faza Posted October 4, 2007 Posted October 4, 2007 Hi All, I wonder if anybody can help, pupils are accessing the servers and seeing the actually servers folders/files. When they login they are double clicking on the programs located on the start menu and accessing explorer. They keep pressing up one level until thery get to network neighbourhood, where they can select the domain thyey are on and see all work stations and servers. They can access the servers and see shared folders and folders. As you understand this is a serious issue has any of you got any ideas please. TIA Faza
Geoff Posted October 4, 2007 Posted October 4, 2007 It's only a serious issue if your NTFS permissions are setup wrong.
BKGarry Posted October 4, 2007 Posted October 4, 2007 Faza, This shouldn't be a majour problem IF the permission are set correctly on the shares. But also in GPO there is a no Somputers Near me and a no Entire Network etc etc under User Configuration>Windows Components>Windows Explorer Might be worth checking Also enabling the Classic Start Menu and Shell helps against these things
Geoff Posted October 4, 2007 Posted October 4, 2007 Installing Access based Enumeration on your W2k3 servers is also worth while.
maniac Posted October 4, 2007 Posted October 4, 2007 There is a registry change you can make which as soon as it sees the '\\' in a windows address bar it closes the window. All our student machines do this and it works well, but as it was over a year ago when I made the change, I really can't remember how I did it! I'll try and find out tomorrow, but some googling might help in the meantime. I remember it wasn't too hard, and involved adding a couple of extra registry settings to a group policy. Mike.
faza Posted October 4, 2007 Author Posted October 4, 2007 Is there anyone to stop them double clicking on the programs menu?
Geoff Posted October 4, 2007 Posted October 4, 2007 See this thread: http://www.edugeek.net/index.php?name=Forums&file=viewtopic&t=11001
faza Posted October 5, 2007 Author Posted October 5, 2007 I have locked down as much as i can as some of the shares they need. There is no way i can lock it down?
tech_guy Posted October 5, 2007 Posted October 5, 2007 There is a registry change you can make which as soon as it sees the '\\' in a windows address bar it closes the window. All our student machines do this and it works well, but as it was over a year ago when I made the change, I really can't remember how I did it! I'll try and find out tomorrow, but some googling might help in the meantime. I remember it wasn't too hard, and involved adding a couple of extra registry settings to a group policy. Mike. Hi Mike, Any joy with finding those reg tweaks? Would be much appreciated as this is something I'd like to close on my nw too! Darrell.
Geoff Posted October 5, 2007 Posted October 5, 2007 You can disable Netbios over TCP/IP in DHCP options too.
richardp Posted October 5, 2007 Posted October 5, 2007 Hi, You can do this through Active Directory Group Policy and making sure that your server shares are set with the correct permissons so even if they get to the network they can only access what they would access anyway. In group policy management you need to look at User Configuration/Administrative Templates/Windows Components/Windows Explorer. In there you can hide drive letters, computers near me, entire network etc... We also prevent them from running explorer.exe directly. You really should not have to play around with the registry or fiddle with netbios settings to achieve what you want to do. Richard
faza Posted October 5, 2007 Author Posted October 5, 2007 If you turn off the browser service, the pupil workstation will not be able to see the server to get things such as application and stuff.
faza Posted October 5, 2007 Author Posted October 5, 2007 richardp - How to you prevent puopils from accessing explorer.exe
BKGarry Posted October 5, 2007 Posted October 5, 2007 Erm.... i thought you couldn't it is the Shell after all
faza Posted October 5, 2007 Author Posted October 5, 2007 Its so hard just tio remove the servers from the list so pupils cant access them or see them.
mattx Posted October 5, 2007 Posted October 5, 2007 the pupil workstation will not be able to see the server to get things such as application and stuff. No they won't - it depends how you have setup the apps etc. You may have a problem with Net View - but who uses that ?
faza Posted October 5, 2007 Author Posted October 5, 2007 We have a serpate apps server and the shortcuts go to that server
richardp Posted October 5, 2007 Posted October 5, 2007 Hi, You need to go into group policy management and edit your top level policy. Go to User Configuration / Administrative Templates / System. In the top level of System there is an option called "Don't run specified Windows applications". You need to enable this and add "explorer.exe" to the list of disallowed applications (by clicking on properties on the above item). This stops a user from launching any program in that list but does not prevent the system process from doing so. Which obviously allows the shell to run correctly. This is not perfect but if you do this as well as prevent access as I mentioned earlier it should stop them from doing what you have described. Richard
faza Posted October 8, 2007 Author Posted October 8, 2007 richardp - When a user double clicks on programs explorer still opens.
richardp Posted October 9, 2007 Posted October 9, 2007 Hello again, it sounds to me like you have not enabled the other relevant group policy options. As BKGarry said before you cannot completely block the explorer process as it is the shell for windows and is required. I have gone through our top level default group policy and picked out what I think are all the relevant options you need to look at : User Configuration \ Administrative Templates \ Windows Components \ Windows Explorer Removes the Folder Options menu item from the tools menu - ENABLED Remove File menu from windows explorer - ENABLED Remove "Map Network Drive" and "Disconnect Network Drive" - ENABLED Remove Search button from windows explorer - ENABLED Hides the manage item on the windows explorer context menu - ENABLED Hide these specified drives in My Computer - Restrict C drive only - ENABLED No "Computers Near Me" in My Network Places - ENABLED No "Entire Network" in My Network Places - ENABLED User Configuration \ Administrative Templates \ Start Menu and Taskbar Remove My Documents icon from the Start Menu - ENABLED Remove Documents menu from Start Menu - ENABLED Remove Network Connections from Start Menu - ENABLED Remove Search menu from Start Menu - ENABLED Remove Run menu from Start Menu - ENABLED Remove Drag and Drop context menus on the Start Menu - ENABLED Prevent changes to Taskbar and Start Menu settings - ENABLED Remove access to the context menus for the taskbar - ENABLED Do not use the search based method when resolving shell shortcuts - ENABLED Do not use the tracking based method when resolving shell shortcuts - ENABLED User Configuration \ Administrative Templates \ Desktop Remove My Documents icon on the desktop - ENABLED Remove properties from the My Computer context menu - ENABLED Hide My Network Places icon on desktop - ENABLED Prohibit user from changing my documents path - ENABLED Don't save settings at exit - ENABLED User Configuration \ Administrative Templates \ Network \ Network Connections Prohibit access to the New Connection Wizard - ENABLED User Configuration \ Administrative Templates \ System Prevent access to the command prompt - ENABLED Prevent access to registry editing tools - ENABLED Don't run specified Windows applications - ENABLED - explorer.exe By enabling the above options my users are unable to access the network apart from through server shares mapped to drive letters in the main vb login script. Even if they do as you describe they can never get to a point where they can see the network or any icons for it. Even if they run my computer and type in a network path (such as \\servername\sharename) it returns an error message. Again you should also be looking at your share permissions at the same time so if they do somehow manage to get to the network they will be unable to access any shares that they should not have access to anyway. I hope some of this helps, I am no expert with AD but it seems to work for me! Richard
techy32 Posted July 6, 2009 Posted July 6, 2009 richardp - When a user double clicks on programs explorer still opens. We have the same problem at our school which I have just noticed today. Are the group policies given by richard work or not? Are the students still accessing the server shares? Thanks, Shoaib
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now