Word 2003/Program UNC Browsing

[rh91uk]

:oHi all

 

I know similar threads have been posted so I'm sorry if I sound repetitive.

 

We have just moved our server's from Ranger to Vanilla. All very good, locked down most of the servers, redone all the permissions.

 

Now, I have a problem. Where as in windows explorer a user will get denied when they try and visit a UNC path - in Word, in the Open Dialog box, they can type in \\servername and get the server.

 

Now, i've tried turning off Computer browsing service, disabled all relevant gpos to do with network browsing (my network places etc) and double checked the permissions - but i'm not progressing anywhere! I haven't a clue how to stop kids going \\servername and stop browsing the network. I am at a loss. I have even tried an application policy in abtutor which doesn't work.

 

I know the permissions are there but I would really prefer the kids not to have the opportunity to go hunting.

 

Any help would really be appreciated, with reps awarded

 

Thanks

 

 

Richard

[FN-GM]

There is a way to stop it. Off the top of my head i dont know will have to look into group policy. What version of active directory are you using? Are you using Server 2003?

[rh91uk]

Hi FN-GM, thanks, would be really greatful. Active Directory Windows Sever 2003 R2

[rh91uk]

I have stopped browsing from word hyperlinks too, btw.

 

richard

[leco]

I seem to recall a GPO to prevent searching from the address bar - would that do?

[Gatt]

I had this issue not that long ago and I got round it by using access based enumeration. we were also using dfs so don't know if its needed for abe to work?

[rh91uk]

Hi all thanks for your replies. I tried the Access Based Enumeration but that doesn't do the job

 

Any other ideas?

[FN-GM]

Sorry i forgot to look i will have a look for it.

[Michael]

Unfortunately even if you lock down or remove access to 'My Network Places' some applications still ignore this and you can browse the network. However, on a positive, if you're good at setting permissions you have nothing to worry about.

 

Access Based Enumeration takes things one step further and completely hides shares a user doesn't have permission to access if you're after a little more stealth.

 

@richardharris, when you say ABE doesn't do the job, are you saying all shares are still displayed or users can access any share? Either way, you need to double check your permissions!

[rh91uk]

@ FN-GM thanks

 

@ Michael - sorry, I should of been more clearer. ABE does do the job, but I want to hide the computers when a user browses to \\servername.

 

All folder permissions are fine, thank god! Users can only access the shares they need to plus the share we install things on the network to. It's just things like seeing computers etc, but Computing Browsing Service is off in the services GPO and it's still happening.

 

I'm slightly confused Thank you all for the replies - it's good we can rely on edugeek when we're in a bit of a pickle.

 

Richard

[rvdmast]

Here's a few tricks i've learned that might help you.

Besides correct permissions and using ABE:

-If you create your shares using a name that ends with a $ sign, the share will be

invisible in the browse list, yet still accesible given the correct permissions.

Example: \\servername\shared will show up but \\servername\shared$ will not.

 

 

-The same goes for server names: using a (NetBIOS)name that ends with a $ sign,

the server will be invisible in the browse list. So server1 will show up in network neighborhood,

but server1$ will not.

 

Ofcourse this is a major change in your network and requires carefull planning and testing.

There are some applications that will work problematic with hidden shares/servers.

An example i've experienced is Veritas BackupExec: how am i going to add a certain share

to a backup job if i can't see it listed in the file/network browser!

 

One final trick i've found out by accident and is actually more a NetBIOS bug/limitation:

If the comment/description field in My computer/properties/computername tab is longer than

(i think) 24 characters the computer will also stop showing up in the browse list. But i can't

guarantee this will always work...

Edited May 24, 2009 by rvdmast

[rh91uk]

rvdmast - cheers for that! Something to look into with Soulfish.