1

Windows 10 Home's default account lock system for the admin account is not completely secure because there are multiple free password recovery tools & ways available that can be used by a non-admin to reset/bypass the admin password.

How to secure Windows 10 Home admin's data & installed programs behind a password, even when programs like Office, Chrome, etc. are opened and running in the background with some documents/pages opened in it?

Securing data with multiple solution/software is acceptable
& if all the non-windows hard drive partitions can't be secured, it's also acceptable.

Edit: Securing data when anyone can have physical access to the locked device(running but password protected).
Edit 2: & when the system is used by only one user, through the admin account.

4
  • What does it matter if apps are running? Commented Feb 3, 2020 at 22:32
  • Is this a shared system where you want to protect the admin account and related files from a number of standard users? Are there additional admin users on the system? Commented Apr 17, 2020 at 19:16
  • @user2320464 for a system that is used by only one user, as the admin account.
    – proseosoc
    Commented Apr 18, 2020 at 8:58
  • Thanks for the details. There's an exhaustive thread about this here: security.stackexchange.com/questions/187515/… Commented Apr 18, 2020 at 14:49

1 Answer 1

2

Nothing can be used by a non-admin to reset the admin password without rebooting the system and modifying the disk offline. Doing so requires physical access to the machine (which I'm guessing you must allow) and is usually mitigated with full-volume encryption (FVE). The standard Windows FVE feature, Bitlocker, is not available on Home editions; you can pay MS for a license upgrade if you want to enable it. Alternatively, you can use third-party system encryption tools, such as Veracrypt. Since your machine probably doesn't have a Trusted Platform Module (hardware security chip, not common on home systems), the FVE would need to use a password (or key on a flashdrive), and anybody with the password/key will be able to unlock the disk (and potentially tamper with it, such as resetting passwords or stealing data directly). Note that a really sophisticated attacker might still be able to get past this even if you have a TPM, but I'm guessing that's a level of security you don't need.

If you just want to restrict access to the admin's data, you could also create an encrypted volume (Veracrypt supports this; other software might too) that only you can unlock (requires a password, and the password can't be reset without making the data permanently unrecoverable). You'd need to ensure it's locked whenever it's not in use, though. A better option might be to just store everything sensitive on a flashdrive or other external storage, and take it with you when you go.

Alternatively, Windows has an option for easy-to-use data encryption (Encrypting File System, or EFS), but I think it's not available on Home editions either. Home is really not intended for use in an environment sensitive data that needs protection from hostile local users.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .