Block students using Chrome as a local browser to access C:

[chrisjako]

I have just rolled out Google Chrome which i've noticed allows the student to work it as a file explorer for access to C Drive. Essentially you can get to anywhere on the 'C Drive' (or the computer) by simply typing in the path into the address bar same as other browsers, (ex. file:///C:/) is the root drive and you can access whatever.

 

I do not want to have students typing in paths into the address bar. The students are prevented from accessing any files or folders in that drive via GPO but does anyone know of a way to block that feature completely?

 

It's disabled through IE with a GPO but cannot see a policy to disable it for Chrome.

[Arthur]

It's disabled through IE with a GPO but cannot see a policy to disable it for Chrome.

The easiest way to do it is to add file:///* to the URL blacklist policy.

 

https://support.google.com/chrome/a/answer/2657289?hl=en

Edited August 3, 2018 by Arthur

[TechMonkey]

The easiest way to do it is to add file://* to the URL blacklist policy.

 

https://support.google.com/chrome/a/answer/2657289?hl=en

 

That may cause issue if the browser opens up a file in a tab, say a PDF after download.

 

Better to have your C drive security correct, not just rely on having C hidden. Don't forget any application that doesn't use the standard Windows file open interface will have the same issue

[Arthur]

Better to have your C drive security correct, not just rely on having C hidden

That should go without saying, but you're 100% right.

 

If @chrisjako uses folder direction perhaps a better URL to use would be file:///C:/* since Chrome will download PDFs and other files to the redirected Downloads folder (e.g. file:///N:/Downloads/example.pdf) and users will still be able to open them in the browser.

[chrisjako]

That should go without saying, but you're 100% right.

 

If @chrisjako uses folder direction perhaps a better URL to use would be file:///C:/* since Chrome will download PDFs and other files to the redirected Downloads folder (e.g. file:///N:/Downloads/example.pdf) and users will still be able to open them in the browser.

 

there is a policy setting in chrome admx to force pdfs to open externally from chrome - maybe i could stick those two policies in coalition

[LRSFC_DanJ]

Are there any updates on the proper way to do this? It doesn't seem like putting file://C* or file:///C* on the URLBlockList setting is working any more.

[malware]

Are there any updates on the proper way to do this? It doesn't seem like putting file://C* or file:///C* on the URLBlockList setting is working any more.

 

There is literally nothing you can do to stop people accessing the C drive.

 

Just get proper security in place so its mostly just readable.

[chazzy2501]

just wait till kids use the old "\\127.0.0.1\c$" in any application.

 

humm

 

edit:\\127.0.0.1\c$

 

edit2: probably could make it work.

Edited June 8, 2021 by chazzy2501

[free780]

Can you just disable the c$ share?

 

Hiding the C drive contents isn't really more secure. Stopping write access apart from the user profile may be possible.

[LRSFC_DanJ]

Hiding the C drive contents isn't really more secure. Stopping write access apart from the user profile may be possible.

 

Is there a way to do this via group policy or some other scalable method? We don't have the resources to go round 1500+ computers ourselves and set permissions on the C: drive.