Downloads Folder - Allowing access to other users documents

[vortex999]

Hey all bit of a strange one this, basically students have figured out that they can access other students documents and edit them !!!

 

The Method:

Open Computer

Click on downloads in the navigation Pane

The full server path comes up in the location bar ( \\server\student\Year\username\downloads\)

They can then click on the year group and are then able to access and edit anything.

 

 

This is extremely worrying, despite file security not allowing them access, for example they cannot enter the location manually > denied.

 

The only reason I have found this to work is down to a security group which allows a handful of staff to modify students work(A SLT Idea). If I remove this security group form their share it no longer works.

 

Now the easiest solution I can see is to just Hide the downloads link in the left hand nav pane, however I am having some trouble rolling this out via GPO. This is because the registry value requires a permission change before it can be edited .

 

 

Anybody else faced something like this before?

 

Anybody know a simple way to hide the Favorites link from the Nav pane?

 

I have managed to get this working with local registry changed but I am unable to get it working on mass.

 

 

Thank you.

Edited January 15, 2014 by vortex999

[vortex999]

Anybody got an clue?

 

I thought I would have some success with deleting the file directly from the mandatory profile, however that doesn't seem to work.

[john]

You can roll reg changes out via GPO would that not help you?

 

As for your issue if its students you must have some permissions wrong somewhere, the group you say is causing this if it just has staff in it makes little sense if its students doing it unless the student has got in the staff group ?

[Michael]

If that's the case I would urgently review your NTFS permissions. User A trying to access User B's documents (even entering the path correctly), should be denied access. Even better, if home directories or important shares are made hidden, it makes entering the correct path a lot more difficult.

[vortex999]

Having played with this all morning, I think I have now cracked it!

 

I seemed to have the "Everyone" permission added to student shares. Although this only had read access ?:/, removing it now makes the correct access denied dialog box appear. Is this correct?

 

 

 

If that's the case I would urgently review your NTFS permissions. User A trying to access User B's documents (even entering the path correctly), should be denied access. Even better, if home directories or important shares are made hidden, it makes entering the correct path a lot more difficult.

 

That was the strange part if I clicked on downloads to make the Path appear and then copy that path and paste it into another explorer window it would say access denied as its uses the server share.

 

I think its something to do with the "Network" path beign at the start.

[Michael]

It sounds like you've solved it The Access Denied is the message you should expect to see

[Garacesh]

It might be worth denying Student accounts the ability to navigate to network locations.

We map student areas to M:/ (which is admittedly \\fileserver\kids\year\name) but if they typed their path in instead of M:/ they'd get a 'disabled due to restrictions by the administrator' (I think) message.

Same with things like shared printers. They can see \\printserver\printer but if they tried to browse to it (either \\printserver or the actual printer), again, denied.

Edited January 15, 2014 by Garacesh