How to block 'hosts' file from editting?

Question

Hello

In folder windows/system32/drivers/etc there is a hosts file. You can put there list of websites to be blocked. How to protect file hosts from editing? How to disable editing it? Softwares which block files and folders don't work with system folders like /etc.

Answer 1

Hello，

Here are some methods you can use to help restrict editing:

───────────────────────────────

1. Set the File Attribute to Read‐Only

• Open an elevated Command Prompt (Run as Administrator).

• Enter the following command:

  attrib +r C:\Windows\System32\drivers\etc\hosts

• This marks the file as read‑only.

  Note: This is a basic protection that many programs can bypass if they change the file attributes.

───────────────────────────────

2. Modify NTFS Permissions via Windows Explorer

• Navigate to C:\Windows\System32\drivers\etc and locate the hosts file.

• Right‑click on the hosts file and select Properties.

• Go to the Security tab.

• Click the “Edit…” button to change permissions.

• For each entry (Users, Authenticated Users, etc.), you can remove the Write and Modify permissions.

 For example:

  – Select “Users” and uncheck “Modify” and “Write”.

  – If you need more granular control, click “Advanced”, then modify the permission entries there.

• Click Apply and OK to save the changes.

───────────────────────────────

3. Use the icacls Command to Deny Write Permissions

Running commands as an administrator, you can use icacls to deny write permission to certain user groups. For example:

  icacls "C:\Windows\System32\drivers\etc\hosts" /deny Users:(W)

This command denies write access to the “Users” group. You can replace "Users" with other groups or specific accounts as needed. To restore permissions later, note down changes before applying them.

───────────────────────────────

4. Advanced: Use Group Policy or Software Restriction Policies

If you’re in a managed environment the Group Policy Editor (gpedit.msc) can be used to enforce certain file system restrictions. However, for a standalone desktop, Group Policy might be more complex to set up for a single file. Still, you might consider software restriction policies that prevent unauthorized executables from launching, especially if you are trying to block malicious programs from modifying your files.

───────────────────────────────

Important Considerations

• Any method that restricts editing works only if the user doesn’t have full administrative rights. An administrator or malware with elevated privileges can always re‑take ownership or modify permissions.

• Always back up the hosts file before making changes.

• Remember that if you lock it down too restrictively, legitimate system or software updates might have trouble modifying or using it.

---

If the Answer is helpful, please click "Accept Answer" and upvote it.