+ Post New Thread
Results 1 to 3 of 3
Windows 7 Thread, Profile permissions and sharing... in Technical; Hi there, Have somewhat of an odd request. We use local profiles - meaning that student a logs on, it ...
  1. #1
    MordyT's Avatar
    Join Date
    Sep 2012
    Location
    In a computer
    Posts
    485
    Thank Post
    44
    Thanked 74 Times in 69 Posts
    Rep Power
    21

    Profile permissions and sharing...

    Hi there,
    Have somewhat of an odd request.

    We use local profiles - meaning that student a logs on, it makes a local profile. We redirect desktop, docs.
    Recently found that students can change permissions on these profiles... meaning that student a can give student b access to his local profile. This does NOT affect anything that is redirected as those acls are set correctly, but does give access to say appdata, or the favs folder...

    I need a way to block this. As a student is technically the creator of the profile, he is the owner and can change permissions or add people. So I am kinda lost on how to do this.

    Why is this important? We have some special accounts that are not allowed to access resources not on the network (external media is blocked for them). However, what they do is log on with an account on the network, save the files to the local c (everywhere but their profile is locked down hard, so they have to save to their profile), add in the special account so it can read their files, and then the special account has those files it should not have.

    Any ideas?

    The one idea I came up with was to somehow force everyone to use a temp profile. I know, crazy, most people are trying to prevent users from getting a temp profile, but imagine if you login -> temp profile -> deleted when you log off.....
    Thoughts?

  2. #2
    GeekyPete's Avatar
    Join Date
    Mar 2013
    Location
    In a cold dark server room.
    Posts
    339
    Thank Post
    23
    Thanked 78 Times in 59 Posts
    Rep Power
    27
    If you re-direct everything to network servers deny access to the local drives where the profiles are. Use a GPO to hide c: and remove anything they can use to find it too, like cmd.

  3. #3
    MordyT's Avatar
    Join Date
    Sep 2012
    Location
    In a computer
    Posts
    485
    Thank Post
    44
    Thanked 74 Times in 69 Posts
    Rep Power
    21
    Quote Originally Posted by GeekyPete View Post
    If you re-direct everything to network servers deny access to the local drives where the profiles are. Use a GPO to hide c: and remove anything they can use to find it too, like cmd.
    I don't want to direct appdata to the network... But everything important already is being redirected...

    I already set the local drives to hide/ prevent access, but the kids found ways around that...
    Make a new shortcut to \\localhost\c$ for one way to access the C drive when hidden...
    I'm going to try to deny write in the users folder and see what happens. In a VM of course.

SHARE:
+ Post New Thread

Similar Threads

  1. Setting folder security and share permissions automatically
    By Dragon in forum Windows Server 2008 R2
    Replies: 2
    Last Post: 18th May 2013, 04:01 PM
  2. Replies: 1
    Last Post: 15th November 2012, 11:28 AM
  3. Share folder permission and security
    By Hamid in forum Windows Server 2008 R2
    Replies: 1
    Last Post: 13th November 2012, 08:37 AM
  4. Best set up for new users - Home drive permissions and shares?
    By reggiep in forum Windows Server 2008
    Replies: 11
    Last Post: 5th May 2011, 03:01 PM
  5. Back to basics - NTFS and Share permissions
    By Ignatius in forum Windows
    Replies: 16
    Last Post: 20th December 2009, 03:04 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •