c drive issues

[alonebfg]

right where do i start oh yes we have this software. when it installs it puts some examples on the c drive for students to use. all well and good but the here comes the tricky part they are doing databases. All the other exapmles work except databases i did have c drive restricted to stop them playing on the c drive no good. apprantly i need to give the students read write execute modify to this folder how do i do that without going round and doing it manually on about 60 machines. the software in question is texease studio ct. i have a work around for the time being but have been told this is not good enough. i have already had to remove the policy restrict c drive for them to access it i dont want to do no more ??

[Quackers]

Ever thought of using Windows Disk Protection? You can highlight the Program files directory while on as Admin , delete it all , reboot and its all back to normal with no delay in booting. Allows your students to do what they want to drive C:, reboot all is back to how you set it.

[tosca925]

We have had to do this on quite a lot of software over the years. We, like you had to manually do it for a couple of months until i found out the correct way of doing it.

I cant remember the policy in GPO off hand but I'm sure someone will if not I'll find it tomorrow at work.

It is a setting that lets you add folders that are on the local c:\drive and lets you change the permissions on those individual folders alone. You could do this for all the 60 machines you talk about in one GPO our in the GPO's the 60 machines reside in.

I hope this makes sense because i don't think am explaining it too well.

[ChrisH]

Or a startup scipt along the lines of

if exists c:\folder then
cacls blah blah

[mattx]

GPO [ as someone has already stated will meet your requirements ] - I have quite a lot setup in this department for various programs which need write access etc to the C: drive

Work your way to:

Stations ---> Computer Config ---> Security Settings ---> File system

Right click in the right pane and 'add file'
Note - certain locations are set like %programFiles% %Systemroot% %SystemDrive% etc

For example I have: %ProgramFiles%\Groupcall & %SystemDrive%\Darkedit

You can then add users with the relevant NTFS settings and file propagate etc.

Good luck.

[tosca925]

Stations ---> Computer Config ---> Security Settings ---> File system

Right click in the right pane and 'add file'
Note - certain locations are set like %programFiles% %Systemroot% %SystemDrive% etc

For example I have: %ProgramFiles%\Groupcall & %SystemDrive%\Darkedit

You can then add users with the relevant NTFS settings and file propagate etc.

Perfect explanation matx, far better than i did this time of night. I knew exactly how to do it in front of my GPO at work but could not get it into words.

Time for bed me thinks

[GeeDee]

Also bear in mind that the Group Policy for 'Hide the C drive' is NOT the same thing as permissions on the file system.

The GP setting is merely cosmetic and it makes zero difference to the actual permissions your users have. It just hides the drive in Explorer.

[alonebfg]

thanks i think i have got it i do have hide c drive and restrict c drive its only this one folder that needs write as databases need that to work ( i hate databases)

[srochford]

Remember that hiding the C drive doesn't stop anyone doing damage if they know what they're doing. As GeeDee says, you need to make sure that the permissions are good. If they are OK then it doesn't matter whether you hide the drive or not - users can't cause any harm!

[ITWombat]

@alonebfg
Will they actually being creating EXEs/scripts etc. or is the execute permission just needed for file associations?

If it's for the latter then make sure Software Restriction Polcies are setup in additon to the NTFS permissions. This is so that they won't be able to launch their favourite games or any malware from the new folder.

Ideally the app should be written only to have common read only data in Program Files with any user created data either in My Documents or the Application Data folder.

[sidewinder]

Perfect coincidence seeing this thread

Found out today some old software needs full access to the temp folder to run under non-admin, and I wouldnt have had any idea there was a policy setting for this - so thanks!