[1903, au] Anyone Restrict C: in GP? Does it Work for You?

[JRA]

Afternoon. For many years I've stopped the little darlings browsing C: and deleting things in a free-for-all of anarchy. However, don't seem to be able to do this fully on W10.

 

I've restricted it in the old way, from the explorer policy "restrict C" at the dropdown (and I swear that policy's moved now too) and also gotten rid of the search bar and therefore UNC browsing.

 

However, I find that from a start menu search just typing in "C:" the jolly explorer window happily brings it up and there I am. On a C:\ I didn't want the children getting.

 

Has anyone else overcome this one? Thanks all for any info.

[BOOT]

Are you also using the "Prevent access" policy or just "Hide these drives"?

[JRA]

Are you also using the "Prevent access" policy or just "Hide these drives"?

There's a "prevent access" one? Oohhh...

 

Yeah only using User > Policies > Admin templates > Windows components > File explorer > Hide these specified drives.

 

Where's the "prevent" one and does it, like, wreck the world or literally just stop them browsing it?

 

Thanks lots for that one too.

[BOOT]

The policy is in the same place as the other one. I've never found it to break anything. Scripts still work etc. Just stops them browsing to it by typing the path or clicking "Open File Location".

I would also suggest looking at restricting the default administrative shares (C$ etc) as you can still browse the local disk via those.

[mavhc]

Why do they have permission to delete things?

[JRA]

Thanks both.

 

I'll look for that I may have been staring right at it but not clocked it. Thanks.

 

And I'd always been hesitant to apply that to C: just in case something (in my mind something Adobe-flavoured as it happens) just didn't work without some user-context delete on %thing% in there. Or also MS Office flavoured too. I'd never asked around, but assumed it'd have the capacity to break the world quietly at some point.

 

In the olden days of W7 I just had the drive restricted and, without the search business, seemed to keep the children out of it alright.

 

Cheers again though both, I'll set that policy.

[Katy]

Just as a heads up, the "Prevent access to" policy will break OneDrive sync client if you have it syncing to the default path i.e. C:\Users\%username%\OneDrive - TenancyName