Finder browsing the SYSVOL and NETLOGON folder

[networkmanager]

Hello,

 

I wonder if someone can help me.

 

We've just installed the Xserve and a couple of iMacs.

 

The iMacs were bound to Open and Active Directories such that users can use their Windows logon account to get authenticated on the iMacs, all properly locked down just like on the PCs.

 

However in Simple Finder in OS X, there is a link to Network where users can browse the list of all PCs and Servers along with Shared Folders on them, as such the SYSVOL and NETLOGON folders are visible as shares on the DCs. This network link becomes visible when users open up the 'Storage Area' used for storing common files for users.

 

I just wondered if there's a way to hide such shares from users' view?

 

The SYSVOL and NETLOGON folders have got the default permissions on, which is Everyone - Modify, can this be altered without screwing up the DCs? Probably define the User group to have READ ONLY access?

 

Really confused about this, just hope someone will help out.

 

Thanks.

[powdarrmonkey]

I just wondered if there's a way to hide such shares from users' view?

 

Not at the server end, I don't know if you can configure Finder to ignore them.

 

The SYSVOL and NETLOGON folders have got the default permissions on, which is Everyone - Modify, can this be altered without screwing up the DCs? Probably define the User group to have READ ONLY access?

 

Err... if that's the case, you probably have a bigger problem. Only server operators should have write permission to these shares. (Do you mean share permission or NTFS permission?)

[networkmanager]

Thanks for your prompt response.

 

The share and NTFS permissions on the SYSVOL folder is as follows;

 

SHARES

Admin - Full control

Auth. Users - Full control

Everyone - Read

 

NTFS

Admin - Full control

Creator Owner - Full control

Everyone - Modify

System - Full control

Users - Read & Execute, List Folders and Read.

 

On the NETLOGON is as follows;

 

SHARES

Admin - Full control

Everyone - Read

 

NTFS

 

All permissions here inherited from the SYSVOL folder above.

 

I'll appreciate if you can suggest a better alternative to these, we've got a global security group defined for each type of user in AD if that will help.

 

Thanks.

[fox1977]

Did you have any luck with this? Ive got the same problem!

[tosca925]

Does anyone know how to lock Finder down so they can't browse the network or see any PC's? We have just had a MAC server put in and we are experiencing this problem from our iMac's

 

[mac_shinobi]

What version of OS X are the clients and the server running ?

 

possibly the below

 

http://www.windowsnetworking.com/kbase/WindowsTips/WindowsNT/RegistryTips/Network/HideWindowsNTfromNetworkNeighborhoodBrowsing.html

Edited January 28, 2010 by mac_shinobi

[tosca925]

Snow Leopard 10.6

[5tu]

It was a long time ago but I think we resolved this issue by customising a com.apple.sidebarlists plist and applying it against student and staff user groups.

[AntonioRocco]

Hi

 

Disable "NetBIOS over TCP/IP" in the DHCP Service's Advanced Section. When was the last time you had to support NetBIOS aware client workstations?

 

Customizing the Sidebar's plist is one way of doing this although by itself it still won't stop users from re-enabling the view by accessing the Finder Preferences. The trick is to deny them access to this Setting as well. However this may cause more problems than it solves.

 

Why is it such a problem? Surely if authentication and authorisation along with permissions has been correctly set on server and client workstations what difference would it make? Should you not be storing SYSVOL on another volume for performance reasons anyway? One that is not being shared. Hard drives are not expensive.

 

Antonio Rocco (ACSA)

Edited January 28, 2010 by AntonioRocco

[TomH]

The SYSVOL has to be shared its required for file based replication between domain controllers and holds things like group policy. Removing it as a share would be VERY bad.

 

As far as permissions go this is where your Group Policy is stored so users need read access when logging onto a Windows Client. The modify on the NTFS permissions is irrelevant for network access, because of the Everyone - Read at the shares level, i wouldn't modify these permissions as it can have some serious repercussions.

 

There is no real way or need to properly hide it on the server side, and as such there is always going to be a way to find this on a Mac or indeed a PC the sidebar lists will go some way to removing it from the view of a casual mac user but not anyone who has an real mac experience.

 

Disabling NetBios is a nice tip, but you also have to tell the clients to be compliant with the DHCP servers settings which is a pain to implement in a large environment.

 

I wouldnt worry about it, its aesthetically annoying at most