Removing right click - open file location when using a redirected start menu

[Oaktech]

Ok, I've got a quandry here. I want to use a redirected start menu, and it works OK except for one thing.

 

If you right click on a redirected item go -> more -> open file location, it serves up the whole file share in explorer. The students can't go anywhere or do anything because ABE is on, and they only have read access, but it's still annoying.

 

If I remove the redirection and point it back to local, right click -> more -> open file location brings up the expected 'this action has been cancelled due to restriction in effect'.

 

Am I missing something?

[ccx9010]

Following, as I'm still after solution. Have posted on Spiceworks to no avail yet

[3s-gtech]

Yup, same issue here. I just love finding these little nuggets, it's like a treasure hunt!

[Oaktech]

Yup, same issue here. I just love finding these little nuggets, it's like a treasure hunt!

 

It really is isn't it...

 

Moving on from the right click open file location have you discovered that if you click the network breadcrumb in the redirected start menu explorer window location the little darlings can do an AD search unless you set a GPO at User policy -> admin templates -> desktop active directory -> maximum size of active directory searches ->0

[3s-gtech]

If you set the size at 0, does that stop them from searching for printers in the directory? I'm not sure I'm seeing the exact same thing - if I click on Network I get the usual devices that show up - a couple of NASs and printers. What are you clicking to get the AD search?

 

Oh - for the Start Menu I have just hidden the root folders in the sysvol, then removed the capability of turning on hidden files. Then I've secured some of the folders within the sysvol with NTFS. I know that's obscurity rather than security (they may guess the next path name) but it helps.

[Oaktech]

If you set the size at 0, does that stop them from searching for printers in the directory? I'm not sure I'm seeing the exact same thing - if I click on Network I get the usual devices that show up - a couple of NASs and printers. What are you clicking to get the AD search?

 

I've got a button... Hitting find now returns 0 results.

 

it doesn't stop them hitting the add devices button, but they can't add anything because a change requires admin credentials.

 

For some reason it won't let me upload the next 2 pics.

Edited April 26, 2017 by Oaktech

[3s-gtech]

When I click that, I'm pretty restricted on what I can do as a student. I can see the NASs etc mentioned before, which are locked down. I can't do a search. The Network icon doesn't appear on the left in the Navigation Pane. I can't access Properties or the Network and Sharing Centre. With the folders in the redirected folders path hidden, I'm fairly happy that the students can't access or see anything I don't want them to. I can try to help if you want to lock it down a bit more.

 

[Oaktech]

Ah, I've got a GPO setting to prevent network browsing at all... Big error message pops up to say so...

 

 

The things I'm on about is this...

 

[3s-gtech]

Ooh that is sneaky. Nope, that's wide open here and I can't set the search size to 0 as that stuffs up searching for printers! I'll keep at it.

[3s-gtech]

Right, I'm currently playing with Classic Shell which enables me to disabled the breadcrumbs - that stops this dead. However, the breadcrumbs are rather useful really, and I'm not a fan of add-ons (I stopped using Classic Start once we got to later versions of 1607). Still, progress.

[3s-gtech]

Okay @Oaktech and @ccx9010 , I've done it and it's easy, thankfully. After several dead ends, I had a brainwave.

 

I currently have a registry setting which removes the Hidden Item checkbox from the Ribbon Bar. I expanded on this, from here Server 2012/Windows 8 – Ribbon UI: Disable Icons, Buttons, Shortcuts, Tasks, and Commands | Paper Street Online

 

If you simply delete the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.SearchActiveDirectory , the button disappears. To delete the key, you'll need to take Ownership of it from TrustedInstaller, change the permissions, then delete it. You can do this with GP - I'm just playing with this now but it'll be under Computer Configuration/Preferences/Registry and a Delete item, alongside a Security Setting to take ownership.

 

Obviously, the button will go for all users. I can't see this being a problem. The Find Printers dialog works fine still.

[ccx9010]

Hmmm, that didn't work for me.

[3s-gtech]

Really? I've double and triple checked - can you make sure you've followed every step? What version of Windows 10? Any chance of a screenshot of that key in regedit?

[ccx9010]

10 Edu x64 1607. I'll re-install from fresh and go through it all again on Monday- Might be this machine being stupid...

[3s-gtech]

I've only tested on 1703, though this setting existed back in Windows 8/Server 2012. I'll see what I can do to help with it then.

[ccx9010]

To be fair, I can't even get my start menu to open on 1703 right now. If this works on 1703 I'll give it a try next week!

[3s-gtech]

I've tried my GPO that I built from this on a second PC to test - after tweaking the permissions settings so that ownership changes worked, the key was successfully deleted automatically.

[Oaktech]

Okay @Oaktech and @ccx9010 , I've done it and it's easy, thankfully. After several dead ends, I had a brainwave.

 

I currently have a registry setting which removes the Hidden Item checkbox from the Ribbon Bar. I expanded on this, from here Server 2012/Windows 8 – Ribbon UI: Disable Icons, Buttons, Shortcuts, Tasks, and Commands | Paper Street Online

 

If you simply delete the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.SearchActiveDirectory , the button disappears. To delete the key, you'll need to take Ownership of it from TrustedInstaller, change the permissions, then delete it. You can do this with GP - I'm just playing with this now but it'll be under Computer Configuration/Preferences/Registry and a Delete item, alongside a Security Setting to take ownership.

 

Obviously, the button will go for all users. I can't see this being a problem. The Find Printers dialog works fine still.

 

What user are you setting as owner/full access?

[3s-gtech]

Everyone as Owner, then SYSTEM, domain admin and Creator Owner have Full Access. As the key will be deleted, this 'insecure' setting only matters extremely briefly as the key then gets deleted entirely. Edited April 28, 2017 by 3s-gtech