What OS would help. I assume is windows, so use the win sys stuff.
Shared file access in Windows is managed by three distinct mechanisms:
1. Using share access controls that allow applications to specify whole-file access sharing for read, write or delete;
2. Using byte range locks to arbitrate read and write access to regions within a single file; and
3. By Windows file systems disallowing executing files from being opened for write or delete access.
The semantics of share access controls in Windows are inherited from the original MS-DOS system (where sharing was introduced in MS-DOS 3.3) Thus, an application must explicitly allow sharing - otherwise an application has exclusive read, write and delete access to the file (other types of access, such as those to retrieve the attributes of a file are allowed.)
For a file with shared access, applications may then use byte range locking to control access to specific regions of the file. Such byte range locks specify a region of the file (offset and length) and the type of lock (shared or exclusive). Note that the region of the file being locked is not required to have data within the file and applications sometimes exploit this ability to implement their functionality.
For applications that use the file read/write APIs in Windows, byte range locks are enforced (also referred to as mandatory locks) by the file systems that execute within Windows. For applications that use the file mapping APIs in Windows, byte range locks are not enforced (also referred to as advisory locks.) Byte range locking may also have other side-effects on the Windows system. For example, the Windows file sharing mechanism will typically disable client side caching of a file for all clients when byte range locks are used on any client to control access of the file. The client will observe slower access to the file because all read and write operations must be sent to the file server where the file is stored.
Improper error handling in an application program can lead to a situation where a file is locked (either using share access or with byte range file locking) and cannot be accessed by other applications. In this case the user may be able to restore access to the file by terminating the malfunctioning program manually. This is typically done through the Task Manager utility.
File sharing is determined by the sharing mode parameter in the CreateFile function used to open files. Files can be opened to allow sharing the file for read, write or delete access. Subsequent attempts to open the file must be compatible with all previously granted sharing access to the file. When the file is closed, the sharing access restrictions are adjusted to remove the restrictions imposed by that specific file open.
Byte range locking type is determined by the dwFlags parameter in the LockFileEx function used to lock a region of a file. The Windows API function LockFile can also be used and acquires an exclusive lock on the region of the file.
Any file that is executing on the computer system as a program (e.g., an EXE, COM, DLL, CPL or other binary program file format) is normally prevented by the file system from being opened for write or delete access, reporting a sharing violation, despite the fact that the program is not opened by any application. However, some access is still allowed. For example, a running application file can be renamed or copied (read) even when executing.
Files are accessed by applications in Windows by using file handles. These file handles can be explored with the Process Explorer utility. This utility can also be used to force-close handles without needing to terminate the application holding them.
Microsoft Windows XP and Server 2003 editions have introduced volume snapshot capability to NTFS, allowing open files to be accessed by backup software despite any exclusive locks. However, unless software is rewritten to specifically support this feature, the snapshot will be crash consistent only, while properly supported applications can assist the operating system in creating "transactionally consistent" snapshots. Other windows commercial software for accessing locked files include File Access Manager, and Open File Manager. It operates by installing its own drivers to access the files in kernel mode.
That is the jist of it from wikipedia.
ACL is kinda what you want.
I use dual logins, no shares allowed, I am on a limited account now, and cannot access certain folders or files without Admin rights, I placed some as Administrator only.
Is rather simple.