Windows 7 Thread, Shortcut to C: Drive in Technical; A nice security flaw in Windows 7 that I wondered if anyone else has fixed, as I can't find an ...
22nd June 2012, 02:47 PM #1
Shortcut to C: Drive
A nice security flaw in Windows 7 that I wondered if anyone else has fixed, as I can't find an elegant solution. Student logs in, right clicks in My Documents - New - Shortcut, types in C:\ and there you go, complete access to the C:\ Drive. This is despite having a GPO that is meant to restrict access to C: (How To Restrict Access To Drives In My Computer In Windows - How-To Geek).
I could prevent users from creating shortcuts (I think) however it is a mandatory part of the OCR or Cambridge Nationals ICT course, and would probably cause more trouble than it's worth. I'm loathe to change permissions on the C: drive as that tends to cause a lot of issues, and changing permissions on C:\Windows (the main folder I want to protect) appears to be a big no no.
Any other ideas?
22nd June 2012, 02:54 PM #2
I don't allow right click in explorer, I also don't have a new shortcut link available. I even copied a shortcut from another folder and tried to edit it to point to c:\ but it wouldn't allow it. I can't say what GPOs I selected but I am saying it's possible.
22nd June 2012, 02:59 PM #3
Originally Posted by simpsonj
What are they doing in C anyway? I'm assuming exe's are blocked from running? Programs can be accessed anyway etc
22nd June 2012, 03:03 PM #4
At the moment, it's just one student pushing the boundaries of my security. But it's a concern that I can't block this access, at least not without either potentially bricking the PCs through excessive permissions, or preventing shortcut creation.
Originally Posted by Steve21
22nd June 2012, 03:11 PM #5
We have prevented students from creating shortcuts and nobody is screaming yet.
22nd June 2012, 03:13 PM #6
I'll have a word with the ICT Teacher.
Maybe I can just prevent access to Right Click - New. If they need a shortcut ot anything they can just right click on the icon they want to shortcut to, and create it that way.
Thanks for the ideas!
22nd June 2012, 03:23 PM #7
Removed the My Documents link on the Start Menu here. Done before Win7 roll out so no one noticed the change :-).
22nd June 2012, 03:47 PM #8
Seems it's all or nothing to remove the context menu, which I don't think is really a viable option.
Interestingly, the running of shortcuts should be blocked by my Software Restrictions GPO, but it doesn't seem to want to block .lnk files, but will happily block .exes.
22nd June 2012, 03:52 PM #9
Best answer I've found so far: Disable Context Menu (New-Create Shortcut)
Requires a reg hack, which isn't my favourite method of fixing anything, but trying it to see if it works.
22nd June 2012, 04:07 PM #10
Just a final update, to achieve this in Windows 7, remove the NullFile Reg_SZ Data Value instead of the COMMAND data value.
*EDIT* Please note I have only tested this on a virtualised machine, and have not rolled it out across my network, so ensure to test this thoroughly as I do not know what else this might have an impact on! And, you know, you're messing with the registry, so ensure you've got a back up somewhere
Last edited by simpsonj; 22nd June 2012 at 04:28 PM.
Reason: Disclaimer added
Last Post: 1st August 2006, 11:25 AM
By markesmith in forum How do you do....it?
Last Post: 3rd July 2006, 10:01 PM
By tosca925 in forum Scripts
Last Post: 21st November 2005, 10:49 PM
By eejit in forum Windows
Last Post: 22nd June 2005, 04:35 PM
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)
Tags for this Thread