Is it possible in Windows to assign permissions to a folder so that the application has read and write permissions, but ordinary users using it do not?

Question

1C

Actually in the case of 1C for example. So that the 1C program has the rights to read and write from the folder, and the user who runs this program does not have these rights? That is, so that he could NOT go into the folder with the database and copy\change\delete these files.
The variant with SQL is known. But now I'm talking about the file version using the terminal server.
I heard about the option that the program can be run from under another user. It is not very clear how reliable this is, because the password must be stored somewhere, which is not safe.

Answer 1

The software itself (in this case, 1C) runs in the context of the user, which means it uses its (user's) rights.
It is possible, as an option, to save the password from a specially created user in the form of a secure string and write a script that will read this line and then use it as a password to start 1s from this specially created user. It will be relatively secure.
blogs.technet.com/b/robcost/archive/2008/05/01/pow...
Here are examples of how to use this method.

Answer 2

it is necessary to rank as a separate order of the general director of 1C among the applications requiring administrator privileges, and let the users continue to work under a limited account ... they themselves probably encountered, some programs themselves say at startup that they need admin rights and you confirm that you allow the program to start like this. ...

Answer 3

Why such frills?
You probably want to protect yourself from base theft?
Make a terminal server, cut everything there with policies to the maximum so that the user can only run 1C, disable the clipboard and connect local drives.
Backup base - protection against damage.