+ Post New Thread
Results 1 to 10 of 10
Windows 7 Thread, Shortcut to C: Drive in Technical; A nice security flaw in Windows 7 that I wondered if anyone else has fixed, as I can't find an ...
  1. #1
    simpsonj's Avatar
    Join Date
    Apr 2009
    Location
    Oxford
    Posts
    382
    Thank Post
    159
    Thanked 65 Times in 54 Posts
    Blog Entries
    8
    Rep Power
    21

    Shortcut to C: Drive

    A nice security flaw in Windows 7 that I wondered if anyone else has fixed, as I can't find an elegant solution. Student logs in, right clicks in My Documents - New - Shortcut, types in C:\ and there you go, complete access to the C:\ Drive. This is despite having a GPO that is meant to restrict access to C: (How To Restrict Access To Drives In My Computer In Windows - How-To Geek).

    I could prevent users from creating shortcuts (I think) however it is a mandatory part of the OCR or Cambridge Nationals ICT course, and would probably cause more trouble than it's worth. I'm loathe to change permissions on the C: drive as that tends to cause a lot of issues, and changing permissions on C:\Windows (the main folder I want to protect) appears to be a big no no.

    Any other ideas?

  2. #2
    chazzy2501's Avatar
    Join Date
    Jan 2008
    Location
    South West
    Posts
    1,781
    Thank Post
    213
    Thanked 263 Times in 213 Posts
    Rep Power
    67
    I don't allow right click in explorer, I also don't have a new shortcut link available. I even copied a shortcut from another folder and tried to edit it to point to c:\ but it wouldn't allow it. I can't say what GPOs I selected but I am saying it's possible.

  3. #3

    Steve21's Avatar
    Join Date
    Feb 2011
    Location
    Swindon
    Posts
    2,689
    Thank Post
    334
    Thanked 515 Times in 483 Posts
    Rep Power
    179
    Quote Originally Posted by simpsonj View Post
    A nice security flaw in Windows 7 that I wondered if anyone else has fixed, as I can't find an elegant solution.

    What are they doing in C anyway? I'm assuming exe's are blocked from running? Programs can be accessed anyway etc

    Steve

  4. #4
    simpsonj's Avatar
    Join Date
    Apr 2009
    Location
    Oxford
    Posts
    382
    Thank Post
    159
    Thanked 65 Times in 54 Posts
    Blog Entries
    8
    Rep Power
    21
    Quote Originally Posted by Steve21 View Post
    What are they doing in C anyway? I'm assuming exe's are blocked from running? Programs can be accessed anyway etc

    Steve
    At the moment, it's just one student pushing the boundaries of my security. But it's a concern that I can't block this access, at least not without either potentially bricking the PCs through excessive permissions, or preventing shortcut creation.

  5. #5

    DaveP's Avatar
    Join Date
    Oct 2006
    Location
    Can't talk now: The mother-ship is calling!
    Posts
    8,795
    Thank Post
    351
    Thanked 1,274 Times in 870 Posts
    Blog Entries
    4
    Rep Power
    1126
    We have prevented students from creating shortcuts and nobody is screaming yet.

  6. #6
    simpsonj's Avatar
    Join Date
    Apr 2009
    Location
    Oxford
    Posts
    382
    Thank Post
    159
    Thanked 65 Times in 54 Posts
    Blog Entries
    8
    Rep Power
    21
    I'll have a word with the ICT Teacher.

    Maybe I can just prevent access to Right Click - New. If they need a shortcut ot anything they can just right click on the icon they want to shortcut to, and create it that way.

    Thanks for the ideas!

  7. #7

    Join Date
    May 2011
    Location
    Jus North of London, close but not too close
    Posts
    743
    Thank Post
    172
    Thanked 56 Times in 54 Posts
    Rep Power
    35
    Removed the My Documents link on the Start Menu here. Done before Win7 roll out so no one noticed the change :-).

  8. #8
    simpsonj's Avatar
    Join Date
    Apr 2009
    Location
    Oxford
    Posts
    382
    Thank Post
    159
    Thanked 65 Times in 54 Posts
    Blog Entries
    8
    Rep Power
    21
    Seems it's all or nothing to remove the context menu, which I don't think is really a viable option.

    Interestingly, the running of shortcuts should be blocked by my Software Restrictions GPO, but it doesn't seem to want to block .lnk files, but will happily block .exes.

  9. #9
    simpsonj's Avatar
    Join Date
    Apr 2009
    Location
    Oxford
    Posts
    382
    Thank Post
    159
    Thanked 65 Times in 54 Posts
    Blog Entries
    8
    Rep Power
    21
    Best answer I've found so far: Disable Context Menu (New-Create Shortcut)

    Requires a reg hack, which isn't my favourite method of fixing anything, but trying it to see if it works.

  10. #10
    simpsonj's Avatar
    Join Date
    Apr 2009
    Location
    Oxford
    Posts
    382
    Thank Post
    159
    Thanked 65 Times in 54 Posts
    Blog Entries
    8
    Rep Power
    21
    Just a final update, to achieve this in Windows 7, remove the NullFile Reg_SZ Data Value instead of the COMMAND data value.

    *EDIT* Please note I have only tested this on a virtualised machine, and have not rolled it out across my network, so ensure to test this thoroughly as I do not know what else this might have an impact on! And, you know, you're messing with the registry, so ensure you've got a back up somewhere
    Last edited by simpsonj; 22nd June 2012 at 03:28 PM. Reason: Disclaimer added

SHARE:
+ Post New Thread

Similar Threads

  1. Replies: 9
    Last Post: 1st August 2006, 10:25 AM
  2. ...remove shortcut to Sample Pictures
    By markesmith in forum How do you do....it?
    Replies: 7
    Last Post: 3rd July 2006, 09:01 PM
  3. Replies: 12
    Last Post: 21st November 2005, 09:49 PM
  4. Adding shortcuts to Sims.net
    By eejit in forum Windows
    Replies: 26
    Last Post: 22nd June 2005, 03:35 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •