Enabling Right-Click

[witch]

We have right-click disabled by group policy and the head of ICT is asking for it to be restored as he finds it difficult to get by without it. He mentioned 'save target as' and 'open in new tab' as two examples of things the students cannot do.
Can you give me some arguments for and against? I know they could delete or rename desktop shortcuts but whilst annoying that wouldnt really matter as they are redirected. They could look at the properties of a file but they wouldnt be able to change security permissions or anything, would they?
This is a middle-deemed-secondary - Years 5 to 8

[sippo]

We give right click access as part of an IT course students need to create new shortcut, rename files etc. With redirected start menu's and desktops, I don't see it being an issue. Yes they might be able to rename icons whilst logged on but as soon as they log off it resets anyway.

[Arcath]

I never disable right click. I redirect the desktop to a share that they only have read access to (much to the dismay of the staff) so they can't rename stuff even if they wanted too.

[3s-gtech]

We currently disable, but much has changed since this was set - including the move to mandatory profiles. I need to look at re-enabling it, it does rather hobble things without.

[witch]

Are there other things apart from the desktop that they could potentially sabotage?
We have roaming profiles here

[DMcCoy]

There is no valid reason for disabling right click (which can't be bypassed easily anyway). Sure you can get to the properties of some items, but these can all be locked in other places in the policy.

[cneilson6]

We have right click disabled for students but enabled for staff. Though i agree it is possible to lock down anything that might be accessed via right click it does add an extra layer of security

[pete]

If your network is configured correctly, you have no reason to disable right-click.

If your network is incorrectly configured and you're relying on right-click removal as a band-aid, you're stuffed anyway.

[witch]

If your network is configured correctly, you have no reason to disable right-click.

If your network is incorrectly configured and you're relying on right-click removal as a band-aid, you're stuffed anyway.

Thanks for that...
That's the whole point of this - what MIGHT they be able to access if the network is incorrectly configured - right-click has always been disabled since the server was installed - not by me - and so it may be that because of that, some configuring isn't in place which should be there.
I'm just asking for a bit of advice to make sure that I havent missed something before I re-enable it. Several people, whose opinions I value, have right-click disabled and I am asking the question as to why this is?

[cromertech]

We have right click enabled here. I even allow pinning items to the taskbar for win7. As the students have roaming appdata this allows them to access more commonly used programs quickly and without me having to fill the taskbar with icons at staff request.

Just make sure you go through the things that can be done with a right click (and there are too many to list TBH) and see if they should sensibly be disabled or not.

Sorry can't be too much more help really but as long as you remove the obvious

• disallow access to start menu and task bar preferences
• disallow access to command line (shift and right click will allow to open command window at location)

That should prevent serious problems as most other options are related to their own profile and if they stuff that up there's really only one person to blame

[witch]

Can you tell me where those are? Can't find them in the policy settings

[pete]

Thanks for that...
That's the whole point of this - what MIGHT they be able to access if the network is incorrectly configured - right-click has always been disabled since the server was installed - not by me - and so it may be that because of that, some configuring isn't in place which should be there.
I'm just asking for a bit of advice to make sure that I havent missed something before I re-enable it. Several people, whose opinions I value, have right-click disabled and I am asking the question as to why this is?

Why not try to see what you can break or access on a student account with right-click enabled?

I suspect you'll probably be able to make a hideous pink-on-pink colour scheme so you can't tell what's what on the screen, you'll be able to create shortcuts to local and network locations (and applications) if you know or can browse the path, you'll be able to view the details of any shortcuts, shares, etc.

In short, if your file permissions (or desired access rights) to things on the network are incorrectly configured, the kids will be able to make easy shortcuts to them and run/browse/them. For example, if you're storing scripts or programs in Netlogon or Sysvol, the kids will be able to access them. Unless you're also disabling browsing of UNC paths (can work around that too).

So, are your file permissions appropriate? Have you set the Control Panel/Display GPOs to prevent unreadable pink? Can a kid reset their daft personalisations by logging out / rebooting the machine to clear the cached profile? Have you run access enumerator (free tool) against your shares to check the permissions you think are set are accurate?

There's so many things the person who installed your server could have got wrong, that's it's not really right-click that's the issue.

[cromertech]

Can you tell me where those are? Can't find them in the policy settings

user config /admin templates /start menu and task bar/ prevent changes to taskbar and start menu settings
and user config/admin templates/system/ prevent access to command prompt

[witch]

It's not quite as bad as that, @pete!
I set up most of the policies so I know what is there and what isn't - I just needed to know if I had missed anything. So far I havent found anything that they can do if right-click is enabled, so hopefully all will be well now.
Unless anyone knows any different......

[3s-gtech]

Just found what's stopping us here - lovely Intel graphics drivers give students full access to mess with the display settings from the desktop context menu. Just need to find how to remove the entries for these, probably some fairly simple registry tweaks. Everything else undesireable is already locked out. Will try http://www.intowindows.com/how-to-re...-context-menu/