Windows 7 Explorer Restrictions or similar setup to new shell.

[surendra5254]

Hi All,

 

We have requirement from our management to block network browsing from windows explorer.exe. We have tried all the options and found the loopholes. Our requirement is very simple. People should have no access to any network path or storage or the network storage unc path (\\storageserver ). Only the specific applications should have access to the storage in user mode. For example Notepad.exe which we can able to open files through notepad open option.

 

We have tried below options in group policy object but it didn't given more flexibility to block the complete browsing access to the network shared folders.

 

Tried the following options.

 

1) We have hide the drives in group policy

2) We have switch off the network discovery settings in control panel.

3) We have created $ share (\\server\share$ path in the NAS storage) folder.

4) We have removed Network icon from the Desktop using group policy.

5) We have restricted access to Run command.

 

In spite of the above, in the third option people may get to know the path and trying to use the unc path in windows explorer address bar (\\server\share$).

 

We are trying to setup our own shell in windows using the code of some opensource windows shells in the internet. But it needs lot of coding and time efforts.

 

Please suggest if anybody knows how to hide address bar in the windows explorer. So that, we can accomplish the complete setup required for this project.

 

Best Regards, Surendra

[Davit2005]

Isn't hide the run menu the solution to this via GPO, i.e.

 

Remove Run menu from Start Menu - Enabled

[surendra5254]

We can able to hide the run menu. But users are trying to access the network storage via windows explorer address bar using UNC path.

[ITGuyWestMidlands]

The above should restrict that for you also

[surendra5254]

Run menu helped me to restrict the access to UNC path. Could you please help me out to remove network icon from windows explorer using GPO.

[linkazoid]

Try some of the suggestions here - http://www.edugeek.net/forums/windows-7/75114-disable-network-icon-windows-explorer-via-gpo.html

[surendra5254]

One more last suggestion is need. We have to prevent access to mapped network drives from window explorer only. The all other app should have access to mapped network drive. The reason is to block browsing from windows explorer and use our own tool to browse the folders.

[Rob_D]

There are GPOs to hide mapped drives, and If you map the drive then the UNC path is hidden, but I'm not sure if they'd be able to get into it by typing the drive path into the explorer address bar. Also, I don't know if you program would be able to "find" a hidden drive.

You may also run into problems with other (especially MS) products having problems opening files they can't "see".

[surendra5254]

I have restricted almost we want. But only one thing is pending is file open / save dialog box.

 

For example: I open the notepad, and try to save a new document if I write in the "File Name" field: "D:" (D: drive is hidden) I can see the D: drive.

 

It is possible to prohibit the user to access the D: drive when writing in the "File Name" field?

[surendra5254]

If anyone know how to block it. Please let me know. We are almost there to complete everything. Only the browsing from Notepad or any app file open dialog box is pending to block.

 

Thank you for the help and support who are helped me to achieve this till now.

[Davit2005]

If you want to block access to removable drives can you use another method at all.

 

It is possible to hide a drive and still allow an application access to it. I used to do that at previous place because some software wouldn't work with UNC paths.

Edited August 27, 2015 by Davit2005

[surendra5254]

I am looking to block the UNC access from the file dialog box window. Users are use to type the UNC path in filename section in the Windows file dialog box. Please find the attached screenshot.