How to prevent copying of a file or its parts in AD?

Question

Active Directory

Tell me how to forbid and simply prohibit copying a file or text from a file to AD without bells and whistles (without IRM, SZI from NSD, DLP ...). Exception copying through screenshots.
Goal: Specific users can read the file, but cannot select text and copy it, nor can they copy the entire file.
Proposed solution (what brains were enough for):
The user enters the folder, launches a program that opens a "protected file" located in a subfolder inaccessible to the user, but accessible to the program.
In other words:
Folder "A" (access to it through the AD group - that is, we limit the circle of access).
//composition of the folder "A":
1) Program * opening the file stored in the folder "Folder1"
2) The folder "Folder1" invisible to users (we restrict copying of the file)
//composition of the subfolder "A \ Folder1":
2.1) The file "Protected file" (we limit the copying of text in the file)
Will this work at all? Or the program will not get access to the folder ?
* self-written program, script (not a problem)...
the program contains a static link to the file ("\Folder1\Protected file.txt"), i.e. the user can copy the file, but the path "\Folder1\Protected file.txt" will be invalid anywhere else.

Answer 1

Write a program that will act as an image viewer and convert opened files into images in the background. An example is virtual printers that print documents as PDF, JPG, PNG files.
After the end of viewing, obviously, the converted files need to be deleted

Answer 2

As one of the options, you can offer thin clients - diskless stations, since you do not trust your users so much. There simply will not be uncontrolled data output.
Remote OS loading with a terminal client (thinstation for example), all the necessary software works on the terminal server.
Copying is not prohibited, however, all data can only be saved to a shared network folder or roaming desktop/documents located on the same file server.
Employees of the Security Council have access to mail and file resources, in which case they will make an atata.
IMHO, this is more logical than trying to implement the above.

Answer 3

The idea is certainly interesting, but for what purpose?
With the same success, you can make a copy-protected PDF file, but this is also not a perfect thing.
And what prevents the user from taking a screenshot?

Answer 4

Program rights = user rights (domain) => you can not make a folder that is visible to the user, but not to the program launched by IM (an exception is folders with disabled listing, perhaps).
And so - just put an agent for the user that will block operations with the clipboard and a screenshot button.
P.S. - "read" operation = "copy" operation, i.e. The task you have is to prohibit RECORDING to the data clipboard.

Answer 5

Exception copying through screenshots.

And what is the meaning of this trouble, if everything can be copied with screenshots?

Answer 6

So far, I have done so, documents in the form of encrypted PDFs (copying and printing are prohibited) using a certificate that is installed on computers.
The management decided that this was enough, given the average level of computer literacy of employees.

Answer 7

Microsoft Windows Rights Management Services: https://social.technet.microsoft.com/Forums/en-US/...