Oaktech Posted April 25, 2017 Posted April 25, 2017 Ok, I've got a quandry here. I want to use a redirected start menu, and it works OK except for one thing. If you right click on a redirected item go -> more -> open file location, it serves up the whole file share in explorer. The students can't go anywhere or do anything because ABE is on, and they only have read access, but it's still annoying. If I remove the redirection and point it back to local, right click -> more -> open file location brings up the expected 'this action has been cancelled due to restriction in effect'. Am I missing something?
ccx9010 Posted April 26, 2017 Posted April 26, 2017 Following, as I'm still after solution. Have posted on Spiceworks to no avail yet
3s-gtech Posted April 26, 2017 Posted April 26, 2017 Yup, same issue here. I just love finding these little nuggets, it's like a treasure hunt!
Oaktech Posted April 26, 2017 Author Posted April 26, 2017 Yup, same issue here. I just love finding these little nuggets, it's like a treasure hunt! It really is isn't it... Moving on from the right click open file location have you discovered that if you click the network breadcrumb in the redirected start menu explorer window location the little darlings can do an AD search unless you set a GPO at User policy -> admin templates -> desktop active directory -> maximum size of active directory searches ->0
3s-gtech Posted April 26, 2017 Posted April 26, 2017 If you set the size at 0, does that stop them from searching for printers in the directory? I'm not sure I'm seeing the exact same thing - if I click on Network I get the usual devices that show up - a couple of NASs and printers. What are you clicking to get the AD search? Oh - for the Start Menu I have just hidden the root folders in the sysvol, then removed the capability of turning on hidden files. Then I've secured some of the folders within the sysvol with NTFS. I know that's obscurity rather than security (they may guess the next path name) but it helps.
Oaktech Posted April 26, 2017 Author Posted April 26, 2017 (edited) If you set the size at 0, does that stop them from searching for printers in the directory? I'm not sure I'm seeing the exact same thing - if I click on Network I get the usual devices that show up - a couple of NASs and printers. What are you clicking to get the AD search? I've got a button... Hitting find now returns 0 results. it doesn't stop them hitting the add devices button, but they can't add anything because a change requires admin credentials. For some reason it won't let me upload the next 2 pics. Edited April 26, 2017 by Oaktech
3s-gtech Posted April 27, 2017 Posted April 27, 2017 When I click that, I'm pretty restricted on what I can do as a student. I can see the NASs etc mentioned before, which are locked down. I can't do a search. The Network icon doesn't appear on the left in the Navigation Pane. I can't access Properties or the Network and Sharing Centre. With the folders in the redirected folders path hidden, I'm fairly happy that the students can't access or see anything I don't want them to. I can try to help if you want to lock it down a bit more.
Oaktech Posted April 27, 2017 Author Posted April 27, 2017 Ah, I've got a GPO setting to prevent network browsing at all... Big error message pops up to say so... The things I'm on about is this...
3s-gtech Posted April 27, 2017 Posted April 27, 2017 Ooh that is sneaky. Nope, that's wide open here and I can't set the search size to 0 as that stuffs up searching for printers! I'll keep at it.
3s-gtech Posted April 27, 2017 Posted April 27, 2017 Right, I'm currently playing with Classic Shell which enables me to disabled the breadcrumbs - that stops this dead. However, the breadcrumbs are rather useful really, and I'm not a fan of add-ons (I stopped using Classic Start once we got to later versions of 1607). Still, progress. 1
3s-gtech Posted April 28, 2017 Posted April 28, 2017 Okay @Oaktech and @ccx9010 , I've done it and it's easy, thankfully. After several dead ends, I had a brainwave. I currently have a registry setting which removes the Hidden Item checkbox from the Ribbon Bar. I expanded on this, from here Server 2012/Windows 8 – Ribbon UI: Disable Icons, Buttons, Shortcuts, Tasks, and Commands | Paper Street Online If you simply delete the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.SearchActiveDirectory , the button disappears. To delete the key, you'll need to take Ownership of it from TrustedInstaller, change the permissions, then delete it. You can do this with GP - I'm just playing with this now but it'll be under Computer Configuration/Preferences/Registry and a Delete item, alongside a Security Setting to take ownership. Obviously, the button will go for all users. I can't see this being a problem. The Find Printers dialog works fine still. 1
3s-gtech Posted April 28, 2017 Posted April 28, 2017 Really? I've double and triple checked - can you make sure you've followed every step? What version of Windows 10? Any chance of a screenshot of that key in regedit?
ccx9010 Posted April 28, 2017 Posted April 28, 2017 10 Edu x64 1607. I'll re-install from fresh and go through it all again on Monday- Might be this machine being stupid...
3s-gtech Posted April 28, 2017 Posted April 28, 2017 I've only tested on 1703, though this setting existed back in Windows 8/Server 2012. I'll see what I can do to help with it then.
ccx9010 Posted April 28, 2017 Posted April 28, 2017 To be fair, I can't even get my start menu to open on 1703 right now. If this works on 1703 I'll give it a try next week!
3s-gtech Posted April 28, 2017 Posted April 28, 2017 I've tried my GPO that I built from this on a second PC to test - after tweaking the permissions settings so that ownership changes worked, the key was successfully deleted automatically.
Oaktech Posted April 28, 2017 Author Posted April 28, 2017 Okay @Oaktech and @ccx9010 , I've done it and it's easy, thankfully. After several dead ends, I had a brainwave. I currently have a registry setting which removes the Hidden Item checkbox from the Ribbon Bar. I expanded on this, from here Server 2012/Windows 8 – Ribbon UI: Disable Icons, Buttons, Shortcuts, Tasks, and Commands | Paper Street Online If you simply delete the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.SearchActiveDirectory , the button disappears. To delete the key, you'll need to take Ownership of it from TrustedInstaller, change the permissions, then delete it. You can do this with GP - I'm just playing with this now but it'll be under Computer Configuration/Preferences/Registry and a Delete item, alongside a Security Setting to take ownership. Obviously, the button will go for all users. I can't see this being a problem. The Find Printers dialog works fine still. What user are you setting as owner/full access?
3s-gtech Posted April 28, 2017 Posted April 28, 2017 (edited) Everyone as Owner, then SYSTEM, domain admin and Creator Owner have Full Access. As the key will be deleted, this 'insecure' setting only matters extremely briefly as the key then gets deleted entirely. Edited April 28, 2017 by 3s-gtech
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now