Not every file on a shared computer or network should be open to everyone. Payroll spreadsheets, HR records, client contracts, and financial reports all deserve a little more protection than a folder anyone can click into.
Windows has several built-in ways to restrict who can open, change, or delete a folder. Some are true security controls, and some just keep things out of sight. Here’s how folder restrictions in Windows work, how to set them up in Windows 11, and how businesses should handle file access across a whole team.
Hiding a Folder Is Not Protecting It
One quick myth to clear up first. You can right-click a folder, choose Properties, and check Hidden. The folder disappears from view, but anyone who turns on Show hidden items in File Explorer can see and open it. Hiding is handy for reducing clutter, not for keeping information private. For real protection, use permissions or encryption.
How to Restrict Folder Access in Windows 11
Set folder permissions
Permissions control exactly who can see, open, change, or delete a folder and everything inside it. They work on any drive formatted with NTFS, which includes the main drive on nearly every Windows computer.
- In File Explorer, right-click the folder and select Properties.
- Open the Security tab and select Edit.
- Select a user or group, then check Allow or Deny for permissions like Read, Write, Modify, or Full control.
- To give someone access, select Add, type their user name, and choose their permissions. To remove access, select the user and choose Remove.
- Select Apply, then OK.
A few tips: changes apply to everything inside the folder by default, so set permissions on the highest folder that makes sense. And be careful with Deny, since it overrides other permissions and can lock out people you didn’t mean to, including yourself.
Share a folder with specific people on your network
If a folder is shared over your office network, its Sharing permissions also matter. Right-click the folder, select Properties > Sharing > Advanced Sharing, then select Permissions to control who can reach it from other computers. Windows uses the stricter of the sharing and security permissions, so it’s best to keep sharing permissions simple and manage details on the Security tab.
Encrypt sensitive folders
Encryption protects files even if someone gets physical access to the computer or removes its drive.
- BitLocker (Windows 11 Pro and higher) or Device encryption (on many Windows 11 Home devices) encrypts the entire drive. Every business laptop should have one of these turned on.
- Encrypting File System (EFS), available in Windows 11 Pro and higher, encrypts individual folders. Right-click the folder, select Properties > Advanced, and check Encrypt contents to secure data. Back up the encryption key when prompted, or you could lose access to your own files.
Protect important folders from ransomware
Windows Security includes a feature called Controlled folder access that blocks untrusted apps from changing files in protected folders, like Documents and Pictures. It’s a different kind of folder restriction, aimed at stopping ransomware from encrypting your files.
To turn it on, open Windows Security > Virus & threat protection > Manage ransomware protection, and turn on Controlled folder access. If it blocks an app you trust, Microsoft explains how to allow an app through Controlled folder access.
Folder Restrictions for Businesses
Setting permissions on one computer is straightforward. Managing who can access what across a whole company takes a plan.
- Give people only the access they need. This is called least privilege. Sales doesn’t need payroll files, and a summer intern doesn’t need the client database.
- Use groups, not individuals. Create groups like “Accounting” or “Management” and assign folder permissions to the group. When someone joins or leaves a team, you change their group membership instead of editing dozens of folders.
- Move shared files to the cloud. OneDrive and SharePoint make it easy to control who can view or edit each folder, share files securely with people outside the company, and see who has access. They also keep version history and work from anywhere.
- Don’t use shared logins. Everyone should have their own account so access can be tracked and removed when someone leaves.
- Review access regularly, at least once a year and whenever someone changes roles or leaves. Permissions tend to pile up over time.
- Remove access immediately when employees leave. It’s one of the most common gaps in small businesses.
- Back up everything, because permissions protect against the wrong people, not against deleted or encrypted files. See our guide to backup and disaster recovery.
If your business handles regulated data, like health records, financial information, or defense contract data, access controls aren’t optional. They’re a core requirement of most compliance frameworks.
For more on protecting work devices, see our guide to risks of unrestricted internet access at work and our post on how to personalize Windows 11.
LG Networks Can Help You Control Who Sees What
File permissions are easy to set up once and hard to keep right over time. People change roles, new folders appear, and before long, sensitive files are open to far more people than they should be.
LG Networks provides managed IT services in Dallas, TX, and across DFW, including Microsoft 365, OneDrive, and SharePoint setup, cybersecurity services, compliance services, backup and disaster recovery, and a 24/7 helpdesk your team can call with any access question. We help businesses organize their files, set the right permissions, and keep them that way.
Do you know who can open your company’s most sensitive files right now?
Take the first step. We’ve got you covered.
Want help locking down access to your business files? Contact Us Today.
