Can any user access the %APPDATA% folder

Question

Can any user access the %APPDATA% folder? Or can only administrators read & access that directory? Also, do the permissions to access this directory differ over different Windows platforms from 2k to Windows 7?

Question has nothing to do with C++ or WINAPI. Retagged. – Mahmoud Al-Qudsi Oct 01 '11 at 01:43 — Mahmoud Al-Qudsi, Oct 01 '11 at 01:43

score 12 · Answer 1 · answered Oct 01 '11 at 02:42

You can see the permissions on %APPDATA% by using the icacls tool at the command prompt. Here's what it looks like on my machine:

C:\Users\davidp>icacls %APPDATA%
C:\Users\davidp\AppData\Roaming NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
                                BUILTIN\Administrators:(I)(OI)(CI)(F)
                                MACHINE09\davidp:(I)(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files

What this means is that only I, administrators, and the system itself can see the folder. If you run this on a folder where other users can see it, you'll see something like this:

C:\Users\davidp>icacls c:\
c:\ BUILTIN\Administrators:(F)
    BUILTIN\Administrators:(OI)(CI)(IO)(F)
    NT AUTHORITY\SYSTEM:(F)
    NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
    BUILTIN\Users:(OI)(CI)(RX)
    NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(M)
    NT AUTHORITY\Authenticated Users:(AD)
    Mandatory Label\High Mandatory Level:(OI)(NP)(IO)(NW)

Successfully processed 1 files; Failed processing 0 files

You can see that the BUILTIN\Users group can see the c:\ folder (as you would expect).

EDIT

I'm not sure how far back the %APPDATA% variable itself goes back in Windows history. I recommend checking directly. On older systems the cacls command was the predecessor to icacls. Regardless, in Windows NT-based OSes there has always been a profile area visible only to the user and administrators.

The `%APPDATA%` variable goes back as far as Windows Vista, before that, user information was stored in Documents and Settings — , Nov 06 '12 at 00:42
As jmohr mentions `%APPDATA%` exists on Win XP, too, where it'll be something like `C:\Documents and Settings\martineau\Application Data`. — martineau, Jan 27 '13 at 12:19

score 9 · Accepted Answer · edited Oct 01 '11 at 01:53

9

%AppData% is a user-specific path. Yes, any user can access %appdata%, but it will go to a different directory for each user. Only an administrator can read the appdata of another user.

Do the effort of actually going to %appdata% on your machine, and looking at the path it gets converted into. Do you see what I mean?

edited Oct 01 '11 at 01:53

Ana Betts

73,868
16
141
209

answered Oct 01 '11 at 01:42

Mahmoud Al-Qudsi

28,357
12
85
125

Can any user access the %APPDATA% folder

2 Answers2

Linked