Win 10 21H2
Assume we have two users:
a) Root (i.e. Admin user)
b) Regular
99% of time the user works through Regular account. However, they need a 3rd account for some sensitive/private data handling that cannot be accessed/seen even when the drive is externally read.
The following architecture is proposed:
- A separate partition (E:) is created.
- E: is encrypted i.e with VeraCrypt
- A new user account is created on Win10, and ALL of its data (i.e. its C/Users/ folder is moved onto the E:. Appropriate registry changes are made to make windows load that user from E:
- To access the account and data, user logs in as Regular, decrypts E:, switches to 'HiddenUser'. After logging off as 'HiddenUser', veracrypt E: drive is dismounted from within Regular user, effectively locking all the data,recent files, thumb cache/local appdata/everything of Hidden User behind encryption.
I am aware that Windows' user profiles cannot be just "cut-pasted to new location + registry edit. Is there a native way to implement this setup in Windows? Roaming profile perhaps?
You've been given a variety of good suggestions in comments.
Some preliminary points
First, there's no such thing as you describe, specifically, in Windows; you have to find some other way to achieve what you want based on your specific needs.
Second, it may be helpful to more precisely define, for yourself, your true needs. If this is an organizational privacy concern, the policies that will govern this solution should be written by appropriate teams in your org, with ITs input regarding feasibility.
Possible solutions
The viable solutions currently available based on our understanding of your request:
A Virtual Machine: This may be more complex to implement, but it is arguable the easiest for an average user to understand and use on an ongoing basis. The VM can exist in a secure server, have its own VM-device encryption on top of the host encryption (if you really wish), and because it is a full, if transient, computer, you have the most flexibility in what sorts of confidential content you need to review as well as the simplest clean up: just delete the VM when you're done. This can be largely automated using off-the-shelf tools that are likely already present in your environment.
An encrypted container: As suggested by Ramhound. Veracrypt and other mature and free encryption tools allow creation of local containers with a variety of authentication options supported. This would exist on whatever storage you wish it to exist on. This is very secure, very private storage. If that's all you need, that should be sufficient.
Closing thoughts:
If you're concerned about 3rd parties viewing content, you really have a different set of problems, not all of which are technical in their nature, and your better solution may be to identify and solve those problems.
Are you concerned about snoopers employed at the same corp? Identify and remove these. Are you unable to trust your IT staff? Why, and if you are justified, remove them. These are HR, not technology, issues.
Are you concerned about outsiders gaining access? None of these solutions will stop them from accessing the data if they're inside your systems. Secure your entire system properly, and you won't need to worry about these.
Are you concerned about employees not treating the confidential information with sufficient care? None of these solutions will solve that problem either. The weakest link in any system is, generally, the humans using it. Set up normal security, create appropriate and clear policies, educate, and then enforce. The most secure system is turned off and inaccessible by any method, physical or electronic. Because your systems need to be used, they have to balance security.
I hope this makes it clear that understanding your specific needs more precisely will help you make a better decision regarding how best to secure it.
