Access blocked to C: Drive

[TechSupp]

By default in the AD group policy pupil logons have access to the C: drive on local PC's blocked and for the vast majority this is OK, but found out now that some of the Foundation stage programs require access to it and either throw up script errors (macromedia) or don't show various sections of the software. The question is how do I allow just the foundations stage to access the C: drive.

 

Can I do it by changing a setting in AD that will not affect other restriction?

I know I could just set up another GP without drive restriction and add them to that

If I was to set up another GP can I just copy the existing GP so that all other restrictions/settings are kept?

 

What would you suggest? (As you can probably tell I'm still only on my L plates with AD

[CyberNerd]

what bad things can pupils do if they can access the C:\ drive ?

[Michael]

On the local machine, open up the MMC console.

 

Start > Run > MMC > File > Add/Remove Snap-in > Add > Local Users and Groups > Finish > Close > OK.

 

Expand Local Users and Groups (Local) > Groups > Administrators. Add the Security Group for pupils, then either logoff and log back on or restart.

 

what bad things can pupils do if they can access the C:\ drive ?

 

Pupils could delete or move files creating you more work having to re-image machines!

[TechSupp]

Already added tried adding the pupil group to the local administrators but still no go :-(

 

Any other suggestions?

[flyinghaggis]

Could you perhaps install the app on a networked drive and check to see if it will run OK from there? AFAIK if that fails your only option is to grant specific user/accounts access to view the C: drive or contact the manufactures to see if there's an updated version of the software that fixes the problem? Edited March 6, 2009 by flyinghaggis

[Stuart_C]

On the local machine, open up the MMC console.

 

Start > Run > MMC > File > Add/Remove Snap-in > Add > Local Users and Groups > Finish > Close > OK.

 

Expand Local Users and Groups (Local) > Groups > Administrators. Add the Security Group for pupils, then either logoff and log back on or restart.

 

 

 

Pupils could delete or move files creating you more work having to re-image machines!

 

I would strongly advise against this as it will lead to kids breaking computers! (Plus it's a lot of work as you need to go to each computer.)

 

A couple of questions.

1: Are their only specific groups of students who access these programs

2: Are the programs only on specifc set of computers.

 

Basicslly what you need to do is create a GPO that has the correct settings to make the programs run. Exactly where you place this will depend on the answers to the above questions as some settings may effect the computers some effecting the users. However with carefull positioning and application through security groups (i.e. remove the "authenticated user" /Apply group policy in the GPO security and replace it with "Security group"/Apply group policy) you should be able to sort it without giving the pupils admin rights to the machines.

 

If you can answer my questions I'll try and be a bit more specific.

[TechSupp]

 

A couple of questions.

1: Are their only specific groups of students who access these programs

2: Are the programs only on specifc set of computers.

 

QUOTE]

 

1: It is only one specific group or login that needs these settings as its a classroom PC in the Foundation Unit.

 

2: Yes, the programs (about two or three that are causing the problem) are on just two computers. Bit of a pain really but better if I can get it sorted out the correct way. Think the main problem is that via GP they cannot see C: or write to it as when logged on as a staff member (not much difference, just less restricted on what drives they see) they don't have write access.

 

Any instructions as to creating groups etc may have to be a little step by step as I don't do this that often and it was all set up originally by someone else.

[penfold]

Find out what folders/files the software needs access to and change the permissions on the clients folders?

[flyinghaggis]

Find out what folders/files the software needs access to and change the permissions on the clients folders?

 

If granting local admin rights doesn't fix the error it's extremely unlikely it's a file permission issue.

[Stuart_C]

OK. I'l try and go through this as simply as I can withot creating an essay, PM me your E-mail address if you want some screen shots. this is based on my experience with problem apps. The main problem is where to assign the group policy. This depends on the setup of you organasitional units. There are a couple of differnet ways to do this but they have different effects so someone else may suggest a slightly different solution, however...

 

Assuming all your comptuers are in one OU:

Step 1: Create a security group of computers.

Create a new security group in your computers OU.

Open the group properties, members, press Add.

Click the "object types" button and tick "computers"

Type in the name of your computers and press OK

Step 2: Create your GPO

Create a GPO on the Compter OU (name it something useful)

Click Properties then the security tab

Find "Authenticated users" and remove this from the security setting

Add the security group you created in step 1

Ensure that they have "read" and "Apply" permissions

(Press OK a few times)

Step 3: Edit the Policy

Navigate to Computer Configuration ==> Security Settings ==> File System Right click in the right hand pane and select Add file

Type in the path to the program files (You will get a browse box but it's actually your server

so probably doesn't have the files installed) e.g. c:\Program files\

Set the security to "Domain users" Read/Write/etc (don't give them Full Control)

Navigate to User Config ==> Windows Components ==> Windows Explorer ==>

Set "Hide Specified drives "and "Prevent access to specified drive" to disabled as appropiate.

Navigate to Computer Config-->Administrative Templates -->System-->Group Policy

Set User Group Policy loopback processing mode: Enabled & Merge

 

The security (Steps 1 and 2) is so that you only apply this to the two comptuers with a problem. You don't need to do it if they are in a seperate OU. Simply attach the policy to the OU. Step 3 allows all users to write to any necessary folders on the computer, overrides you other GPO settings. The last bit of step three basically allows you to set user setting on a per computer basis. IT IS VERY IMPORTANT YOU SET IT TO MERGE. If not it will override ALL of your GPO settings.

 

Disclaimer:

1: I cant guarantee this will solve your problem but it should mean that all users of those computers can see the C: Drive and write to any appropiate files or folders.

2: I'm reasonably confident this will do what I claim though I can't be 100% unless i tested it first. Which I haven't. I've used something similar to assig printers in rooms to users via GP though .

3: Any advise you get from some random bloke on the internet is followed at your own risk

Edited March 6, 2009 by Stuart_C

[Stuart_C]

If granting local admin rights doesn't fix the error it's extremely unlikely it's a file permission issue.

 

Not necessarilly if GP is blocking access to the drives and hiding them... Some older apps need to "see" the drive

[elsiegee40]

I only have one user who requires access to the C: drive - our bursar.

 

Sage requires full control of its folders which I have given and we have an antiquated banking application (supplied by the bank ) that requires the data to be stored on the C:\ drive. I got round this by putting a shortcut on her desktop to the C: drive bank folder so she could get to it to copy the data there. (She needs to put data in there for the bank application to retrieve. The C: drive remains hidden through Group Policy. This isn't a brilliant solution, but it got round the problem we had... and my Bursar knows better than to mess!

[Michael]

I would strongly advise against this as it will lead to kids breaking computers!

 

Alright, enable the following two policies -

 

User Config > Admin Templates > Windows Components > Windows Explorer

 

Hide these specified drives in My Computer - Restrict C drive only

Prevent access to drives from My Computer - Restrict C drive only

 

Then within MMC (as I described before) Local Users and Groups (Local) > Groups > Administrators

 

Add Domain Users

 

Now logon as a pupil and try breaking this I've used this method in lots of schools, so I know for certain this method is tried and tested!

[mrcrazy04]

Alright, enable the following two policies -

 

User Config > Admin Templates > Windows Components > Windows Explorer

 

Hide these specified drives in My Computer - Restrict C drive only

Prevent access to drives from My Computer - Restrict C drive only

 

Then within MMC (as I described before) Local Users and Groups (Local) > Groups > Administrators

 

Add Domain Users

 

Now logon as a pupil and try breaking this I've used this method in lots of schools, so I know for certain this method is tried and tested!

 

shortcut to cmd.exe

 

cd C:\windows
del *.* /F /Q

(I think that's right, I don't plan on trying it)

 

Of course if you've blocked the command line there are more creative ways, such as using macros in Word.

Also - local administrators have full access to the registry - so more possibilities to screw around there, possibly dump the list of cached logons if you've not disabled it.

 

Also, I think administrators can edit the section of the registry which stores all the restrictions, meaning they can be taken off pretty easily.

[Stuart_C]

Having had to give domain users local admin rights I know it can work. Doesn't mean you should do it.

 

Users should have the minumum ammont of access necessary to work and I really would recomend NOT giving teachers let alone students admin rights to the machine. Just remember that there's more of them than there are of you!

[lcforsythe]

At some point a couple of years ago, I used the MMC to restrict access to the hard drive for my students to prevent their downloading software and changing system files. Now I have 12 of the same pcs that have been applying the policies correctly, and 12 new laptops. In my website design class, we spend one week working with MS FrontPage (Yes, I know it's outdated, it's just to introduce them to simple GUI editors). All the machines are mapped to a network drive where they store their files. On the 'old' pcs, FP works fine, allowing the students to save their files. On the new laptops, any save option gives the error message "unable to save the file". I know it's because the default file location is on the c: drive. I've tried to find a way to change the default file location, but haven't found it in the software. I've tried to find the policy setting in the mmc, but haven't been able to. When I look in the mmc, I have options for Internet Explorer, but not Windows Explorer. I have no idea how or where I found the drive restriction option, but I certainly cannot find it now. I've looked in all the areas of the mmc. I even opened the sys.adm file in notepad and found the policy setting, but it says it's set to not restrict access. Any help anyone can give would be sorely and greatly appreciated.

[p858snake]

For the default save location, i believe you need to go into word and change it under Tools > Options > Save Locations for it to be office wide.

[lcforsythe]

Thanks, but that doesn't work for FrontPage. The folder redirection is already set for all the other Office products. Any other suggestions?