Network computers, including the serve, visible to users on W7 clients.

[loci]

Hello everyone,

 

I have been searching for a solution to this problem but have hit a brick wall and would appreciate your advice please.

 

Clients logging in to their Windows 7 workstations are able to see the 'Network' Icon and view all other computers on the domain, including the DC. Clicking on a computer listed allows them to view and access the shares on those computers, even the DC (sysvol, netlogon, users etc). I have trawled through GPO's trying to find the relevent settings to remove the Network Icon and prevent users accessing other computers but with no luck. Please could you advise, Thanks

[psydii]

IMO Hiding them adds nothing of value. Kids will always bring in their own devices to scan the network - just because you've locked down the UI on your managed desktops does not make you secure.

 

Security is provided through usernames/passwords, group membership, NTFS ACL, Share Permissions (set in that order)

 

If you've got SQL instances on your lan make sure they are up to date (i.e all Service Packs, Cumulative Updates and Security Updates).

 

If applications require new shares etc always check the permissions granted don't open up more access than is required.

 

Apologies if your reason for wanting to do this is not security related.

[free780]

There is a reg key. You need to ban exes/scripts on pen drives and home drives to prevent scanning. Quite right about ntfs and share permissions being correctly set.

[loci]

It is predominantly security related because I obviously want to prevent any unexpected 'meddling' by users. The share permissions, NTFS security etc on the sysvol, netlogon folders are defaults set when the server was installed so I'm assuming that those are correct. As for the shares I have created I followed best practice regarding sharing 'Everyone' Group and so on. When logged in users can access only the shares I expect (their Home Folder, Student Shared Folder) and no others so I think that is Okay.

 

The Network Icon, however, still allows them to view and access computers~folders that the shouldn't. I will re-check permissions and security and try again.

 

Thanks for your help Guys.

[SYNACK]

I'd just worry about the perms, if they are right they should not be able to change anything they are not allowed to, also make sure the network discovery feature is off on the server and the clients as that is a security Rick and probably the reason they are showing up in network places to start with.

[Ephelyon]

From experience, the more worrying thing about the Network window is the exposure of the Search Active Directory button. You can't hide this but you can set a GPO setting to always limit the number of search results returned to 0, rendering its use as a nosey-parker's tools effectively null and void.

[MordyT]

From experience, the more worrying thing about the Network window is the exposure of the Search Active Directory button. You can't hide this but you can set a GPO setting to always limit the number of search results returned to 0, rendering its use as a nosey-parker's tools effectively null and void.

 

Where is the GPO to set results to 0

[Ephelyon]

Under User Configuration:

 

Administrative Templates > Desktop > Active Directory > Maximum size of Active Directory searches

 

Enable and set to 0.

[loci]

I think the perms are fine as they cannot edit anything in there. I will, however, add a reg entry to hide the icon anyway. Network discovery is off on the server and now off on the clients, with firewall exceptions for services that are required. I will update the Search Active Directory button GPO too!

 

Thanks for your time and advice.

[MYK-IT]

Remove Network Icon (via Registry)

 

Hive HKEY_LOCAL_MACHINE

Key path SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum

Value name {F02C1A0D-BE21-4350-88B0-7367FC96EF3C}

Value type REG_DWORD

Value data 0x1 (1)