General Chat Thread, Enabling Right-Click in General; We have right-click disabled by group policy and the head of ICT is asking for it to be restored as ...
15th March 2012, 12:42 PM #1
We have right-click disabled by group policy and the head of ICT is asking for it to be restored as he finds it difficult to get by without it. He mentioned 'save target as' and 'open in new tab' as two examples of things the students cannot do.
Can you give me some arguments for and against? I know they could delete or rename desktop shortcuts but whilst annoying that wouldnt really matter as they are redirected. They could look at the properties of a file but they wouldnt be able to change security permissions or anything, would they?
This is a middle-deemed-secondary - Years 5 to 8
15th March 2012, 12:47 PM #2
We give right click access as part of an IT course students need to create new shortcut, rename files etc. With redirected start menu's and desktops, I don't see it being an issue. Yes they might be able to rename icons whilst logged on but as soon as they log off it resets anyway.
15th March 2012, 12:50 PM #3
I never disable right click. I redirect the desktop to a share that they only have read access to (much to the dismay of the staff) so they can't rename stuff even if they wanted too.
15th March 2012, 12:58 PM #4
We currently disable, but much has changed since this was set - including the move to mandatory profiles. I need to look at re-enabling it, it does rather hobble things without.
15th March 2012, 01:15 PM #5
Are there other things apart from the desktop that they could potentially sabotage?
We have roaming profiles here
15th March 2012, 01:21 PM #6
There is no valid reason for disabling right click (which can't be bypassed easily anyway). Sure you can get to the properties of some items, but these can all be locked in other places in the policy.
15th March 2012, 01:25 PM #7
- Rep Power
We have right click disabled for students but enabled for staff. Though i agree it is possible to lock down anything that might be accessed via right click it does add an extra layer of security
15th March 2012, 01:35 PM #8
If your network is configured correctly, you have no reason to disable right-click.
If your network is incorrectly configured and you're relying on right-click removal as a band-aid, you're stuffed anyway.
15th March 2012, 01:49 PM #9
Thanks for that...
Originally Posted by pete
That's the whole point of this - what MIGHT they be able to access if the network is incorrectly configured - right-click has always been disabled since the server was installed - not by me - and so it may be that because of that, some configuring isn't in place which should be there.
I'm just asking for a bit of advice to make sure that I havent missed something before I re-enable it. Several people, whose opinions I value, have right-click disabled and I am asking the question as to why this is?
Last edited by witch; 15th March 2012 at 01:51 PM.
15th March 2012, 02:02 PM #10
We have right click enabled here. I even allow pinning items to the taskbar for win7. As the students have roaming appdata this allows them to access more commonly used programs quickly and without me having to fill the taskbar with icons at staff request.
Just make sure you go through the things that can be done with a right click (and there are too many to list TBH) and see if they should sensibly be disabled or not.
Sorry can't be too much more help really but as long as you remove the obvious
- disallow access to start menu and task bar preferences
- disallow access to command line (shift and right click will allow to open command window at location)
That should prevent serious problems as most other options are related to their own profile and if they stuff that up there's really only one person to blame
Thanks to cromertech from:
15th March 2012, 02:07 PM #11
Can you tell me where those are? Can't find them in the policy settings
15th March 2012, 02:24 PM #12
Why not try to see what you can break or access on a student account with right-click enabled?
Originally Posted by witch
I suspect you'll probably be able to make a hideous pink-on-pink colour scheme so you can't tell what's what on the screen, you'll be able to create shortcuts to local and network locations (and applications) if you know or can browse the path, you'll be able to view the details of any shortcuts, shares, etc.
In short, if your file permissions (or desired access rights) to things on the network are incorrectly configured, the kids will be able to make easy shortcuts to them and run/browse/them. For example, if you're storing scripts or programs in Netlogon or Sysvol, the kids will be able to access them. Unless you're also disabling browsing of UNC paths (can work around that too).
So, are your file permissions appropriate? Have you set the Control Panel/Display GPOs to prevent unreadable pink? Can a kid reset their daft personalisations by logging out / rebooting the machine to clear the cached profile? Have you run access enumerator (free tool) against your shares to check the permissions you think are set are accurate?
There's so many things the person who installed your server could have got wrong, that's it's not really right-click that's the issue.
Last edited by pete; 15th March 2012 at 02:25 PM.
15th March 2012, 03:15 PM #13
user config /admin templates /start menu and task bar/ prevent changes to taskbar and start menu settings
Originally Posted by witch
and user config/admin templates/system/ prevent access to command prompt
Thanks to cromertech from:
16th March 2012, 08:11 AM #14
It's not quite as bad as that, @pete!
I set up most of the policies so I know what is there and what isn't - I just needed to know if I had missed anything. So far I havent found anything that they can do if right-click is enabled, so hopefully all will be well now.
Unless anyone knows any different......
16th March 2012, 09:37 AM #15
Just found what's stopping us here - lovely Intel graphics drivers give students full access to mess with the display settings from the desktop context menu. Just need to find how to remove the entries for these, probably some fairly simple registry tweaks. Everything else undesireable is already locked out. Will try http://www.intowindows.com/how-to-re...-context-menu/
Last edited by 3s-gtech; 16th March 2012 at 09:41 AM.
By beeswax in forum Windows
Last Post: 29th March 2012, 04:35 PM
By SimpleSi in forum Windows Server 2000/2003
Last Post: 19th October 2011, 01:55 PM
By emyllis in forum Windows Server 2000/2003
Last Post: 22nd March 2010, 10:27 AM
By ricki in forum Wireless Networks
Last Post: 25th November 2009, 02:05 PM
By browolf in forum Windows
Last Post: 14th October 2005, 01:33 PM
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)