Prevent Browsing Netlogon and Sysvol

[GSmith]

Hi

 

does any know how to disable browsing of netlogon and sysvol by any chance?

 

chrs

 

giles.

[mrwoberts]

To clarify, are you wanting to stop workgroup devices (not domain joined), or any domain joined device?

Because, for domain joined devices, it is essential that they are able to access those folders.

[GSmith]

yes you are right i need everyone and every device to be able to read/use the contents of both but without their knowledge/under the hood/stealth like......i don't want my students being able to interact with the folder via explorer or any open/save dialogues

[FishCustard]

yes you are right i need everyone and every device to be able to read/use the contents of both but without their knowledge/under the hood/stealth like......i don't want my students being able to interact with the folder via explorer or any open/save dialogues

 

Why? If they have read-only access, they can't save any files there. Nor is being able to read them a security hole.

 

EDIT: When I said this I assumed the standard set of files there. If you're storing anything else in the NETLOGON folder it may be worth rethinking doing so.

 

If we understand what you're trying to achieve we can better assist.

Edited February 4, 2019 by FishCustard

[3s-gtech]

I just hid the folders within, and removed users’ ability to turn on viewing hidden files and folders. Has worked okay.

[mrwoberts]

3s-gtech solution is probably your best bet, and you'll have to block the command prompt/powershell to avoid access through that door. For those who are determined/curious, there are lots of other ways they could still access it - 7-zip portable is just one route.

 

If there are sensitive things within those folders, then now is a good time to rethink what you keep in there.

[GSmith]

ahh yes of course DOH!! too much margarita at the weekend, hide the scripts teheeheee

 

thank you, apologise for my befuddlements

[mavhc]

Can you deny listing of the folder for students without breaking reading the files?

[ADMaster]

Have you removed run from the start menu?

User config > admin templates > Start menu and task bar > remove run from start menu

 

This policy prevents them from entering a UNC into file explorer, this will prevent the direct approach.

For the determined, it is easily bypassed, so consider what you have stored in the folder as others said.