Solved

Protecting FAT partition

Posted on 1998-11-04
18
269 Views
Last Modified: 2013-12-14
I have a FAT-partition with a boot-programm. This boot-programm then boots Windows NT 4.0 from a NTFS-partition. What I want is that users of Windows NT can NOT change anything in the FAT-partition. How can I do this?

Note: We need that FAT-partition to boot many other OS on that system.
0
Comment
Question by:xilef
  • 7
  • 5
  • 3
  • +3
18 Comments
 
LVL 1

Expert Comment

by:jminck
ID: 1771512
You can't set permissions on a FAT partition. What you might be able to do is go into disk administrator and remove the drive letter for the FAT partition so that users simply don't see the drive. Of course, a knowledgable user will be able to defeat that, but it will probably work fine for 99% of users.
0
 
LVL 7

Expert Comment

by:dankh
ID: 1771513
Xil,

   You will need a third party utility to do this.

http://www.winfiles.com/apps/nt/access-control.html

Also, you could install TweakUI on NT and instruct it not to show that FAT drive in Explorer.
0
 

Author Comment

by:xilef
ID: 1771514
jminck: I do not need permissions for specific files on that partition. As soon as no one can write to the partition I'm happy. I guess this must be possible.

0
 

Author Comment

by:xilef
ID: 1771515
dankh: The URL you gave lists a lot of security programs. Must of them seem to be able to protect floppies or CD-ROMs, but I didn't find anyone which lets ne protect any harddisk partitions.

What's the other one, TweakUI, and where can I get it?

0
 
LVL 7

Expert Comment

by:dankh
ID: 1771516
Xilef,

    I think TweakUI will solve your problem.  It is a free utility provided by Microsoft.  Go to their website (www.microsoft.com) and do a search for Powertoys.  Find tweakUI, download and install it.  There will be an option in the program to hide certain harddisks and partitions.
0
 
LVL 51

Expert Comment

by:ahoffmann
ID: 1771517
dank, and how do you prevent other OSs to write to the FAT partition?
0
 

Author Comment

by:xilef
ID: 1771518
ahoffmann: In other OS I just don't mount the partition (no entry in /etc/fstab). The problem only appears with Windows, as it automatically mounts all partitions with a known filesystem.

I'll try TweakUI later today.

0
 
LVL 51

Expert Comment

by:ahoffmann
ID: 1771519
> no entry in /etc/fstab
and no samba, and no entry in exports, and nobody has root's passwd ;-))
0
 

Author Comment

by:xilef
ID: 1771520
I just tried TweakUI and there seem to be two problems:

1. If I hide the C-Partition, it does not show up in "My Computer" or find or NT-explorer. But if I open a DOS-shell, I can still access that partition.

2. I tried to hide the C-partition as Administrator. When I then logged in as guest, the C-drive was visible again. As we're expecting to have around 1000 users on our system, this does not seem to be a good option.

I'm a bit surprised. Every system can protect partitions, so how can I do it in NT?

0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 51

Expert Comment

by:ahoffmann
ID: 1771521
In the permissions dialog you must remove the Everyone user from C: and all its share below, then add an apropriate group instead.
Keep in mind that you need apropriate permission in %SystemRoot% to run programs.

You have no  "chgrp -R" on NT, but a "userfriendly" GUI with mouse-support, you understand ;-))
0
 

Author Comment

by:xilef
ID: 1771522
ahoffmann: I tried "rightlick on C: -> share -> permissions" and removed Everyone. Then I logged in as guest and I could still access C: (read and write). I guess "share" is only for the network?

0
 
LVL 51

Expert Comment

by:ahoffmann
ID: 1771523
Ok, was a bit fuzzy: with C: I meant the folder.
But it could be a share too.
If you have changed the NTFS permissions you need not to change the share permissions for the same folder, means leaving the share permission as FullControl for Everyone is ok.
But you have to take care for shares in subfolders. Best is to change the NTFS permissions and let the share permissions as is.

I recommend to add administrator FullControl permissions as long as you're testing; you know why? I'm shure ;-)
0
 

Author Comment

by:xilef
ID: 1771524
I probably didn't state it clear enough in my question: C: is a FAT FS. SO I guess I can't use NTFS permissions. But protecting the whole partition (instead of files or folders) is enough.


0
 
LVL 51

Expert Comment

by:ahoffmann
ID: 1771525
Oops, missed the essential, should have read the title.
You need 3'rd party tools.
Sorry for wasting your time.
0
 
LVL 5

Expert Comment

by:tcalesa
ID: 1771526
Here are some utilities I've found that may help with your situation. The first seems like a pretty close match for what you want.

http://www.cnet.com/Resources/Topdownloads/PC/Result/TitleDetail/0,160,2045-34571,00.html

http://www.cnet.com/Resources/Topdownloads/PC/Result/TitleDetail/0,160,2045-19985,00.html

http://www.cnet.com/Resources/Topdownloads/PC/Result/TitleDetail/0,160,2045-36975,00.html

To search for more (there were several pages).
http://www.cnet.com/Resources/Topdownloads/PC/CategoryDoor/0,157,2045,00.html

Then do a quick search using the keyword security.

I haven't tried any of these utilities so I can't recommend one over the other.

Good luck
0
 
LVL 3

Expert Comment

by:arunm
ID: 1771527
You may have already thought of this very simple solution,  but have you considered converting you fat partition from FAT16 to FAT32? As NT can not see FAT32 so you FAT partition would be protected.
0
 
LVL 7

Accepted Solution

by:
dankh earned 300 total points
ID: 1771528
Xil,

   Take a look at this utility:

http://www.protect-me.com/dl/
0
 

Author Comment

by:xilef
ID: 1771529
dankh: Yes, DeviceLock looks exactly right. Thanks.

arunm: This would probably help, but as I've been informed future versions of NT will recignize FAT32, so it would only be a temporary fix (and I don't even know if the boot programm could use a FAT32 partition).

tcalesa: I didn't want to encrypt anything. Just protect it from ordinary users.

Thanks everyone for the help.

0

Featured Post

Don't lose your head updating email signatures!

Do your end users still have the wrong email signature? Do email signature updates bore you or fill you with a sense of dread? You can make this a whole lot easier on yourself by trusting an Exclaimer email signature management solution. Over 50 million users do...so should you!

Join & Write a Comment

Our Group Policy work started with Small Business Server in 2000. Microsoft gave us an excellent OU and GPO model in subsequent SBS editions that utilized WMI filters, OU linking, and VBS scripts. These are some of experiences plus our spending a lo…
Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now