FolderRisk: Caution
Public C:\Users\Public
Profile shared by all local users of the machine: common documents, pictures, downloads and desktop.
What it’s for
C:\Users\Public is the folder all local accounts share. It matches FOLDERID_Public and the %PUBLIC% variable. You use it to exchange files between users of one PC without setting up a network share.
What it contains
- Common folders:
Documents,Downloads,Music,Pictures,Videos. Desktop: its content appears on every user’s desktop, which is where installers drop their “for all users” shortcuts.- Broad default permissions: authenticated users can read and modify files here.
Risks and best practices
- Every local user can read and write here, so keep sensitive data and any script a privileged account will run out of it.
- Check
Public\Desktopnow and then: a booby-trapped shortcut would show on every account’s desktop. - Public folder sharing, in the advanced sharing settings of Network and Sharing Center, opens this folder to other machines on the network. Leave it off unless you need it.
- On a shared workstation you can empty it or restrict its permissions under your policy, after checking that no application relies on
%PUBLIC%.
Useful commands
# Resolved folder and contents$env:PUBLICGet-ChildItem $env:PUBLIC -Force
# Effective permissionsGet-Acl $env:PUBLIC | Format-List Owner, AccessToString