One of the easiest ways to do it is by assigning rights to each user for the drive in question. The you can restrict them to specific areas and prevent them access to al the other areas. This will work in W2K but for W9x, you would need to activate the policies and then configure them for this. But, to make a HDD physically impossible to write to? I don't think it can be done. As stated earlier, the OS must be able to read and write to it at all times. Never mind that he doesn't need write access all the time, it must exist. Is this a workstation that is being shared or is it a server?