How ATLOCK v4 actually Locks Files at the OS level (A technical breakdown)

Short summary

ATLOCK v4's File Guard feature manipulates NTFS Access Control Lists directly to lock files at the OS kernel level, unlike typical file lockers that only hide files or add password dialogs. The approach strips all SIDs including administrators, requiring careful save/restore of original security descriptors. The post covers the Win32 API calls involved and challenges like permission escalation, inheritance leaks, and avoiding constant admin requirements.

• •File Guard edits NTFS ACLs to deny all access including administrators, enforced by the OS kernel
• •Save/restore cycle must be bit-for-bit reversible to avoid permanently corrupting permissions
• •Implementation uses Win32 security API (SetNamedSecurityInfo/GetNamedSecurityInfo) with no high-level library

Generated with AI, which can make mistakes.