ATLOCK v4 Uses Windows NTFS ACLs to Block File Access at Kernel Level
ATLOCK's File Guard feature locks files by directly modifying NTFS Access Control Lists (ACLs), the permission layer enforced by the Windows OS kernel itself. Unlike typical file-locking tools that merely hide files or apply password overlays, ATLOCK strips access rights for all Security Identifiers — including administrators — making the file unreachable system-wide. The tool uses Win32 security APIs such as SetNamedSecurityInfo and GetNamedSecurityInfo to read, modify, and later restore a file's original security descriptor. Key engineering challenges included handling privilege escalation, preventing permanent permission corruption during the save-restore cycle, and accounting for already-open file handles. Access is only reinstated when ATLOCK explicitly rewrites the original ACL, at which point the file becomes fully usable again.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in