Allowing Users to Selected C:\ Drive Paths only... Via GPO

[jdell]

Hi All,

 

I am running a 2012 R2 domain, with Windows 7/8.1 Clients. I am currently hitting issues with a few packages. This is most likely because we block the users from getting to the C drive via GPO, this was to prevent issues we had previously seen.

 

What I am after is a way that we can stop access to the C drive in general but allow access to selected paths. ie C:\Program Files\SoftwarePackage1\

 

I must mention that this need to be done by GPO because we have 2000 client, so I am not doing this manually.

 

Any help would be great.

 

Cheers.

[woreilly]

Computer Config > Policies > Windows Settings > Security Settings > File System > Add File

 

Type path to folder and press OK, then you can apply NTFS permissions the same way you would on any normal folder

[tmcd35]

Rather than block any access to the C: drive, a better approach is to hide the C: drive and disable any routes to finding it. This can all be done through GPOs (sorry not looking through the GPO at the moment). But basically disabling things like Start Menu->Run, CTRL+R, Command Prompt, etc and hiding the C: drive so it doesn't appear as a selectable drive in My Computer.

 

This way all programs can see and access the C: drive as normal with out any interference from UAC, etc.

[zebwainwright]

Ok, I posted something similar to this already, but didn't get many responses. We can hide all the drives and prevent them from getting getting there using most methods, but the problem is if they open a program like paint, they can save as and it lets them type in c:\ and then they can create new folders and files on the root of the C: If I could find a way to prevent write access to the root without messing stuff up then I would be all for it. Either that or have a script that deletes every file and folder except the ones that are there when the computer is imaged (windows files etc.)

 

Any thoughts on how to do this??