InTune - Restricting C: Drive

[mjhardisty]

Good afternoon all. Has anyone any experience with InTune and restricting access to local drives for a potential student policy?

 

We obviously want to restrict access, but allow students the ability to use the OneDrive Files-on-Demand client.

 

Has anyone implemented this successfully?

[snagrat]

I hide C: via registry but you can still access it if you know how.

 

Doesn’t really bother me too much. They can’t do much in there anyway

[mjhardisty]

OK, so a search for C:, or entering C: into the start menu will access it?

[snagrat]

OK, so a search for C:, or entering C: into the start menu will access it?

 

Yes it will.

[mjhardisty]

First allow OneDrive Files-on-Demand to run and start to sync Windows Known Folders. Set the following OneDrive policies to allowed:

 

Silently move Windows known folders to OneDrive

Allow syncing OneDrive accounts for only specific organizations

Prevent users from syncing personal OneDrive accounts

Silently sign-in users to the OneDrive sync app with their Windows credentials

Use OneDrive Files On-Demand (also add your tenant ID)

 

OK, then configure the new policy:

 

https://learn.microsoft.com/en-gb/windows/client-management/mdm/policy-csp-fileexplorer

 

SetAllowedStorageLocations to LocalDrives

SetAllowedFolderLocations to Documents (or include Desktops if you want to sync shortcuts)

 

This will only show the "SetAllowedFolderLocations" in Windows Explorer. Students can navigate to C: still, but are restricted and can't navigate anywhere else but the root.

 

Anything they save in "Documents" will be synchronised into OneDrive.