Edge Allows access to C: drive

[StevieM]

I am in the process of configuring a W10 image suitable for use by teachers and students. I have locked it down so that they are unable to browse the C: drive, through File Explorer or Internet Explorer. However, I have discovered that Edge allows all users to access the C: drive using the http://file:/// prefix. They are unable to add, delete or modify files, but they do have free access to navigate around the OS files and open them. I even managed to open a PowerShell session.

 

Could a few others test this and see if it's just something I've done wrong? This could have major security implications if it isn't.

[mavhc]

Why would that be a major security implication?

[StevieM]

Personally, I wouldn't be happy allowing anyone near system batch files or PowerShell or the Registry Editor. There have also been discussions on here about people disabling UAC

 

It seems pointless having group policies to prevent users accessing certain areas of a system if a core element of the OS provides access via the backdoor.

[Guest obsidianpillar]

Personally, I wouldn't be happy allowing anyone near system batch files or PowerShell or the Registry Editor. There have also been discussions on here about people disabling UAC

 

It seems pointless having group policies to prevent users accessing certain areas of a system if a core element of the OS provides access via the backdoor.

 

I'm talking Windows 7/8 era policies here, but isn't there one designed to "Prevent access to...." instead of "Hide these specified drives..." won't that "block" the users from accessing the drive? You didn't explicitly mention the one you are using, so I am assuming it is the "prevent" one?

 

I haven't yet tested Windows 10, so apologies if the above is no use.

 

Hope this helps.

 

Tom

[dry]

Why would that be a major security implication?

Hmm, bit of a funny statement! Would you be happy leaving PowerShell accessible to all users on your network?

 

OP: Do you use AppLocker? Could you block access to Edge completely?

[Michael]

Could you block access to Edge completely?

 

On newer versions of Win 10 (Redstone), Edge is greatly improved, but also acts as the default PDF viewer. This of course removes the need for a third party solution from Adobe or other, but also as part of Microsoft patch cycles, Edge updates are also included.

 

It makes more sense to leave Edge enabled rather than disabled. Access to C:\ be it in 'read mode' shouldn't be a problem and access to Powershell.exe can easily be restricted using Group Policy/Software Restriction Policy.

 

As far as I'm aware there's isn't a traditional/native Group Policy for Powershell as there is the Command Prompt, but I might be wrong on this!

[StevieM]

I'm talking Windows 7/8 era policies here, but isn't there one designed to "Prevent access to...." instead of "Hide these specified drives..." won't that "block" the users from accessing the drive? You didn't explicitly mention the one you are using, so I am assuming it is the "prevent" one?

 

I haven't yet tested Windows 10, so apologies if the above is no use.

 

Hope this helps.

 

Tom

I'm currently using the 'Hide specified drives' policy restricting drive c only. I'm sure we had issues with software not working properly in the past when we used the Prevent Access to C.

 

It's a bit worrying to me that when I try to access c: from file manager or IE, I get the pop-up message 'Accessing the resource c: has been disallowed', but when I do it in Edge a new File Explorer window opens with the whole drive available.

@dry - I'm not using AppLocker at the moment but it comes to something when you have to consider blocking a core app in order to make the system more secure.

[Guest obsidianpillar]

On newer versions of Win 10 (Redstone), Edge is greatly improved, but also acts as the default PDF viewer. This of course removes the need for a third party solution from Adobe or other, but also as part of Microsoft patch cycles, Edge updates are also included.

 

It makes more sense to leave Edge enabled rather than disabled. Access to C:\ be it in 'read mode' shouldn't be a problem and access to Powershell.exe can easily be restricted using Group Policy/Software Restriction Policy.

 

As far as I'm aware there's isn't a traditional/native Group Policy for Powershell as there is the Command Prompt, but I might be wrong on this!

 

I don't believe there is a native Group Policy to mange Powershell. We disabled Powershell by using a SRP and have had no problems/issues with doing so.

 

In regards to the "read mode", granted there is no problems with doing this. If users can't see it (i.e the drive is hidden) then there should be no issue with disabling access full stop. In concept, if you redirect all folders to the users' Home Drive, it has helped with users being "forced" to save to their drive, rather than anything locally which gets removed when the profile is offloaded in our case.

[Guest obsidianpillar]

I'm currently using the 'Hide specified drives' policy restricting drive c only. I'm sure we had issues with software not working properly in the past when we used the Prevent Access to C.

 

It's a bit worrying to me that when I try to access c: from file manager or IE, I get the pop-up message 'Accessing the resource c: has been disallowed', but when I do it in Edge a new File Explorer window opens with the whole drive available.

@dry - I'm not using AppLocker at the moment but it comes to something when you have to consider blocking a core app in order to make the system more secure.

 

I can't comment on your specific use case with your environment. I remember SIMS did require some access to C:\ to do some stuff historically. I'm not sure if this is the case now? You could use the "hide" policy for Staff, and "restrict" for Students? I don't know your software inventory, but may be useful to do some testing before you decide.

[Michael]

In regards to the "read mode", granted there is no problems with doing this. If users can't see it (i.e the drive is hidden) then there should be no issue with disabling access full stop. In concept, if you redirect all folders to the users' Home Drive, it has helped with users being "forced" to save to their drive, rather than anything locally which gets removed when the profile is offloaded in our case.

 

Yep I agree 100% as I apply the same rules/policies.

[mavhc]

Hmm, bit of a funny statement! Would you be happy leaving PowerShell accessible to all users on your network?

 

Yes, they're here to learn programming amongst other things, can't do that without a shell very easily. What bad things are they going to do with it?

[StevieM]

I've also been able to use the file protocol to navigate to a network folder that the user doesn't have permission to access any other way than through Edge.

[mavhc]

Remove the traverse folder/read folder permission?

[Michael]

I've just tried it myself and I can navigate C:\ in Edge however if I tried to create a folder I'm asked for admin credentials.

 

Although not perfect, I don't consider it a security risk. It's just the way Microsoft have designed Edge, but as I said above, leaving it enabled outweighs it being disabled in my opinion.

[angrycomputingteacher]

This works in Chrome too

[StevieM]

Remove the traverse folder/read folder permission?

Yes. It looks like I'm going to have to reconfigure permissions on all shared folders that need restricted access.

 

The annoying thing is that these permissions have been in place for years (since before I ever started working here) and the same folders have never been accessible before. File Explorer and Internet Explorer both show the error message "Accessing the [%] resource has been disallowed" when I try to access them using the file:// protocol. It's only Edge* that allows access to them on our system. (*We don't have any browsers other than IE and Edge installed currently.)

[mavhc]

Well, they have been accessible, just a bit harder to find. Would work with any programming language.