DirProtect.vbs

'DirProtect v1.0.1
'https://pastebin.com/u/jcunews
'https://www.reddit.com/user/jcunews1
'
'Usage: DirProtect {unprotected directory}
'       DirProtect /u {protected directory}
'
'Requirements: Windows 2003 or later version, NTFS drive, elevated privileges.
'
'This script provides a simple protection for directories in NTFS drives where
'contents of the protected directory can only be accessed from a shortcut file.
'The shortcut file can then be renamed and placed anywhere else which only the
'user will know. Junction or symbolic link is not used in order to prevent
'applications from traversing directory typed file system objects, and to
'prevent them from discovering the files within the protected directory.
'
'Protection is done by moving and placing the directory in another inaccessible
'directory of the same name. e.g. if the old directory location is at:
'
'  d:\my data\personal files
'
'It will be moved into a new location:
'
'  d:\my data\personal files\personal files
'
'Access to the old location will be denied, but access to the new location
'will be allowed. Access to the protected directory is done by using a shortcut
'file which will be created using the same name. e.g.:
'
'  d:\my data\personal files.lnk
'
'To access the protected directory from a file selector dialog (e.g. "Open" or
'"Save" dialogs), change the view to show all files, then double click on the
'protected directory shortcut file.
'
'If the shortcut file is accidentally deleted, create one in an unprotected
'directory by using the right-click popup menu and choose "New" then "Shortcut".
'Manually type the new location of the protected directory.

sub help
  set f = fs.opentextfile(wscript.scriptfullname)
  s = ""
  do while true
    l = f.readline
    if left(l, 1) <> "'" then exit do
    s = s & mid(l, 2) & vbcrlf
  loop
  f.close
  wscript.echo left(s, len(s) - 2)
  wscript.quit 1
end sub

set fs = createobject("scripting.filesystemobject")
lock = not wsh.arguments.named.exists("U")
if wsh.arguments.unnamed.count = 0 then help
dir = wsh.arguments.unnamed(0)
if not fs.folderexists(dir) then
  wsh.echo "Specified directory is not found."
  wsh.quit 2
end if
set d = fs.getfolder(dir)
if d.parentfolder is nothing then
  wsh.echo "Specified directory must not be a root directory."
  wsh.quit 2
end if
if not fs.fileexists(fs.getspecialfolder(1) & "\config\system") then
  wsh.echo "This script must be run with elevated privileges."
  wsh.quit 2
end if
dir = d.path
dn = d.name
lkn = d.name & ".lnk"
lkp = dir & "\..\" & lkn
randomize
rn = round(rnd * 10000000000, 0)
set ws = createobject("wscript.shell")
set e = ws.environment("process")
u = e("userdomain") & "\" & e("username")
on error resume next
set xc = ws.exec("icacls.exe """ & dir & """")
if err.number <> 0 then
  wsh.echo "This script requires Windows 2003 or later versions." & vbcrlf & _
    xc.stderr.readall
  wsh.quit 2
end if
on error goto 0
s = split(xc.stdout.readall, vblf)
do while xc.status = 0
  wsh.sleep 20
loop
if xc.exitcode <> 0 then
  wsh.echo "Failed on retrieving directory permissions." & vbcrlf & _
    xc.stderr.readall
  wsh.quit 3
end if
sec = ""
for each l in s
  if instr(l, u & ":(DENY)") > 0 then
    sec = mid(l, instr(l, ":(DENY)") + 7)
    exit for
  elseif instr(l, "  No permissions are set.") > 0 then
    wsh.echo "Only directory of a local NTFS drive can be protected."
    wsh.quit 2
  end if
next
e = 0
if lock then
  if sec <> "" then
    wsh.echo "Specified directory is already protected."
    wsh.quit 2
  end if
  if fs.fileexists(lkp) then
    wsh.echo """" & dir & ".lnk" & """ shortcut file is already exists."
    wsh.quit 3
  end if
  on error resume next
  fs.createtextfile(lkp).close
  if err.number <> 0 then
    wsh.echo "Failed on creating shortcut file." & vbcrlf & err.description
    wsh.quit 3
  end if
  err.clear
  fs.createfolder dir & rn
  if e = 0 then
    err.clear
    fs.movefolder dir, dir & rn & "\" & dn
    e = err.number
    if e = 0 then
      err.clear
      fs.movefolder dir & rn, dir
      e = err.number
      if e = 0 then
        set lk = createobject("shell.application").namespace( _
          d.parentfolder.path).parsename(lkn).getlink
        lk.path = dir & "\" & dn
        lk.save
        set xc = ws.exec("icacls.exe """ & dir & """ /deny " & u & ":(rd)")
        xc.stdout.readall
        do while xc.status = 0
          wsh.sleep 20
        loop
        if xc.exitcode <> 0 then
          fs.movefolder dir, dir & rn
          wsh.echo "Failed on changing directory permissions." & vbcrlf & _
            xc.stderr.readall
        end if
      else
        wsh.echo "Failed on renaming directory." & vbcrlf & err.description
      end if
      if err.number <> 0 then fs.movefolder dir & rn & "\" & dn, dir
    else
      wsh.echo "Failed on moving directory." & vbcrlf & err.description
    end if
    if e <> 0 then fs.deletefolder dir & rn
  else
    wsh.echo "Failed on creating directory." & vbcrlf & err.description
  end if
  if e = 0 then
    wsh.echo """" & dir & """ directory has been protected." & vbcrlf & _
      "Use below shortcut file to access the protected directory." & _
      vbcrlf & vbcrlf & "  " & fs.getfile(lkp).path
  else
    fs.deletefile lkp
    wsh.quit 3
  end if
else
  if sec = "" then
    wsh.echo "Specified directory is not a protected directory."
    wsh.quit 2
  end if
  set xc = ws.exec("icacls.exe """ & dir & """ /remove:d " & u)
  xc.stdout.readall
  do while xc.status = 0
    wsh.sleep 20
  loop
  if xc.exitcode <> 0 then
    wsh.echo "Failed on changing directory permissions." & vbcrlf & _
      xc.stderr.readall
    wsh.quit 3
  end if
  if not fs.folderexists(dir & "\" & dn) then
    set xc = ws.exec("icacls.exe """ & dir & """ /deny " & _
      ws.environment("process")("username") & ":d")
    xc.stdout.readall
    do while xc.status = 0
      wsh.sleep 20
    loop
    wsh.echo "Specified directory is not a protected directory."
    wsh.quit 2
  end if
  if fs.fileexists(lkp) then fs.deletefile lkp
  fs.movefolder dir, dir & rn
  fs.movefolder dir & rn & "\" & dn, dir
  fs.deletefolder dir & rn
  wsh.echo """" & dir & """ directory protection has been removed."
end if