Computer device and method for isolating untrusted content

A computer device, comprising:

• a hardware layer including at least a processor and a memory;
• an operating system which performs tasks using the hardware layer;
• a user process operating in a primary user account controlled by the operating system and configured to request a task to be actioned by the operating system, wherein the primary user account comprises a network drive which is mapped into the primary user account;
• an agent configured to execute in cooperation with the operating system, wherein the agent is configured to:
• intercept the task before being actioned by the operating system and provide task metadata relevant to the intercepted task;
• examine the task metadata and selectively output a policy result identifying the task as being an untrusted task;
• provision a task isolation environment by (i) (i) programmatically creating a secondary user account on the computer device, (ii) determining a printer which is available in the primary user account, and (iii) making the printer available in the secondary user account by populating printer-related user settings in the secondary user account;
• and
• cause the untrusted task to be executed as an isolated process in the task isolation environment provided by the secondary user account.

A computer readable storage medium having recorded thereon instructions which, when implemented by a computer device, perform the steps of:

• intercepting a task from a primary user account prior to execution of the task by the computer device, wherein the task relates to an untrusted content;
• provisioning a task isolation environment for executing the task, including (i) programmatically creating a secondary user account on the computer device, (ii) determining a printer which is available in the primary user account, and (iii) making the printer available in the secondary user account by populating printer-related user settings in the secondary user account;
• executing the task in the task isolation environment in relation to the untrusted content;
• intercepting, by an agent, a printer service request by the task in the secondary user account in relation to the printer;
• determining, by the agent, whether to allow or deny the printer service request by the task of the secondary user account in relation to the printer;
• and
• providing impersonated credentials of the primary user account by the agent when the printer service request is allowed and allowing the printer service request to proceed using the impersonated credentials.