7-Zip allows local drive access

[toffee_paul]

Hi,

 

Is anyone aware of a way to prevent 7-Zip from accessing local drives from it's File Manager?

 

Thanks

[bald_pig]

Hi,

 

Is anyone aware of a way to prevent 7-Zip from accessing local drives from it's File Manager?

 

Thanks

 

Yes. It isn't installed on student machines, they have no need for it.

[toffee_paul]

Thanks but need a solution for staff also.

[Katy]

If it isn't written to obey group policies then nothing you can do about it.

 

We don't have it on any machines except ours, but we only hide the C drive to stop people thinking "ooh i can put stuff on there" - staff and students cannot get at anything they shouldn't be able to on the C drive as they have the correct permissions for what they need to do.

[bald_pig]

Thanks but need a solution for staff also.

 

Staff can see the C drive, they have appropriate permissions so cannot do anything silly.

[toffee_paul]

Permissions are set to prevent users from deleting/editing things they shouldn't on C but was just wondering if drive visibility can be blocked. Perhaps I should have been more clear on that sorry.

[jthompson]

I don't think there's going to be any way to restrict 7-Zip functionality in that way, not unless the developers have offered it. I expect the same will be true of other alternative file manager applications.

[toffee_paul]

Yes, you and Katy both say, it doesn't seem to honour GP settings which is a shame. A lot of the 'utility' type of software is the same I've found. In the case of 7-Zip it's odd really considering how widely used it is.

[Arthur]

TC4Shell would probably do want you want since it integrates 7-Zip into File Explorer, but it's not free.

 

A lot of the 'utility' type of software is the same I've found.

The developer of 7-Zip hates adding any kind of 'bloat' to his program. It's difficult enough getting security-related improvements that increase the file size of the app by 0.5%, let alone GP support.

 

https://news.ycombinator.com/item?id=16986377

 

It seems quite rare to find third-party software that honours Group Policy settings such as hiding drives. Most developers either don't care or use cross-platform toolkits that do not include support out of the box and therefore don't bother.

Edited December 6, 2018 by Arthur

[Danp]

I think allowing 7-Zip to most users is a security risk in it's own right.

[chazzy2501]

Don't mean to sound daft, but why would staff need 7zip anyway? Windows can natively handle zip files (with and without encryption) and can mount iso files if really needed.

 

EDIT: I'm wrong it can't handle encrypted zip files.

EDIT2: ok it can extract encrypted zip files using zip encryption but not aes256.. but I can't find away to encrypt natively.

Edited December 6, 2018 by chazzy2501

[jthompson]

Doesn't 7-zip offer some stronger encryption options? I don't know how it compares to native Win10 though, tbh.

[Arthur]

Doesn't 7-zip offer some stronger encryption options?

Yes (AES-256). Windows and macOS only support ZipCrypto which isn't secure.

[toffee_paul]

7-Zip doesnt overwrite your files without telling you [emoji1] Looking at you 1809!