Onedrive SSO and restrict C drives

[KK20]

We have a working SSO onedrive for our staff having set up "Silently configure OneDrive using the primary Windows account". We run ADFS and have a valid azure tenant. All is good, AD sync works, onedrive is happy for staff and the folder appears in file explorer. We have on-demand setup so that staff can download files they need. Office 365 A1 is running and although noone has used it in 6 months, it does work.

 

Moving onto pupils, we have a few differences in our GPOs for pupils, one of which is "Windows Components/File Explorer/Prevent access to drives from My Computer = Restrict C drive only". This is to stop the little darlings messing with things they shouldnt, such as running amok in program files double clicking everything they can find or trying to run random .msi's that may or may not install but certainly screw up their profiles. This has worked well for us for many years. However, onedrive will not work when this GPO is enabled. If I remove the restriction, onedrive works and maps the userprofile temp onedrive folder to their cloud onedrive; put the restriction in place and you get an error clicking on the onedrive icon.

 

I have tried "hiding" the C drive instead - this fixes onedrive but you can still "search" for C: and open the drive, since this is "hidden" rather than "restricted" the little darlings can run amok again. (Searching whilst "restricted" brings the same error as if you have clicked the C drive in explorer).

 

I have tried redirecting the default onedrive folder - this works if I select a "d" drive as the destination for onedrive, but I cannot get the redirection to work with a network folder (\\fileserver\onedrive$\%username%) - I have tried both using the USER GPO for default directory and setting the registry Software\Policies\Microsoft\OneDrive\DefaultRootDir [value]= \\fileserver\onedrive$\%username% this would be a reasonable workaround for me but I cannot get a network location to work for me. Not all PCs have a "D" drive and since we have 120gb SSDs I cannot afford to script a creation of D drives everywhere - plus I do not know what happens to these working folders over a lifetime I suspect I will need to script a cleanup which will be messy.

 

How are you guys locking down (or not) your PCs and getting onedrive running?

Edited December 14, 2018 by KK20

[allertda]

Hi,

 

Did you ever find a solution for this? I've just hit the same issue (we don't trust Staff with access to the C: drive either!)

[robyholmes]

As long as your permissions are correct you should have any issues with users accessing C:\ drive. We've had it unrestricted for years for both staff and students with no issues. Hidden yes.

[Boredguy]

We hide C drive, but have turned off the Prevent access to C.

 

So far users have not been able to browse to C: but onedrive will function (well it would if it would auto sign in for my test account silently but that's another matter)

[mavhc]

I'm not sure why running files on drive C than you installed for them is such a problem, what exactly have they been able to do?

[free780]

If you have applocker in place users can't run exes/msis they shouldn't. You can setup event forwarding and a daily email to see there are any false positives..Hiding C is a bit of security by obscurity.

[evasion]

I have just hit the same "brick wall" of having OneDrive working with C: drive hidden but not restricted. So far in a test OU it works spot on as long as C: is only hidden, try to restrict access and OneDrive stops working as expected. So, no way to have unsecure network (security by obscurity) for me. Drop the whole OneDrive project or what? Just cannot risk another malware vector and have sleepless nights....

[3s-gtech]

I went through this back before Easter.

 

I shrugged and removed the restriction (staff only). Relying on NTFS and UAC alone, but doesn’t seem to be major risk.

[slugshead]

I'd love to turn off restricted C drive to turn on onedrive for staff. But I don't trust NTFS,UAC or applocker enough to do that just yet. I still feel like I'm missing something

[thimon]

Enable LAPS and that should hopefully put you more at ease.

[Boredguy]

Can't say we've had any issues with it, but we also updated the NTFS permissions so that the "Users" group is read only on the majority of the C Drive so they can have write access to a handful of locations (which includes the user profile folder).

 

Been running OneDrive for the past 12 months with no problem

[mavhc]

So your issues are a) what users can read, and b) what they can write.

 

For b search for which folders on C they can write to, and see what the problem is for each of those. Applocker will stop them running things they can write.

 

For a I'm still not sure what the problem is, what program can they run that you don't want them to? Not like they can't run it some other way anyway.

[KK20]

We solved it by beefing up applocker and our AV running in MD5 hash hardened mode. We dont hide or restrict the drives any longer and pupils can try to run EXE from their USB drives, temp drives, local %appdata% if they wish (i.e. in places that they had access to previously) but cannot. Yes this is a pain when you want to install new software but a necessary one.

 

Why run applocker AND AV? This is when visual studio becomes an issue. Some of our pupils are allowed to compile programs of their own creation for their computer science A level. AV picks up on these compiled programs and kills them. Applocker can be tuned to run with VS.

 

If you want to run various applocker profiles, be aware that whilst you can add on applocker restrictions, removing them is a different issue. You need to clear registry keys if you wish to remove applocker restrictions. I cannot remember what they are right now but it is an easy google.

Edited August 2, 2021 by KK20

[evasion]

just to point out how difficult product to implement in secure environment this is (User Voice since 2015 - no movement since then)..