OneDrive and C Drive

[coreykeeling]

We are currently testing out OneDrive and I have it working with single sign on but our users can’t access the OneDrive folder due to the C drive being restricted on our network.

 

I was wondering how other schools have managed to get around this when deploying OneDrive?

[robyholmes]

This has been mentioned a few times on here. The answer is, remove the restriction but keep it hidden. As long as your permissions and other restrictions are correct you shouldn't have any trouble.

[coreykeeling]

This has been mentioned a few times on here. The answer is, remove the restriction but keep it hidden. As long as your permissions and other restrictions are correct you shouldn't have any trouble.

 

Sorry I have just seen some of the threads about it.

 

What permissions and other restrictions would you suggest?

 

We pretty much do the standard locking down of users. No CMD, no Run, Software Restrictions. C drive permissions I suppose will be whatever are default for Windows.

[ricki]

Have a look at OneDrive mapper

[coreykeeling]

Have a look at OneDrive mapper

 

 

The issue with OneDrive Mapper is that it uses the webdev protocol which can be slow. I have another thread about single sign on with OneDrive and people there have recommended I don’t use mapper due to its performance.

[Warwick_Tech]

The issue with OneDrive Mapper is that it uses the webdev protocol which can be slow. I have another thread about single sign on with OneDrive and people there have recommended I don’t use mapper due to its performance.

 

We had to stop using OneDrive Mapper for two reasons - One was the WebDav which was problematic at best, but the second was more serious in that students could use the login box to access powershell as an admin (despite launching powershell as an admin prompted for credentials, my theory is that as it was run as a login script it was already an admin so it bypassed the UAC prompt)

 

So yeah, no more OneDrive mapper.

 

 

With regards locking the C: drive, I have always had it locked as this covers multiple bases, simply being hidden can cause all sorts of backdoors, better the 'cover all' approach - but this does mean no sync tool for students.

 

For now they are using the web apps version without much issue, it also teaches them how to use it for H/W and access outside school etc so it's swings and roundabouts.

[Driftingforlife]

I thought about making a small 4GB partition that's hidden from uses and redirect the OD folder to it. Use file on demand and make a script that empty's the drive every time a user logs off/the PC turns on. Not sure if any of this is possible, need to test it.

[Warwick_Tech]

I thought about making a small 4GB partition that's hidden from uses and redirect the OD folder to it. Use file on demand and make a script that empty's the drive every time a user logs off/the PC turns on. Not sure if any of this is possible, need to test it.

 

A good idea,

 

there are a few GPO's that can help with this: https://docs.microsoft.com/en-us/onedrive/use-group-policy

 

but as OD is 1TB would 4GB be enough? you may encounter errors if they have more than 4Gb of data.

 

the other idea I had was simply direct it to their home area on the server, but again space issues and sync issues may persist.

[Driftingforlife]

A good idea,

 

there are a few GPO's that can help with this: https://docs.microsoft.com/en-us/onedrive/use-group-policy

 

but as OD is 1TB would 4GB be enough? you may encounter errors if they have more than 4Gb of data.

 

the other idea I had was simply direct it to their home area on the server, but again space issues and sync issues may persist.

 

Will have a look at the GPOs later, thank you.

 

In our college the idea is to move away from people using their home area and using OD.

 

That is why I would use file on demand, so it only syncs files the user wants to open, I would say 99% of people here don't have files bigger than 4GB but it would be easy to use a bigger partition.

[coreykeeling]

I thought about making a small 4GB partition that's hidden from uses and redirect the OD folder to it. Use file on demand and make a script that empty's the drive every time a user logs off/the PC turns on. Not sure if any of this is possible, need to test it.

I liked your idea about creating an extra partiton to get around the issue of the C: drive being restricted. I tested this idea out today but using a 8GB partiton instead and I can say it worked. We used the OneDrive GPOs to force the location of the OneDrive location to O:\%username%

 

I have found that if they right click on the OneDrive icon in the taskbar tray and click open folder then it will go to O:\jsmith\OneDrive - Tenant and they can traverse back and see everyone else's OneDrive folder.

[Driftingforlife]

That's good to know it actually works. Thanks for trying it.

 

That's the second reason to having a script that wipes the drive with every log off/on & power on.

[Warwick_Tech]

That's good to know it actually works. Thanks for trying it.

 

That's the second reason to having a script that wipes the drive with every log off/on & power on.

 

Would this be easier to manage with a server share folder that you can force a wipe of - It means no need to worry about PC's with home area data hanging around (GDPR)

 

The only issue with this is as you say depending on how many people are logged in at once they can browse to others folders...

 

When you say 'right click' do you mean the taskbar icon or file explorer? As there must be a way of blocking acees to the root (O:) but not the path (O:\Username)

[sted]

instead of creating an extra partition could you use a subst command as a startup script?

something like

subst d: c:\onedrive

then alter the onedrive save location to d: ?

ive used that before to get round c drive access i created a scratch space on the c drive for people to drop video files

[coreykeeling]

Would this be easier to manage with a server share folder that you can force a wipe of - It means no need to worry about PC's with home area data hanging around (GDPR)

 

The only issue with this is as you say depending on how many people are logged in at once they can browse to others folders...

 

When you say 'right click' do you mean the taskbar icon or file explorer? As there must be a way of blocking acees to the root (O:) but not the path (O:\Username)

 

I mean the taskbar icon. If you click it and it brings up OneDrive there is a button you can click that takes you to your folder but it opens O:\%Username%\OneDrive which then allows a user to go back and browse the rest of the drive. If you click on OneDrive from File Explorer it doesn't let you do this.

[coreykeeling]

That's good to know it actually works. Thanks for trying it.

 

That's the second reason to having a script that wipes the drive with every log off/on & power on.

 

It seems if you use Windows 10 1903 you can use Storage Sense with GPOS to automatically clear the files in OneDrive if they haven't been used in X amount of time.

https://www.windowscentral.com/how-manage-storage-sense-settings-using-group-policy-windows-10-may-2019-update

 

I have been unable to find a script yet that will automatically clear the files.

Edited July 11, 2019 by coreykeeling
added additional website

[coreykeeling]

I have now found a script that will mark OneDrive files as online only. I have not tested it yet.

 

https://techcommunity.microsoft.com/t5/Microsoft-OneDrive-Blog/OneDrive-Files-On-Demand-For-The-Enterprise/ba-p/117234

 

https://gshaw0.wordpress.com/2017/11/08/onedrive-files-on-demand-first-steps/