%appdata% Woes

[chrisjako]

Just found out if a student types %appdata% in the windows 10 search menu they are then able to traverse into the file server and view other students files

 

We had this disabled in file explorer in windows 7 and stopped them from accessing it

 

can anyone advise on how to lock it down on the search menu please?

Edited July 18, 2018 by chrisjako

[Oaktech]

What version of 10 is this? I don't get that behaviour - I get the good old "This operation has been cancelled due to restrictions in effect on this computer" message?

[chrisjako]

What version of 10 is this? I don't get that behaviour - I get the good old "This operation has been cancelled due to restrictions in effect on this computer" message?

 

Version 1709

 

 

See how its allowed me to access the network location in the background window?

 

if i put %appdata% into the file explorer window they are unable to browse and get this message

 

[Oaktech]

I'm mainly 1703, but I've just tried it on 1709 and I still have the restricted behaviour. I'll have a look and see if I can see what setting is doing it!

[Oaktech]

I'm not finding a setting that seems to control this... I wonder if it's because I don't redirect my appdata to the network, it's local here and is therefore caught by the 'restrict access to C drive' policy. I've found all manner of weirdness redirecting appdata so I stopped doing it.

 

Are they all redirected to the same appdata folder?

[psydii]

If they can see files of other users you have a problem in your NTFS permissions.

 

Also: Redirecting AppData will cause problems/break if you try to introduce wireless windows devices. There isn't a huge amount to be gained by having it on a network share these days. (IMO)

[chrisjako]

Yes thats probably why you cant replicate it - I redirect appdata to their network home drive since we found issues with some apps redirecting to the restricted c drive policy

 

Out of interested though try %homeshare% and see if they can traverse back like that too

[chrisjako]

If they can see files of other users you have a problem in your NTFS permissions.

 

Also: Redirecting AppData will cause problems/break if you try to introduce wireless windows devices. There isn't a huge amount to be gained by having it on a network share these days. (IMO)

 

We don't use windows wireless devices, nor can I see us doing so in the near future

 

I was having issues multiple issues with various adobe CC, the only solution I could get working was to redirect appdata to homedrives

 

But yes you are correct about NTFS permissions - inherited permissions allowed authenticated users read access - when I started this post I disabled inheritance and removed this group from our students home drive share, a few hours in its only 200 folders in from the 2000 it has left to do

 

I am hoping when it is finished Access Based Enumeration will kick in and prevent access to other students folders

 

However I would further like to lock down file explorer by disallowing common %% UNC paths from being accessed via the windows 10 search menu

[3s-gtech]

If they can traverse other users' home folders via the redirected AppData, then your NTFS permissions on those folders are insecure. It simply won't traverse them otherwise. I suspect you have something like Authenticated Users as a permissions group on your home directory root, with Inheritance turned on for the sub folders.

[psydii]

We don't use windows wireless devices, nor can I see us doing so in the near future

 

However I would further like to lock down file explorer by disallowing common %% UNC paths from being accessed via the windows 10 search menu

 

I find that first assertion surprising, but you know your site better than I.

 

On the second point: NTFS and ABE should be sufficient. What benefit is gained by making File Explorer and Search slightly broken?

[Mustang]

As you have found out there is clearly something wrong with how you had your ACLs configured. Have you checked your staff users shares and shared areas too? chances are if one was configured wrong then others might be as well.

 

Also redirecting Appdata to your network storage is definitely going to slow down all application that use the redirected appdata, especially Adobe applications.

 

Lastly what are you trying to achieve by blocking access to these folders?? as you have seen even builtin windows applications can bypass the restrictions you have in place and I know of a number of applications you can download which will do the same without being installed. As long as your ACLs are correct you shouldn't have anything to worry about.

[chrisjako]

All sorted now via ACL's

 

Thanks to all for your input