Stop students being able to create folders on the C: drive in XP

[macclad17]

I work in a school and i am trying to make it so that the students when they are logged in cannot create folders and put files in this on the C: obviously i know i could change the settings for this on every single machine in the school but i am trying to work out a way of doing this maybe with the registry edit or a script so that i can roll it out across the school. Working in XP.

Thanks Macclad

[slugshead]

Do you not have a domain?

[macclad17]

ye the pupils computers are all on a domain.

[chazzy2501]

Snipped this from the MSDN website:

Hiding/Preventing Access to Drives

You can use Group Policy settings to hide and restrict access to drives on the RD Session Host server. By enabling these settings you can ensure that users do not inadvertently access data stored on other drives, or delete or damage programs or other critical system files on drive C.

The following settings are located in the Group Policy Management Console under User Configuration\Policies\Administrative Templates\Windows Components\Windows Explorer:
•Hide these specified drives in My Computer. You can remove the icons for specified drives from a user’s My Computer folder by enabling this setting and using the drop-down list to select the drives you would like to hide. However, this setting does not restrict access to these drives.
•Prevent access to drives from My Computer. Enable this setting to prevent users from accessing the chosen combination of drives. Use this setting to lock down the RD Session Host server for users accessing it for their primary desktop.

These are group policy settings you can access them from (active directory users and computers) on your domain controller. Right click on their folder and select properties, then group policy. you should see at least one GPO if you edit one to include the above changes that should stop their access.

You may want to spend some time watching some technet videos on managing a 2003 server, it should cover active directory and group policy.

heres a start:Step-by-Step Guide to Understanding the Group Policy Feature Set

good luck

[macclad17]

We would rather not stop the pupils from being able to see the drive completely just to stop giving them access to creating folders and then writing to them. Obviously if there is no other way to do this then we will take the steps posted above so thanks for your response.

[Galway]

Why would you need students poking around with C anyway ?

[macclad17]

We don't that's what were trying to stop them from being able to do.

[gl3nnym]

Surely it's just easier to hide the drive with restrictions to pupils? Out of sight out of mind and all that.

[macclad17]

just for extra security really, i don't care if they can see it as long as they can't write on to it. Just trying to cover our backs 100%

[slugshead]

we always hide C, never had a problem

[macclad17]

thanks, worth knowing!

[CyberNerd]

Hiding the drives is a workaround.
Making the permissions secure is a fix.

[gl3nnym]

Hiding the drives is a workaround.
Making the permissions secure is a fix.

We have the drives hidden and pupils cannot write/view the drive either. Never had a problem.

[CyberNerd]

We have the drives hidden and pupils cannot write/view the drive either. Never had a problem.

Thats a fix then

[macclad17]

So whats the best way to hide the drives then across a domain?