double clicking on the start menu

[ZeroHour]

Hi

We are having the issue where pupils double click on a folder in our redirected start menu and it launches with the network path in windows explorer.

I have searched the forums and found a couple of threads of interest where there have been group policy suggestions but I have still not be able to figure out which part of group policy does it.

Can someone please tell me the setting I need to enable to cure this problem?

NOTE: we use classic start menu's here

 

Cheers

 

EDIT:

To elaborate, a user can double click on "Accessories" in the start menu and it then launches windows explorer with the contents of "Accessories" listed. If the start menu is redirected this launches the UNC path of the redirected "Accessories". Once the pupils have that window they can then click on the "Folders" button on the explorer window and then browse the network potentially.

[MkII]

Same problem here when we enabled right click on the desktop. That specifically is in User Config > Admin > windows> IE > Browser Menu > Disable Context Menu

 

I may have done it elsewhere with the context menu tho'.

[ZeroHour]

Hi

thanks for that mark, it blocked IE right clicks but it did not cure the issue. I have edited the first post to explain the problem more clearly.

Anymore ideas?

[maniac]

Our network doesn't allow this, if you double click either it comes up with message saying access denied. It's done with group policy restrictions, but don't ask me exactly how, I can't remember. It proves it is possible to restrict however.

 

Mike.

[ZeroHour]

But do you use redirected start menus?

I think the message you see is because its trying to launch the folder for your start menu which is located on the C:\ and your C:\ is hidden. That part works. If I use redirected though I have issues.

[MkII]

Yes, that's exactly the problem we had ZH - we have redirected start menus too. Settings from IE leak over into explorer is the problem.

[ZeroHour]

Hmm thats weird, I enabled the policy you said about and reset the users profile but it could still launch when double clicked on the start menu?

If you revert your setting does the ability come back?

Any other possible conflicting policy settings we could have?

[pallen]

Just a quick question, why do you need the accessories on the start menu? I have been looking into setting up a redirected start menu, but only want to show the programs list and nothing else. If there is a problem with this can someone enlighten me as I was hoping to get it ready for next week

[ZeroHour]

The "accessories" folder was a just a example.

If you have a folder under the "programs" directory try double clicking on it and follow the Edit section in my first post.

If you select "entire network" from the "folders" list button you can see all your pc's and start browsing for open shares/printers etc.

[ZeroHour]

found this but I have not tried it yet.

It def sounds like its linked to IE but I have not been able to find a GP setting that cures it here.

[srochford]

Why does it matter?

 

What you need to make sure you do is not have any folders accessible which users could get to like this but shouldn't get to.

 

eg - suppose they're opening up \\server\share\menu\accessories - they can then move up to \\server and see its shares. There might be one called "private_staff_work"; provided that the permissions on that are set properly it doesn't matter that they can see the share; they can't access it.

[MkII]

If, like in our setup, you have different start menu's per room/ faculty etc, then pupils could navigate around and launch any locally installed apps. Not really a problem, as we don't have staff programs re-directed there, like sims.net

[srochford]

But even if they could browse to an icon for Sims.Net, surely the permissions on it wouldn't allow them to run it (and I'm assuming Sims has some kind of internal security which prevents anyone from just using it without some kind of authentication!)

[ZeroHour]

Really, why is not the point, I have just seen other people saying its simple so I thought I would ask.

[altecsole]

Here is a small program you can run as a logon script. It'll pop up a message and close the window when they try to access a share on a network computer from the redirected start menu. It's written using AutoIT3.

stopnetbrowse.zip

[ZeroHour]

Here is a small program you can run as a logon script. It'll pop up a message and close the window when they try to access a share on a network computer from the redirected start menu. It's written using AutoIT3.

Nice!

Do you have the au3? I can compile it here and want to look at how it does it if possible.

[ninjabeaver]

Did this work. Got the same thing here now as well. Just gone down the redirected menus route.

 

Cheers.

[ZeroHour]

No reply with the Au3 so I am not prepared to run it until I know whats in the source.

Any ideas ninja?

[altecsole]

Sorry, I normally get an email when posts get updated but it didn't happen with this one.

 

Here is the .au3 file. It'll pop up a message box if you browse network shares from a redirected start menu. There is a WinKill option that is commented out. You can uncomment this to kill the browse window. Feel free to change or amend as required.

stopnetbrowse_461.zip

[kxv2020]

I am sure you can lock it down by "disabling browsing network" in the GPO ...something like that; because personally I would get annoyed as a user if I couldn't right click on something.

[altecsole]

I am sure you can lock it down by "disabling browsing network" in the GPO ...something like that; because personally I would get annoyed as a user if I couldn't right click on something.

 

Yeah, you'd think so, but I've not been able to find another way of stopping this.

[Uraken]

this can be stopped by using a custom adm that maps a drive letter to the share being used as the redirected area instead of unc path (its a known windows error). i have attached adm for you.

[Uraken]

except it didn't upload? umm heres the text save as redirect.adm and add to Active Directory

begin code*****

CLASS USER

 

CATEGORY !!START

 

 

 

KEYNAME !!ShellFolderRegPath

 

POLICY !!RedirectStartMenu

EXPLAIN !!Redirect_Explain

 

 

PART !!RedirectMessage EDITTEXT

DEFAULT !!DefaultRedirection

VALUENAME "Start Menu"

END PART

 

 

END POLICY

 

POLICY !!RedirectStartMenuProg

EXPLAIN !!Redirect_Explain

 

 

PART !!RedirectMessage EDITTEXT

DEFAULT !!DefaultRedirection

VALUENAME "Programs"

END PART

 

 

END POLICY

 

POLICY !!RedirectStartMenuStartup

EXPLAIN !!Redirect_Explain

 

 

PART !!RedirectMessage EDITTEXT

DEFAULT !!DefaultRedirection

VALUENAME "startup"

END PART

 

 

END POLICY

 

END CATEGORY

 

[strings]

START="Start Folder Redirection"

ShellFolderRegPath="Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"

 

 

RedirectStartMenu="Redirect Start Menu"

RedirectStartMenuStartup="Redirect Start Menu Startup"

RedirectStartMenuProg="Redirect Start Menu Programs"

Redirect_Explain= "Redirects the Start Menu folder"

 

DefaultRedirection = "c:\temp"

 

 

RedirectMessage="Start Menu Folder"

 

end code****

[RChilcott]

Hello Uraken

 

I've just been trying to implement your adm file and have imported it as a template, I can see the folder under Administrative Templates called Start Folder Redirection but there are no setting listed. Do i need to edit your adm file to reflect a mapped network drive location?

 

Also anyone else that may be following this post i downloaded altecsole StopNetBrowse.au3 file compiled to .exe. I found that it worked very well and indeed killed the explorer window as soon as i tried to browse the network share from the redirected start menu, however when i looked at the process in task manager i found that it was running at upto 45% Cpu usage. Does anyone know i might be able to reduce this?

 

Any help would be greatly appreciated this problem is really starting to get to me!!!!

 

Thanks

[Uraken]

rchilcott you need to go right click and choose view, filtering and take out the two ticks on only show things that can be fully managed, you will then be able to see the policy in all its glory.