Hiding sysvol etc shares in Finder

[Sheridan]

Our students are currently enjoying browsing through the sysvol etc shares on the Windows servers from the OSX 10.6.8 Macs. They only have read access (as they need for the windows machines) but I would like to prevent this if possible.

 

I've switched off the display of 'connected servers' in finder by using preferences on the Mac Server, but they can still drill down from Network in finder. Is there a policy or preference I can use to stop this browsing as its allowing reading of group policies. Nothing in there is top secret but it seems like an open door to me.

[p858snake]

Couldn't they just do the same from a windows system then?

[Sheridan]

No, using group policy settings we prevent network browsing. Obviously they have read access otherwise they wouldn't be able to login/receive policies etc but they can't browse the folder structure.

[round2it]

same issue here

[AntonioRocco]

Hi

 

A number of ways you could do this:

 

Disable NetBIOS over TCP/IP and that should stop the Macs 'seeing' PCs in the Finder SideBar. This assumes you're not supporting any older applications that you may be running in Virtualisation/Emulation on one of your Windows Servers? If everything you have is XP or better there's no compelling reason AFAIK to leave the option enabled. However you will have to double-check with the network designer/administrator first. If that person happens to be you and you absolutely know everything you need to know regarding your network then you're the best person able to answer the question.

 

Put all the Macs in their VLAN/subnet. Macs are by design Multicast first and Unicast second. The Finder and Finder Sidebar supports Bonjour and NetBIOS Browsing by default. Bonjour does not traverse subnets easily so placing all the macs in a different subnet should stop them 'seeing' other nodes that are in different subnets. This IMO is an easy 'fix'.

 

Restrict what users see in the sidebar by applying an appropriate MCX.

 

There are other ways I can think of but any one of or a combination of the above should do.

 

HTH?

 

Antonio Rocco (ACSA)

Edited September 28, 2011 by AntonioRocco

[Sheridan]

Brilliant that seems to have worked a treat! I used that in conjunction with another post of yours (linky) and that has done the job a treat, without restricting the users too much!

[cogrady84]

I am enjoying some success with simple finder along with a local firewall rule burned into a master image, which can either be done manually or with WaterRoof:

 

deny tcp from any to any 137 out

deny udp from any to any 137 out

 

This blocks WINS, which stops my windows clients showing up in shared, not sure what, if any limitations this poses on my macs yet, but I have magic triangle up and running with 10.6.4 and this rule in place, with no problems so far... #watchthisspace

Edited January 3, 2012 by cogrady84