Stop access to \\servername in ie7

[DSapseid]

I have just had one kid in here saying that he got access to my IT Wiki - he actually only got as far as the login page but thats far enough.

 

Is there anyway that i can stop users from typing \\servername into ie7 or just block access from this server somehow?

 

I am using wamp server to host the wiki on, i have tried giving the group all students deny all access on that folder but it doesnt work.

[RabbieBurns]

Do you have the ie7 adm installed?

 

IM not sure which GPO it is, but on ours with a student account if they try to do a \\anything it comes back with a "accessing the resource has been disallowed"

[RabbieBurns]

possibly

 

User Configuration -> Administrative Templates -> Windows Components -> IE -> Browser menus -> Disable context menu

 

?

[DSapseid]

Context menu is right click isnt it?

[RabbieBurns]

yep, your right. Ignore that.

 

However, I also have Run disabled on the start menu. Might be worth trying that?

[Michael]

I think the simple answer is "no you can't" because Explorer and Internet Explorer are tightly integrated.

 

You've clearly done a good job locking down policies and they're being prompted for a username and password to view shares of the server. To make things that little bit harder, within Active Directory, copy the Administrator account and name it anything you like - then disable the administrator account. They'll need to guess the administrator username and password now.

[Guest Guest]

Read how to edit the httpd.conf file in apache. You can set up whatever ACLs you want

[RabbieBurns]

Re: Disable Run Command and UNC Path

 

If you enable this setting, the following changes occur:

(1) The Run command is removed from the Start menu.

(2) The New Task (Run) command is removed from Task Manager.

(3) The user will be blocked from entering the following into the Internet

Explorer Address Bar:

--- A UNC path: \\\

---Accessing local drives: e.g., C:

--- Accessing local folders: e.g., \temp>

[CyberNerd]

If you don't want someone to access something it is better to disable access to the server by correctly setting the permissions.

 

disabling \\servername in one application might just obscure the problem - can they do it in MSword as well ?

[ChrisH]

There is a policy that disallows the use of UNC paths. I have it in use. I will try and find the setting tomorrow for you.

I have never played with a wamp install only LAMP and WIMP I am guessing you are going to need to play with mod_NTLM and the like for securing the directory. I had a recent post about it between me and Geoff although he had me looking in the wrong place for a while!

 

Renaming the admin account is a good idea in theory but someone is bound to see you typing your admin account name eventually. Any serious enumeration of accounts also easily identifies the admin accounts since the SID always ends with 500. Not something most kids will be capable of but something to bear in mind anyway.

[AndyD]

This is disabled by disallowing access to Start -> Run

 

Set User Configuration -> Administrative Templates -> Start Menu and Taskbar -> Remove Run menu from Start Menu to Enabled

[techyphil]

Saying if someone brought in a laptop from home and plugged into the network. Without RADIUS or some other form of network access protection, how would you prevent non-domain members from browsing network shares?

 

I know theres a way somewhere, I just don't like the idea of prevent the RUN being seen.

 

NTFS is ok, but theres some shares that need to be accessed by some software for students. To the DOMAIN workstations, they are unable to see these shares because of the tight restrictions.

 

Thanks for any help

[sy2k]

If a non domain user hits any of your network shares they should still be prompted for a domain account if permission's are set correctly, also if you just want to say stop kids from hitting your wiki why not just change the port to something other than port 80?