removing "Find Printers" from the search submenu

[goodhead]

It has been requested that we give our staff windows search.
Currently we hide the whole of the search option in the start menu with Group policy.

I want to allow the search for files and folders but allow the searching of printers.

Is there an ADM file or even the option in GPO that will allow me to hide this option from search?

Dan

[william-swc]

I know it's old but instead of creating a new thread I decided to resurrect!

I too am looking a resolution to this problem. Our users use the windows classic menu as defined by group policy. This has only recently been enforced and as a security measure we have removed the search button from the start menu and explorer. The users don't have access to C drive and can only store their info on a personal network share.

As you can imagine there have been a few complaints after they arrived back after summer break and weren't able to search their personal space. We have managed to enable search button and prevent them from searching the entire network and local hard drives however I can't find a way to remove the find printers button in the context menu of search.

When I use the find printers button it allows me to display a list of shared printers across all 4 campuses! Using Group Policy we have ensured that users cannot connect to any of these printers however we want to remove the find printers option completely. Is there a script available or an option within group policy to perform this function?

[ricki]

Have a look at User Configuration, Administrative Templates, Control Panel, and Printers. in a user gpo.

Richard

[Michael]

You can't remove 'Find Printers' but what you can do is hide them being listed in the directory. On your printer server, right click a printer, choose Properties > Sharing. Untick 'List in the directory'.

The only way users could theoretically add printers would be typing the UNC path: \\servername\printersharename

It's also recommended to tweak printer permissions too, as typically 'Everyone' can print to a printer. Taking these entries out and adding security groups can stop users printing too - even if they attempt to connect and print.

[william-swc]

thanks for the replies,

I've already looked at all the options within Group Policy including what you suggested Richard.

I think Michael that your suggestion could work for us. My only problem now is convincing the other campuses to do that too.

Thanks again
William

[Michael]

Well if you push out printers using Print Management, there should be no real need to publish the printers too. Any printers which need to be added can be dealt with on a one to one basis.

[william-swc]

exactly, we use Desktop Authority to push out the printers so we don't have to worry about that.

[william-swc]

Ok another problem has come to light related to this. I'm happy enough for the Find Printers dialog box to pop up however the user can click on browse location and view the whole AD structure! This would provide an unacceptable security risk. Is there anyway to get around this?

[Michael]

Why is it a potential security risk? What can users see that they can do damage with?

[william-swc]

As far as I'm concerned I'd be ok with it, but one of my bosses is real anal about security and says that if a student doesn't need something then they shouldn't even see it. I've made a few adjustments to a test GPO and am awaiting his feedback so will let you know.

[william-swc]

Ok I've let my boss know where I'm at with this. The security issues are as follows:

'The policy change made to the printer properties hides the printer ok but any user can search for any computer (this includes all servers and their shares, etc) or any users details stored within AD on the network.'

What can I do to lock this down?

[morganw]

This will stop the search results but will still show the OU structures.

User configuration / Administrative Templates / Desktop / Active Directory /
Maximum size of Active Directory searches: Enabled
Number of objects returned: 0