Can I assume that the Windows profile directory is not writable by other users?

Question

Can I assume that the Windows profile directory is not writable by any user other than the user my program is running under and the system administrator (who can access anything)?

More specifically:

The SlipRock library creates a directory ~/.sliprock. This directory contains temporary files, which in turn contain (among other things) a secret access key. Therefore, if other users are able to read these files, the result is a security vulnerability.

The directory is created with strict permissions that deny access to untrusted code, but these are moot if another user could rename the directory. Can I be confident that a user’s home directory (as returned by GetUserProfileDirectory) is a secure directory?

Answer 1

Yes, %UserProfile% is a secure directory in such a way, that it's protected from being read or altered by other users in the default configuration.

It is not a secure directory, in such a way that any system administrator including backup operators, holder of various privileges (SeTakeOwnershipPrivilege, SeTcbPrivilege, ...), anyone who can access the files offline, etc. can read, and in most cases, alter the files.

Answer 2

Can you be confident? Only if you know the permission scheme in that install of Windows!

By default, non-admin users don't have rights to other users' profile directories. However, many unskilled administrators make all users administrators in order to simplify software and driver installation. Also, you'd want to check that some rogue administrator hasn't given permission to your home directory to other users and that other users don't have rights to elevate processes. (They could use that to elevate Powershell or CMD, for instance, and then browse your home directory).