To restrict folder access to the guest account on Windows 11 Home, you must disable the built-in Guest user and create a standard local account for visitors. This approach ensures that shared folders remain private while allowing guests to browse the web or watch videos without accessing your personal files, passwords, or system settings.
Understanding Windows 11 Home Limitations
Windows 11 Home does not include the Group Policy Editor, which is often used in professional editions to manage complex permissions. However, you can still effectively secure your data using the native User Accounts interface and File Explorer properties. The primary strategy involves removing the inherent risks of the Guest account and replacing it with a controlled standard user profile. This method provides granular control over what files are visible and accessible during a session.
Disabling the Built-In Guest Account
The default Guest account in Windows is designed for temporary, highly restricted access, but it often lacks the predictability required for home security. It may have unpredictable permission inheritance or be disabled by default depending on the installation state. To ensure a clean slate, we will explicitly disable this account if it is active.
Open the Start menu and type
cmd. Right-click Command Prompt and select Run as administrator. In the elevated window, type the following command and press Enter:
net user guest /active:no
This command immediately deactivates the Guest account. You can verify its status by typing
net user and looking for the Guest entry, which should now show "No" under the Active column. By disabling this legacy account, you prevent accidental logins that bypass modern security expectations.
Creating a Standard Visitor Account
A standard user account offers the perfect balance between usability and security. Users logged into this account cannot install software, change system-wide settings, or access other users' personal directories. Follow these steps to create a dedicated account for guests.
Navigate to Settings by pressing
Win + I. Select Accounts from the left sidebar, then choose Family & other users. Click on Add account under the Other users section. Since you likely do not want to link a Microsoft account for a temporary visitor, select I don't have this person's sign-in information. On the next screen, choose Add a user without a Microsoft account.
Enter a descriptive name such as "Guest" or "Visitor." Set a strong password that you do not share with anyone else. If you prefer no password for convenience, you can leave the fields blank, though this reduces security slightly. Click Next to finalize the creation.
Configuring Folder Permissions
Now that you have a standard account, you need to ensure that specific folders containing sensitive data are inaccessible to them. Windows uses Access Control Lists (ACLs) to manage this.
Right-click the folder you wish to protect and select Properties. Go to the Security tab and click Advanced. Here, you will see a list of assigned permissions. Click Disable inheritance at the top of the window. Choose Convert inherited permissions into explicit permissions when prompted. This step allows you to edit individual entries without affecting parent folder rules.
In the Permission Entries list, locate the group named Users or the specific name of the new visitor account. Select it and click Edit. Ensure that Full control, Modify, Write, and Read & execute are all unchecked. Only Allow List View folder contents might remain checked, depending on your preference for visibility. Click OK to save changes. Repeat this process for any other sensitive directories.
Managing Shared Media Folders
If you want guests to watch movies or view photos, you should create a separate public folder. Create a new directory, such as
C:\PublicMedia. Right-click the folder, go to Properties, and select the Sharing tab. Click Advanced Sharing and check Share this folder. Set permissions to allow Read access for Everyone or the specific Guest account.
This setup allows the visitor to stream content without having write access or the ability to delete files. It isolates media consumption from personal document storage. For more advanced network configurations, you might explore related troubleshooting guides if connectivity issues arise during streaming. See
Troubleshooting RDC through VPN Not Working on a Specific Windows Computer for insights on network isolation principles.
Maintaining System Hygiene
Regularly review the accounts listed in Settings > Accounts > Family & other users. Remove any unused profiles to reduce the attack surface. Additionally, consider using Windows Sandbox for testing unknown applications, ensuring your main environment remains untouched. This practice complements your folder restriction strategy by preventing malware execution during guest sessions.
For users who frequently adjust system behaviors, understanding input customization can improve the guest experience. Learn how to
Control volume with key bindings in Windows 11 to provide easier navigation controls for visitors.
Frequently Asked Questions
Can I use the Guest account instead of creating a new one?
It is generally safer to create a standard account because the built-in Guest account has limited configurability and may behave inconsistently across updates. A custom standard account allows you to apply specific folder permissions via the Security tab more reliably.
Will my personal files be deleted if I create a new user?
No, creating a new user account does not affect existing files or settings in your primary administrator profile. Each user has a separate profile directory under C:\Users, keeping your data isolated and secure.
How do I remove the Guest account after they are done?
You can delete the account anytime by going to Settings > Accounts > Family & other users, selecting the account, and clicking Remove. This action deletes the user's profile folder and all data stored within it.
What happens if I forget the password for the visitor account?
As the administrator, you can reset the password by right-clicking the account in the Family & other users menu and selecting Change password. You do not need the old password to perform this administrative task.
Can guests access the internet with this setup?
Yes, standard users have full access to network resources and the internet unless you explicitly block it via parental controls or firewall settings. This allows them to browse websites and stream video without compromising your local file system.