how to disable url protocol scheme

[ujala]

hi

i am in urgent help

i need to block opening of local files in chrome.

when users open pdf with chrome it shows the local path

how can i disable file:///

[georgeescott]

Why do you need to block local file access?

Just for PDF’s?

 

You can use the Chrome policy setting ‘Block access to a list of URLs’ to block ‘file://*’:

https://admx.help/?Category=Chrome&Policy=Google.Policies.Chrome::URLBlacklist&Language=en-gb.

Edited December 4, 2022 by georgeescott

[ujala]

some students have managed to open pdfs with chrome and then there they found cnc path

they scrolled to that path and managed to open the whole folder of students in their class.

i want to hide this option or block so they cant see cnc path in browser

 

- - - Updated - - -

 

i have tried this policy now but its not working

[georgeescott]

some students have managed to open pdfs with chrome and then there they found cnc path

 

Do you mean the UNC path?

 

they scrolled to that path and managed to open the whole folder of students in their class.

 

Sounds more like a folder/share permissions issue if they can access other students work?

 

Are they accessing C:\Users\ or a file server that’s hosting student home drives via Chrome?

 

They can still do the same through Windows by just creating a shortcut to the folder path if you’ve restricted them from typing UNC paths in the File Explorer address bar.

 

i have tried this policy now but its not working

Do you have an example of a file:// path they’re accessing?

[ujala]

if they type the path in file explorer access is denied but file server that’s hosting student home drives via Chrome

in chrome they type

\\fileserver\homefolder

 

they can access

 

i can not give to individual folder permissions to individual user, there are 100 of them

i removed inheritance and then if i individually give access then it works they cannot see the whole group folder only their

can you help me for this please?

 

Edited December 4, 2022 by ujala

[georgeescott]

Yeah definitely sounds more like a permissions issue. If the permissions were set correctly they wouldn’t be able to access the other student folders regardless of method.

 

As a test student, if you create a shortcut in file explorer to the UNC path of a different student, can you access it via the shortcut?

 

You can also check permissions with the ‘effective access’ tab in the advanced security settings in the properties of the other students folder and see if your test student has access.

[ujala]

there are cross under al permissions in effective access

[ujala]

there are cross under al permissions in effective access

 

how can i make a shortcut?sorry asking alot

[georgeescott]

there are cross under all permissions in effective access

Hmm interesting…

 

how can i make a shortcut?sorry asking alot

1. Open file explorer

2. Right click and go to new -> shortcut

3. Enter in UNC path of another student, click next

4. Give the shortcut a name

5. Create it

6. Double-click on it and see if you can get to it as the test student

[ujala]

aceess to the resoure \\domainname\share\ has been disallowed

 

thats the message comes up

[mavhc]

Your permissions are broken, let's start from scratch. You have a user documents share on the server. Each user has a folder in that share. The usual way Windows/Active Directory works each of those users should have permissions only to access their own folders, but that's been broken by someone in the past. Can you show us what the Advanced Permissions are for 1) the user documents share, and 2) a test user's folder in that share?

[ujala]

1: user folder permissions(intake2021)

createrowner full

system

intake2021

administrators

in advanced

enable inheritance

 

 

2. user inside folder (ali.dam)

 

createrowner full

system

intake2021

administrators

in advance

disable inheritance

Edited December 4, 2022 by ujala

[mavhc]

Yeah, that's wrong. Should be: admins can read, possibly users can create, and each folder should have the user as read/write for that folder, no intake2021 permissions for user folders.

 

If the user is the creator/owner of the folder, just remove intake2021 from each subfolder

[CHiLL]

Yeah, if each user's subfolder has permissions for "Intake 2021", "Intake 2022", etc...then every user that is a member of those groups will have access to the folders.

 

As @mavhc mentioned, you need to remove the Intake group from each user's home folder.

 

My folder structure is: \\server\studenthome$\\Username

 

Studenthome folder permissions:

Owner: Administrators
SYSTEM: Full control
All Staff: Modify
Domain Admins: Modify
Administrator: Full Control
Administrators: Full Control
Everyone: Special (Traverse folder/execute file, List folder/read data, Create folders / append data, Read permissions
Inheritance: Disabled

Studenthome share permissions:

Everyone: Full control

Intake 2021 folder permissions:

Owner: Adminstrators
: Full control
SYSTEM: Full control
All Staff: Modify
Domain Admins: Modify
Administrator: Fulll control
Administrators: Full control
Inheritance: Enabled

Edited December 5, 2022 by CHiLL