pupils accessing c: drive

[jonbones]

can any body help or point in right direction?

on our workstations shorcuts to locally installed apps are in a folder on the C: drive called local programs. this folder is accessed via shortcut in pupils subject programs folder on the network. problem is if pupils click the folder up button from this location (c:\local programs) the local C: drive is displayedand accesible. This is the only way (to my knowledge) that C: drive access is possible as we have Group policy in effect that hides C: drive that seems to be successful in all other ways. Is there way of creating a shorcut to c:\local programs that fools it into thinking the parent folder is elsewhere other than C:.

look forward to your comments/help

[Geoff]

I don't see what the problem is? Assuming your pupils have limited user access only they can't do any damage?

[CyberNerd]

Not sure if this is what you are after but subst command can 'map' a path to a local drive:

 subst G: "c:\program files"

creates a G: drive that is c:\program files

[meastaugh1]

As above, if your NTFS is good, you shouldn't have much to worry about, but if you want to lock down further...

You can work around it by supplying the /root switch to explorer in the shortcut, eg explorer.exe /root, c:\local

Or you could prevent students browsing the C drive using the policy in User Config>Admin Templates>Windows Components>Windows Explorer>Prevent access to drives from My Computer.

[petectid]

I found our pupils doing this, you can stop them by using the no view drives policy. Drive C: is easily hidden but you can also hide network shares from where you may be running software. Just edit the System ADM file to suite your requirements. If you prevent access to the drive they will not be able to run the software, remember there is the NoDrives policy and the NoViewOnDrives Policy. You need the latter which only hides the drive.

[jonbones]

As above, if your NTFS is good, you shouldn't have much to worry about, but if you want to lock down further...

You can work around it by supplying the /root switch to explorer in the shortcut, eg explorer.exe /root, c:\local

Or you could prevent students browsing the C drive using the policy in User Config>Admin Templates>Windows Components>Windows Explorer>Prevent access to drives from My Computer.

Our NTFS is good - better to be safe than sorry though.

your idea of supplying the /root switch to explorer is spot on thanks very much.

Merry Christmas.

[Aaron]

hi everyone i am hoping that you can help me here, i have used what meastaugh1
said about changeing the gpo so that pupils dont get access to drives on my computer which has worked brilliant thank you very much although now if a pupil puts a memory stick in it has removed the my computer icon from the start menu and now pupils cant see there memory stick.

is there anyway around this by using the gpo it has stopped that pupils are able to navigate to the c: by right clicking on the ALL PROGRAMS and opening explore or open which is brilliant but i would still like them to be able to see the my computer icon so that when a memory stick is inserted they have access to that.

[meastaugh1]

hi everyone i am hoping that you can help me here, i have used what meastaugh1
said about changeing the gpo so that pupils dont get access to drives on my computer which has worked brilliant thank you very much although now if a pupil puts a memory stick in it has removed the my computer icon from the start menu and now pupils cant see there memory stick.

is there anyway around this by using the gpo it has stopped that pupils are able to navigate to the c: by right clicking on the ALL PROGRAMS and opening explore or open which is brilliant but i would still like them to be able to see the my computer icon so that when a memory stick is inserted they have access to that.

That sounds odd, afaik neither of the aforemention options should cause the My Computer shortcut from disappearing from the Start Menu. Are you sure you haven't made any other changes that could have caused this behaviour? Which drive letters have you chosen to hide/prevent access to?