Disabling Write Access to Desktop

[Hybrid]

Morning all,

 

Hope you are all well?

 

Before I pull any more hair out that I cannot afford to lose, does anyone have a solution that works to prevent users from saving the desktop?

 

Background:

- We use OneDrive with KFM enabled - so we can't/aren't redirecting folders - otherwise I would have just redirected them to a read-only share

- Setup using local profiles - so desktops are all %userprofile%\desktop

 

I have tried to add a file system GPO rule in to prevent WRITE access to the folder in question, but it doesn't seem to take effect, despite gpresult saying it was applied.

 

 

What am I missing??

 

Open to ideas and suggestions.

Cheers

[simpsonj]

Have you blocked write access to the shared desktop as well?

[Hybrid]

Have you blocked write access to the shared desktop as well?

 

I haven't. I'd just assume that because they are all using their own individual desktops it wouldn't be writing to the shared desktop folder?

[simpsonj]

Not 100% sure, but I think Windows will allow you to write to the shared desktop unless that is specifically blocked. Certainly I would try blocking write access to that folder as well.

[Hybrid]

Not 100% sure, but I think Windows will allow you to write to the shared desktop unless that is specifically blocked. Certainly I would try blocking write access to that folder as well.

 

Doesn't look like it's that. I can see the file I've created in the user's local desktop directory.

 

 

The issue is, it looks like my permissions (probably the way I have them setup) aren't taking effect... or just none effective because of another group permission maybe taking control?!

 

If I look at the file on the local C drive, the permissions appear to be inherited (by design), but I'd just assume the GPO file system change I've made would overwrite that?

 

 

It will be something obvious I'm missing or haven't changed.

[Oaktech]

this may be a potato/potahto thing, but rather than %userprofile% have you tried c:\users\%username%\desktop as a folder to set permissions on?

[DaveTheTech]

Why dont you redirect their desktop to OneDrive?

[Hybrid]

Why dont you redirect their desktop to OneDrive?

 

We're trying to reduce the rubbish people store on their desktops ideally - some users' have unsightly desktops, littered with files that makes it 30x harder to find files from. Leaving it to sync with OneDrive will end up being our fall-back and just 'advise' people not to save to their desktops.

[Hybrid]

this may be a potato/potahto thing, but rather than %userprofile% have you tried c:\users\%username%\desktop as a folder to set permissions on?

 

Not that I'm afraid. Soon as I put the entry in, it simplifies the name back to %userprofile%\Desktop again.

[Davit2005]

The way I have done this in the past is do a re-directed desktop to a folder that all the users only have read access to. This means you can drop specific items i.e. shortcuts on the desktop which can be handy. Done this in Windows 7 not tried in Windows 10, it was over 5 years back.

[Hybrid]

The way I have done this in the past is do a re-directed desktop to a folder that all the users only have read access to. This means you can drop specific items i.e. shortcuts on the desktop which can be handy. Done this in Windows 7 not tried in Windows 10, it was over 5 years back.

 

That is indeed what we used to do - however with the advent of OneDrive, you cannot use Folder Redirection and use KFM together.

[DaveTheTech]

Heres what we are doing at my school, using Desktop as an example, but its done for all the normal libraries.

Our regular fodler redirection policy was scoped to a legacy group. This lets us migrate users in batched. SO I let staff know whats happening, remove them from the group and they get the new OneDrive redirection policy.

 

Desktop Folder redirection to %OneDriveSync%\Desktop

New system environment variable OneDriveSync that points to ther OneDrive folder: %userprofile%\OneDrive -

Create a new folder - CRUD is set tp update, Desktop, %userprofile%\OneDrive - \Desktop

 

A workstation policy is used to turn on silent sign on.

 

 

Users log in, get signed into OneDrive, the sync happens and they have all their documents. - They need to migrate their documents, but thats simple enough.

[MatthewL]

The other option is to create a redirected desktop for students, set the permissions on folder where you want icons, that way you can push different icons for apps out to different year groups if you wanted.

[Hybrid]

Heres what we are doing at my school, using Desktop as an example, but its done for all the normal libraries.

Our regular fodler redirection policy was scoped to a legacy group. This lets us migrate users in batched. SO I let staff know whats happening, remove them from the group and they get the new OneDrive redirection policy.

 

Desktop Folder redirection to %OneDriveSync%\Desktop

New system environment variable OneDriveSync that points to ther OneDrive folder: %userprofile%\OneDrive -

Create a new folder - CRUD is set tp update, Desktop, %userprofile%\OneDrive - \Desktop

 

A workstation policy is used to turn on silent sign on.

 

 

Users log in, get signed into OneDrive, the sync happens and they have all their documents. - They need to migrate their documents, but thats simple enough.

 

Interesting way of doing it! I was under the impression that if OneDrive detects a folder direction (to anywhere, by any means), it simply halts the process of KFM. Is that not what you've found doing it that way? Or are you removing the GPO you've created for that purpose so OneDrive *thinks* it isn't being redirected, but actually is?