Shortcuts giving student access to restricted drives

[Theldron]

We have recently been having an issue where by students have worked out that by going New - Shortcut they can access our public drive which gives them access to the networked programs, even though if they try to access it normally through windows explorer it gives them a restricted error.

 

Has anybody else had this issue and how have you resolved it?

 

I have prevented the creation of new shortcuts through a registry change and have tried to disable lnk files being run in home drives and usb sticks using the software restriction policy which hasn't worked (thanks Microsoft - another success). I just want to stop existing shortcuts being run.

 

Help!

[Duke5A]

It sounds like you're going about this the wrong way; you're trying to disable student's ability to browse rather than setting permissions correctly on those shared resources. You need to disable read to that share for all students.

[Theldron]

Hi Duke5A, i have tried that but when I disable read, they can't access the software.

[network41]

Disable right-click via GPO for all students

[cromertech]

Hide all of the folders/shortcuts so it will just appear empty but the shorcuts will still run.

I'm a bit confused as to why it's a problem for them to browse there if they are allowed to run the applications anyway?

[Theldron]

Hi Network41, I have done that now, and i have prevented them creating new shortcuts, but my only concern is if they have an existing shortcut on a memory stick. I have hidden everything in that drive with the idea that they can mess with what they can't see.

[simpsonj]

What happens if you deny traverse permissions rather than read permissions?

[Theldron]

Cromertech - As a few pieces of software requires them to write to the program for example reading tests and so they can do some damage.

 

SimpsonJ - Traverse combined with execute, so if i deny that I deny them the ability to run the programs.

[SovietRussia]

Disable right-click via GPO for all students

 

File > New > Shortcut

 

(Or if no toolbar, Alt > File > New > Shortcut)

Edited December 2, 2013 by SovietRussia

[Theldron]

Its ok, I deleted the registry entry to create new shortcuts via a batch file. Not ideal I know, but as a temp fix it works, so it doesn't appear on right click or on File > New either

[simpsonj]

Have you disabled Right Click - Send To - Desktop (Create shortcut)?

 

Face palm about traverse, should have seen that! Can you make the entire share a hidden share? Not many students know to add the dollar sign at the end...

[Theldron]

I have disabled the desktop so that they can't send anything to it full stop!! Thats ok, I have tried everything. With regards to hiding, they were able to create a shortcut put a drive letter in, don't ask me how they found out they must have tried every one e.g. P:\ and it fills in the rest for them and creates the shortcut to the drive.

[simpsonj]

Just ensure that it doesn't say something along the lines of 'Desktop is unavailable, would you like to make the shortcut here instead?'

 

I've had similar issues with students accessing the C: drive using this method...