Pupils accessing servers and shared folders

[faza]

Hi All,

I wonder if anybody can help, pupils are accessing the servers and seeing the actually servers folders/files. When they login they are double clicking on the programs located on the start menu and accessing explorer. They keep pressing up one level until thery get to network neighbourhood, where they can select the domain thyey are on and see all work stations and servers. They can access the servers and see shared folders and folders. As you understand this is a serious issue has any of you got any ideas please.


TIA

Faza

[Geoff]

It's only a serious issue if your NTFS permissions are setup wrong.

[BKGarry]

Faza,

This shouldn't be a majour problem IF the permission are set correctly on the shares.

But also in GPO there is a no Somputers Near me and a no Entire Network etc etc under User Configuration>Windows Components>Windows Explorer

Might be worth checking

Also enabling the Classic Start Menu and Shell helps against these things

[Geoff]

Installing Access based Enumeration on your W2k3 servers is also worth while.

[maniac]

There is a registry change you can make which as soon as it sees the '\\' in a windows address bar it closes the window. All our student machines do this and it works well, but as it was over a year ago when I made the change, I really can't remember how I did it!

I'll try and find out tomorrow, but some googling might help in the meantime. I remember it wasn't too hard, and involved adding a couple of extra registry settings to a group policy.

Mike.

[faza]

Is there anyone to stop them double clicking on the programs menu?

[Geoff]

See this thread:

http://www.edugeek.net/index.php?nam...wtopic&t=11001

[faza]

I have locked down as much as i can as some of the shares they need. There is no way i can lock it down?

[tech_guy]

There is a registry change you can make which as soon as it sees the '\\' in a windows address bar it closes the window. All our student machines do this and it works well, but as it was over a year ago when I made the change, I really can't remember how I did it!

I'll try and find out tomorrow, but some googling might help in the meantime. I remember it wasn't too hard, and involved adding a couple of extra registry settings to a group policy.

Mike.

Hi Mike,

Any joy with finding those reg tweaks? Would be much appreciated as this is something I'd like to close on my nw too!

Darrell.

[mattx]

How about turning off the Browser Service ? :-)

[Geoff]

You can disable Netbios over TCP/IP in DHCP options too.

[richardp]

Hi,

You can do this through Active Directory Group Policy and making sure that your server shares are set with the correct permissons so even if they get to the network they can only access what they would access anyway.

In group policy management you need to look at User Configuration/Administrative Templates/Windows Components/Windows Explorer. In there you can hide drive letters, computers near me, entire network etc... We also prevent them from running explorer.exe directly.

You really should not have to play around with the registry or fiddle with netbios settings to achieve what you want to do.

Richard

[faza]

If you turn off the browser service, the pupil workstation will not be able to see the server to get things such as application and stuff.

[faza]

richardp - How to you prevent puopils from accessing explorer.exe

[BKGarry]

Erm.... i thought you couldn't it is the Shell after all