[21h1] Keeping OneDrive while blocking C Drive

[MEvansLA]

Attempting to block the C Drive to students, but push OneDrive as a default.

The issue is that when blocking the C drive, OneDrive also becomes blocked.

there has also been no success when trying to hide the C drive, either through the GPO 'Hide these specified drives in My Computer' or through the Registry edit of 'NoDrives' (value: 4).

 

Any help would be greatly appreciated.

[Mr.Ben]

What is your reason for hiding it?.

 

Pre Windows 7, it made some sense as without UAC it could be tampered with, but it you have everything set up this is negated now.

 

I'm happy to be corrected, but some of the things I used to due for security caused significantly more work for no beneficial purpose - I've always felt this was one of them!

[Boredguy]

Strange, our OneDrive on Demand client is working fine for all users with the C Drive hidden from the File Explorer (but only hidden, not Restrict)

We hide it purely to ensure users aren't tempted to mess about even though we have NTFS permissions on all bar essential locations to prevent them from being able to modify content.

[MEvansLA]

We don't want students to tamper with the C drives on the devices at all. I still have a lot of learning to do and need to find the best ways to restrict what can be changed.

I appreciate the info.

[MEvansLA]

Did you have any issues hiding the C drive?

As I mentioned I tried the 'Hide these specified drives in My Computer' with success and then tried through the Registry edit of 'NoDrives' (value: 4)

 

 

[Guest Guest]

Did you have any issues hiding the C drive?

As I mentioned I tried the 'Hide these specified drives in My Computer' with success and then tried through the Registry edit of 'NoDrives' (value: 4)

 

 

We hide the C drive without issues, doesn't really need to be hidden as we have permissions in place but I prefer it that way

[jamesrhart]

There’s a difference between hide and block. We always found that hide worked fine but block did indeed break the OneDrive client. Hide is a halfway house as if you know paths or use legacy software you can still access and see C.

[Katy]

I achieved this through the "Hide these drives in My Computer" policy, and the policy setting to remove and prevent access to the Run window. Combining these prevents the user from just typing "C:" into the file explorer address bar.

 

I found the "show/hide drives" part of a Group Policy Preference drive mapping doesn't seem to work any more, don't know if that's what you were using and why hiding drives didn't work for you?

[LRSFC_DanJ]

Have people found a way to deal with the fact that users can type c: in Start Menu search and still get to the C: drive with only "Hide these drives in My Computer" enabled? I haven't yet found a way to disable that that doesn't also break the OneDrive sync client.

 

EDIT: now I have, you can add a Deny rule using AppLocker to deny access to the Packaged App Microsoft.Windows.Search. Weirdly AppLocker rules live in Computer policies despite the fact that you specify users/user groups for them to be applied to.

Edited August 9, 2022 by LRSFC_DanJ

[Katy]

Have people found a way to deal with the fact that users can type c: in Start Menu search and still get to the C: drive with only "Hide these drives in My Computer" enabled? I haven't yet found a way to disable that that doesn't also break the OneDrive sync client.

 

Have you tried the setting to remove Run from the start menu? This also prevents them typing a path such as "C:" into the file explorer address bar, and should also stop them from start menu search? At least it used to in the past.

[LRSFC_DanJ]

Have you tried the setting to remove Run from the start menu? This also prevents them typing a path such as "C:" into the file explorer address bar, and should also stop them from start menu search? At least it used to in the past.

 

I have. It does not prevent searching from Start.

[Guest Guest]

I thinks there’s a policy in google which means that you add C:\ in the hidden indexed paths and prevents users from accessing from search in start menu

 

Never tested though

[LRSFC_DanJ]

I thinks there’s a policy in google which means that you add C:\ in the hidden indexed paths and prevents users from accessing from search in start menu

 

Never tested though

 

Tried adding C:\ to "Default excluded paths" and "Prevent indexing these paths" in the Search GPOs but this was not effective either. Blocking the Search app using AppLocker was the only thing that worked.

[tmoon-mint]

You can also type the path \\127.0.0.1\C$ which I think (but dont quote me) would bypass the restrictions entirely. As others have said as long as permissions are correct shouldnt be an issue.

[KK20]

We dont bother locking C: drive down any longer, we use applocker and other GPOs. As for onedrive, I seem to remember there was a way to change the location of onedrive user files, once we had ondrive installed per device (not per user) and set the ondrive file locations to a portion that was redirected, I have a feeling that sorted it for us at the time.

[edubri]

I know I'm dragging up an old post - however I'm in this situation myself - need to have the C:\ drive blocked but blocking it stops OneDrive. Any advice would be great in the best way of doing this - thanks

[Space_Munkey]

I feel like we're likely to see a lot more of this question being asked - I too am in a similar situation.

 

I've done a lot of reading where some basically just hide the C: Drive from users, rather than blocking.

 

If this is the only way to do it, we will have to settle for it, but I'm eager to see if anybody has managed it

[mavhc]

If you don't want people editing the C drive then set NTFS permissions to deny them. You'll want to at least apply RootSec https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/apply-predefined-security-templates because by default people can create folders in C post XP. Which leads to Mock Folders that bypass security https://borncity.com/win/2023/03/11/windows-10-11-mock-folders-as-uac-bypass-security-disaster-leverage-applocker-and-srp/

[edubri]

I feel like we're likely to see a lot more of this question being asked - I too am in a similar situation.

 

I've done a lot of reading where some basically just hide the C: Drive from users, rather than blocking.

 

If this is the only way to do it, we will have to settle for it, but I'm eager to see if anybody has managed it

 

I'm currently testing this right now - I've just got hide C: on, I've inherited a lot of settings in group policy that I'm looking through - it looks like there are other measures in place that prevent access to c:\ drive as well not sure yet, although it let me create the test student onedrive. i on the c:\ drive (i did create a exe rule in applocker for students under this path)

 

My plan is for a while have students use old folder redirection and onedrive - I can't cut off the old method just yet

[Tefters]

Morning all,

 

Working on this myself at the moment and wondering what people do for the Music and Videos redirection as apparently GPO doesn't reference these as known folders yet they are classed as Windows default locations as per explorer quick access and in our on-prem redirection setup I've had running for years I usually redirect these to "same folder as documents". If I just ignore these then they will by default save to C:\users\*username*\Music and \Videos which we cant have and I don't really want to keep redirecting these to my file server as the plan is to stop doing that.

Going to test doing a redirection through the old GPO method to C:\Users\*Username*\Onedrive-*bla bla bla*\Documents\Music and see what happens.

 

EDIT: Trying to redirect to the OneDrive folder does not work for Videos or Music as your cannot user the environment variable %username%

Edited June 4, 2025 by Tefters

[speakercon]

I have in the past redirected them to C:\Users\Default\*RELEVANT FOLDER* which then blocks them saving anything in there.

Edited June 4, 2025 by speakercon

[Tefters]

2 minutes ago, speakercon said:

I have in the past redirected them to C:\Users\Default\*RELEVANT FOLDER* which then blocks them saving anything in there.

 

Owww thats an idea, redirect it to a folder they cant save to so they just get an error and are forced to use Documents / OneDrive.

[DavR]

It's quite a while since I set up our OneDrive redirection, but, I used the environment variable method, as described here - https://community.spiceworks.com/t/onedrive-folder-redirection/1012141

 

You create a new environment variable that refers to your OneDrive location, and use GP to redirect My Documents to the %OneDriveLocation% variable. That achieved, you can then tell all your other folder redirects to follow the Documents folder. 

[Tefters]

9 hours ago, DavR said:

It's quite a while since I set up our OneDrive redirection, but, I used the environment variable method, as described here - https://community.spiceworks.com/t/onedrive-folder-redirection/1012141

 

You create a new environment variable that refers to your OneDrive location, and use GP to redirect My Documents to the %OneDriveLocation% variable. That achieved, you can then tell all your other folder redirects to follow the Documents folder. 

Good shout, didn't think about tricking it like that.

 

I'm more annoyed at Microsoft for supporting Desktop, Documents and Pictures via the Known Folders OneDrive GPO but completely ignoring Videos and Music, even though they are classed as default user folders on a profile creation.

When you run the same OneDrive client outside of GPO management, it sees and can sync the Videos and Music folders so it's only in the GPO managed world they decided to ignore it! 🤬

 

I think I'm going to go down the route suggested by @speakercon which is direct the Music and Video folders to the default profile equivalents, tested it last night and it worked well, the user just goes to a blank directory and then cannot save or create anything in those folders which will then force the user down the mindset of having to use the documents redirect.

[speakercon]

You can just remove the folders by removing them from the registry, I remember trying this a couple of years ago but I seem to remember it causing some other unintended issue but I'm afraid I can't remember what it was.

 

For example, videos:

 

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}]

 

I guess MS is thinking is the music and video folders will be containing loads of large media files that they don't want people to sync to OneDrive, but obviously that doesn't work in an education environment, we can't have users saving things locally. What with streaming platforms how many avarage users actually have folders of music and videos on their computer in this day and age.

 

Known folders aren’t really needed anymore are they, just a simple OneDrive folder would suffice, they're just inherited from the past.