Controlling Libraries with Group Policy

[mitchell1981]

Ok, so I know I'm getting ahead of myself here, but I wanted to set up a test network machine running Windows 7 so that I am prepared for it.

 

Everything works great apart from the fact that the documents shortcut on the start menu points to the Libraries, rather than directly at the documents folder. This wouldn't be a problem except that the libraries are pointing at the C: Drive User folders rather than my folder redirections on the server.

 

Anyone experimented with the Libraries stuff on a network yet? Are there any ways to control it with group policy and do I need a Windows 7 admin station to see those policies?

[FN-GM]

What version of server are you running?

[mitchell1981]

Server 2008. All up to date.

 

I did a search for Libraries and Libray in group policy and the only option I can find is one to turn them off completely. I may try that.

 

It seems weird that there are no more detailed controls for something that is a major new feature of Windows 7. Perhaps I'm missing something.

[jamesb]

It seems weird that there are no more detailed controls for something that is a major new feature of Windows 7. Perhaps I'm missing something.

 

No it doesn't. Server 2008 is designed to work with Vista. Server 2008 R2 probably has these controls in.

 

Once Windows 7 and Server 08 R2 are actually on the market I suspect they'll be a service pack/admin pack which'll add most of the controls to Server 2008, in the same way as they did for Server 03 and Vista.

[mitchell1981]

Yes you're probably right. Might have a play with the R2 beta then, although I expect that the group policies are probably one of the last things they work on.

[AngryTechnician]

It is already possible to add the Windows 7 group policies to Server 2008. If you copy the Group Policy .admx templates from a Windows 7 machine to the Group Policy Central Store on your SYSVOL share, any Server 2008 or Vista machine will be able to see the Windows 7 policies and set them (when logged in as a domain admin, obviously).

 

If you're not yet using a Central Store, see this article for how to set one up.

 

I have this set up on our domain, and I've had a quick look through for Library group policies - there aren't that many that I can see, which seems to be your experience already.

[AngryTechnician]

OK, first off - just checked the libraries on a standard user on our Windows 7 clients, and they are obeying folder redirection, so something is amiss if yours aren't.

 

It seems the libraries themselves are defined by a set of .libary-ms XML files in AppData\Roaming\Microsoft\Windows\Libraries - it might be possible to be replace these with a customised definition that could be pushed out via Group Policy Preferences.

[DrCheese]

Ours are obeying folder redirection but annoyingly they seem to leave the local public documents folder in the library as well and student accounts can add/remove folders! Is there anyway to turn this off? Group policy settings for the libraries feature are virtually non existent. Edited June 10, 2009 by DrCheese

[Nick_Parker]

Ours are obeying folder redirection but annoyingly they seem to leave the local public documents folder in the library as well and student accounts can add/remove folders! Is there anyway to turn this off? Group policy settings for the libraries feature are virtually non existent.

 

I've noticed this as well, it's creating a redirected copy under the librarys, but the local ones are also showing, I can see it creating confusion and people will end up saving into the local documents instead if the network documents.

[AngryTechnician]

Not a fix per se, but you could simply delete the local folder using Group Policy Preferences (or scripting if you haven't wrapped your head around GPP yet). We do this as a matter of course to keep the profiles tidy, so may be why we didn't notice this behaviour.

[Nick_Parker]

Not a fix per se, but you could simply delete the local folder using Group Policy Preferences (or scripting if you haven't wrapped your head around GPP yet). We do this as a matter of course to keep the profiles tidy, so may be why we didn't notice this behaviour.

 

Hmm, I think I'll give it a try

[Nick_Parker]

Not a fix per se, but you could simply delete the local folder using Group Policy Preferences (or scripting if you haven't wrapped your head around GPP yet). We do this as a matter of course to keep the profiles tidy, so may be why we didn't notice this behaviour.

 

You wouldn't happen to have a guide or a step-by-step for this would you?

[eddyc]

You wouldn't happen to have a guide or a step-by-step for this would you?

 

I could really do with one too if you get the chance to write one!

 

Ed

[DrCheese]

How are people who've deployed Windows 7 live dealing with this?

I'm testing it again on a domain at home, but I can't see anyway of preventing users from messing about with library settings, so even if I do lock off the c:\users\public folder that it seems obsessed with adding by default there is nothing to stop them adding something else or deleting all of the folders from the library.

Sure it would just get reapplied when they logon next but I still find it incredible that I can't prevent them in the first place. All I want is the redirected folder in the library and have the settings locked off.

 

I've tried setting the security on the library file in %appdata%\Microsoft\Windows\libraries but it doesn't seem to do much. All I can do is lock myself out from the folder.

 

I could disable libraries entirely but that's not supported by MS and it would remove all of the links in the start menu that go to docs/pictures/music and so on.

 

Argh!

[dhoward_westexetc]

I had the same issue on a Windows 7 client that I have at the moment for testing policies. Following AngryTechnician's guidelines seems to fix this in so far as the library only shows the redirected My Documents location and not the public one.

 

However one issue I am not sure about is that, under a restricted student account I always get a pause of around 5-10 seconds before the library will open. This does not happen under Staff or admin accounts. Has anyone else had this issue and know a way to prevent this delay? It may be a policy setting we have that is causing this, but I am not sure what!

[DJL]

We're having the same problem with the libraries taking 5-10 secs to open under restricted accounts. dhoward, did you ever find a fix for it?

 

It seems as though Microsoft completely forgot about controlling libraries with group policy.

[dhoward_westexetc]

We're having the same problem with the libraries taking 5-10 secs to open under restricted accounts. dhoward, did you ever find a fix for it?

 

It seems as though Microsoft completely forgot about controlling libraries with group policy.

 

Phew! I am glad I wasn't the only one!

 

In the end I just googled the reg files to disable libraries completely and then found a neat little add-on to add the Classic Start Menu back to Windows 7. It is called Classic shell, and the homepage is here: Classic Shell. There are of course others, which are freeware.

 

The nice thing about the classic menu is the links under documents are My Documents and My Pictures, not the libraries.

 

All I have to do under our student policy now is find a way of removing the Favorites shortcuts (Downloads etc) in Explorer (they cause explorer.exe to crash, so removing them is more stable), remove the user folders links and tweak the start menu a bit then it is done!

[Nick_Parker]

Phew! I am glad I wasn't the only one!

 

In the end I just googled the reg files to disable libraries completely and then found a neat little add-on to add the Classic Start Menu back to Windows 7. It is called Classic shell, and the homepage is here: Classic Shell. There are of course others, which are freeware.

 

The nice thing about the classic menu is the links under documents are My Documents and My Pictures, not the libraries.

 

All I have to do under our student policy now is find a way of removing the Favorites shortcuts (Downloads etc) in Explorer (they cause explorer.exe to crash, so removing them is more stable), remove the user folders links and tweak the start menu a bit then it is done!

 

You wouldn't happen to have a link to the reg file would you? And do you run it for every user that logs on? Or just on your default profile?

[Nick_Parker]

Not a fix per se, but you could simply delete the local folder using Group Policy Preferences (or scripting if you haven't wrapped your head around GPP yet). We do this as a matter of course to keep the profiles tidy, so may be why we didn't notice this behaviour.

 

Do you have some more details on this please?

[AngryTechnician]

In a GPO that applies to the user, go to User Configuration > Preferences > Windows Settings > Folders

 

Create a new Folder preference and set the action to Delete

Set Path to %USERPROFILE%\Documents

Tick the following: Delete this folder (if emptied), Recursively delete all subfolders (if emptied), Delete all files in folder(s), and Allow deletion of read-only files/folders

 

On the Common tab:

 

Tick Run in logged-on user's security context (user policy option)

Tick Item-level targeting and click the Targeting... button

 

 

Add a new File Match item:

Match type: Folder exists

Path: %USERPROFILE%\Documents

 

Click OK twice.

 

 

If it's set up correctly, you should see this when viewing the XML for the GPP item:

 

 
- 
  
- 
  
 
 

 

(The GUIDs may differ but everything else should be the same)

 

Obviously if this works it WILL DELETE DATA, and if it goes awry it may delete the wrong data, so test first and use at your own risk.

[Nick_Parker]

In a GPO that applies to the user, go to User Configuration > Preferences > Windows Settings > Folders

 

Create a new Folder preference and set the action to Delete

Set Path to %USERPROFILE%\Documents

Tick the following: Delete this folder (if emptied), Recursively delete all subfolders (if emptied), Delete all files in folder(s), and Allow deletion of read-only files/folders

 

On the Common tab:

 

Tick Run in logged-on user's security context (user policy option)

Tick Item-level targeting and click the Targeting... button

 

 

Add a new File Match item:

Match type: Folder exists

Path: %USERPROFILE%\Documents

 

Click OK twice.

 

 

If it's set up correctly, you should see this when viewing the XML for the GPP item:

 

 
- 
  
- 
  
 
 

 

(The GUIDs may differ but everything else should be the same)

 

Obviously if this works it WILL DELETE DATA, and if it goes awry it may delete the wrong data, so test first and use at your own risk.

 

Thanks AngryTechnician, no luck tho, still leaves the "documents" folder.

[dhoward_westexetc]

You wouldn't happen to have a link to the reg file would you? And do you run it for every user that logs on? Or just on your default profile?

 

Sorry to be slow to reply, been a hectic couple of days!

 

This is the link to the web page that I found to disable Libraries: How to Disable “Libraries” Feature in Windows 7? - Tweaking with Vishal

 

They come as a zip file. It is a per machine setting so you can run it once on the machine and it will apply to all users. You could even put it in the base image I guess!

[bmdixon]

There is a custom gpo that can be used to do this.

It's here. It allows you to remove more than just the Libraries, we're using it here on our W7 machines in the office.

[dhoward_westexetc]

There is a custom gpo that can be used to do this.

It's here. It allows you to remove more than just the Libraries, we're using it here on our W7 machines in the office.

 

You are a class A hero! My Windows 7 student PCs are now complete !! I just have to build them now!

 

I notice it only hides libraries, not disables them completely. I may still run the reg file to disable them, but this will solve the Favorites links as well.

[hcrejazz]

We also found that quite a few applications try to write to these areas so if you disable them you're out of luck. Still need some more testing but so far that's our findings.