I don't think subst is a good idea for security purposes. You can't hide the original drive, some tools look right trough it, and UNC path names allow other wa

I don't think subst is a good idea for security purposes. You can't hide the original drive, some tools look right trough it, and UNC path names allow other ways. Windows has the concepts of window stations and sessions. One of these 2 is the namespace for drive letters, as it allows different rdp users to have their own network drives, and also give services their own security context . Take sysinternals winobj to look around. Maybe you can build something chrootlike out of it, I dont really know, I am a bit out of my depth here.