How to have unchangeable ownership of WinXP folder?

[Nolonemo]

I have the administrator account on a WinXP Pro computer. I also have a private account on the computer, that also has administrator privilges. Another private account also has administrative privileges. (Unlike Win2k,AFAIK Win XP only has two kinds of accounts.)

I have created a folder on the machine that has its security settings set only to allow access to me. However, the folder is not really secure, because although other accounts cannot access the folder, they could access the properties of the folder, and even though they cannot initially change the permissions for the folder, they could access the ownership properties page for the folder, which shows that "Administrators"as well as I can take ownership of the folder. Then, by changing ownership of the folder from my account to "Administrators" , theycan then change the privileges to give "Administrators" full control. And, because their account is part of the "Administrators"group, they end up with access to the folder.

The obvious way to avoid this would be for me to delete "Administrators"as a possible owner of the group,but there doesn't seem to be a way to do this. I can't believe that such a big security hole can exist in XP. I can understand how you might want to have a back door so that the actual Administrator of the machine to unlock any folder, but any account with administrative privileges?

Anyone know if there is any way to prevent change of ownership of my folder and make it secure? BTW, both myself and the other account must have administrative privileges, for reasons I won't go into here. However, I repeat, that only I have access to the "Administrator"account.

[Nolonemo]

OK I dug some more into security settings, but still can't lock the folder down tight.

I tried logging on as Administrator, goiing into Control Panel -> Administrative Tools -> Local Security Settings -> User Rights Assignments, and I changed the value for Take Ownership of Files or Other Objects from "Administrators" to "Administrator". Now, (after a reboot) the other person cannot, from their account, change the ownership of my private folder to "Administrators" and then proceed to unlock it.

BUT, the folder is still not secure, because, the other person can go into User Rights Assignment and change the permission for Take Ownership of FIles or Other Objects back to "Administrators" from "Administrator"!

I tried to defeat that attack by deleting "Administrators" as a user group. But the other user can still add their own account to the permissions for"Take Ownership of Files or Other Objects" (because, it appears, any user with administrative privilveges can alter the security settings). So my folder is still not secure (though the person who wants to get in will have to do some serious digging into Windows administration to open it up)

Am I missing something? Any ideas?

Thanks



Any ideas?