the AccessControl for folders.
However, the settings which i assign can easily be changed by going to "Security Tab" and changing the permissions.
Is there any secure way of preventing access to directories ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
我认为 我对此问题的回答：“如何阻止使用 Windows 服务创建文件夹？" 可能是您需要执行的操作才能实现您想要的效果：
I think my answer to this question: "How could I prevent a folder from being created using a windows service?" is probably what you'd need to do to achieve what you want:
只要用户是目录或文件的所有者，他就可以更改权限。您必须更改目录的所有权才能真正保护目录的安全（并且进行所有权更改需要管理权限）。
但具有管理员权限的用户始终可以收回所有权。
如果您在企业中并且人们不是其计算机的管理员，您可以编写一个以域管理员身份运行的 Windows 服务并进行所需的更改。在家庭环境中，没有办法。
As long as a user is the owner of directories or files, he can change the permissions. You'd have to change the ownership of the directories in order to really secure the directories (and making this change of ownership requires administrative rights).
But a user with administrator right can always take the ownership back.
If you are in an enterprise and people are not admins of their machines, you could write a Windows service that runs as domain admin and makes the needed changes. In a home environment, there's no way.
有两件事可以推翻本地管理员的权利。
但第二个选项无法使用 c# 来完成，第一个选项更多的是 Active Directory 配置解决方案。
There are 2 things which can overrule the rights of a local administrator.
But the second option you can't do with c#, and the first option is more a Active Directory configuration solution.
不，您无法阻止计算机管理员帐户访问任何文件夹或取得任何文件夹的所有权。
您可以阻止受限帐户（如您所描述的），但管理员始终能够更改安全设置。
No, you can't prevent the computers administrator account from accessing or taking ownership of any folder.
You can prevent restricted accounts (as you have described), but the administrator will always be able to change the security settings.