Controlling Libraries with Group Policy

[burgemaster]

Im having the same problems here.

 

Everything would be fine if the C:\users\public wasnt linked by default.

 

If I run the reg fixes to disable the libraries I aslo lose all links to the Documents/Music/Pictures on the start menu.

 

If there a way that I can remove the libraries and then re-add the 3 links to the profiles?

 

Also I cannot seem to remove the link to "Personal Folders"

 

Ive found the key in the reg, but cant seem to apply it:

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]

"Start_ShowUser"=dword:00000001

 

If anyone could please help ?

 

1) Remove the Personal Folders" link on start menu by GP

2) Remove the default setting adding "Public" to all users libraries.

3) Add the normal links back for My docs / pictures / music

 

Any help would be greatly appreciated!

For now i have denied access to "C:\user\Public" to staff.

[burgemaster]

Just Realised that when Staff - Deny permissions are set, click "defaults" in the libraries menu now does not recreate the share to the public folder

 

I guess i need a way to have the "default" run on log in, or the

 

"c:\Users\USERNAME\AppData\Roaming\Microsoft\Windows\Libraries" files deleted on startup

[mrbios]

I've managed to get a secure system with libraries running at last, incase it interests anyone this is how i have ours setup:

 

Group policy preferences:

GPP to delete the C:\Users\Public folder completely

otherwise the links in pictures and music redirected folders goes to the local folders within it, dont have to delete the whole thing but i do and it doesnt seem cause a problem

 

GPP to delete the registry key for libraries showing up in explorer:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{031E4825-7B94-4dc3-B131-E946B44C8DD5}

Reason for this is this part seems to go weirdly slow, without it everything seemed better (You don't lose the start menu stuff this way)

 

Mandatory profiles are configured and in the .v2 folder there are no folders anymore like there was with XP, just the ntuser.man files and nothing else, else you get the problem with a local folder and a redirected folder showing up!!!!

 

This key stops people being able to write to the root of the user share (the GP of: Prevent users from adding files to the root of their Users Files folder. partially does it but you can still save documents there) This stops people from writing anything there (and even pops up asking if you want to save it to a folder within, in our case goes to the root of the H: drive which was lucky):

 

Action: Create

Hive HKEY_CURRENT_USER

Key path Software\Microsoft\Windows\CurrentVersion\RunOnce

Value name Prevent Users from adding files to the root of the User share

Value type REG_SZ

Value data icacls %userprofile% /deny "%userdomain%\%username%":(WD,AD,WDAC)

 

Run in conjunction with this logoff script:

icacls %userprofile% /remove:d "%userdomain%\%username%"

icacls %userprofile% /grant "%userdomain%\%username%":(W,AD)

 

That should do it i think, i've prossibly missed something somewhere but that's the main jist of it (i'll tidy this post up when i have time )

 

EDIT: i also have GPPs to change the local appdata folder to being a hidden folder

Edited March 9, 2010 by mrbios

[dhoward_westexetc]

 

GPP to delete the registry key for libraries showing up in explorer:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{031E4825-7B94-4dc3-B131-E946B44C8DD5}

Reason for this is this part seems to go weirdly slow, without it everything seemed better (You don't lose the start menu stuff this way)

 

Is this for the business of a library folder taking 10 seconds to load up?

[mrbios]

Is this for the business of a library folder taking 10 seconds to load up?

 

Well, yes and no, my issue was that libraries took 10 seconds to do anything from the shortcuts on the explorer bar, the start menu icons work fine, so this removed the ones from the explorer bar

[dhoward_westexetc]

Well, yes and no, my issue was that libraries took 10 seconds to do anything from the shortcuts on the explorer bar, the start menu icons work fine, so this removed the ones from the explorer bar

 

Right, I have the slowness on the Start Menu shortcuts as well as those on the explorer bar. It does that even with the Public folder removed.

[dhoward_westexetc]

Hey all, thanks for your help. Managed to fix my Libraries issue by....denying Students access to the Public folder location. Now the libraries comes up in an instant!!

[Seker]

Thanks for the information on locking down libraries. For our faculty & staff, we don't currently plan on restricting their ability to customize, but we did want to be able to do some customizing ourselves.

 

As AngryTechnician indicated, Microsoft's official way is to customize and replace the .library-ms XML files, but that overwrites any customizations already made to a library. What we ended up doing is using a run-once login script to run some commands using a command-line utility I was able to find (I found a couple of them, actually) that removed the Public folders from the default libraries and also added some folders that we create on our employee's local disks for their personal music, pictures, etc. to the default libraries (we tend to dissuade them from putting non-school related, personal media on the network).

 

The downside was that the two utilities were just source code samples from Microsoft so I had to make them and then figure them out myself since there was virtually no documentation:

• Shell Library Command Line Source: Shell Library Command Line Sample (Windows)
  
• Shell Libraries Utility Source (select native APIs version): Shell Libraries | Windows 7 Online Training | Learn | Channel 9
  
• I also compiled them with some explanation here for convenience (links at end of article)
  

 

Hope this is useful. I'm glad I found these forums, though, as it looks like a lot of valuable information gets tossed around.

[gshaw]

2 years on from this thread, what are people doing with Libraries now?

 

a) disable completely (does this affect anything else?)

b) customise the library file to remove the Public locations

c) something else?

[DrCheese]

I customise the library file to remove the public locations.

 

Other than that, it's never been a problem at all. I have no idea why people are butchering Windows & removing them totally, putting them in an unsupported scenario.

[gshaw]

I customise the library file to remove the public locations.

 

Other than that, it's never been a problem at all. I have no idea why people are butchering Windows & removing them totally, putting them in an unsupported scenario.

 

Agree, once the Public locations are out the way I'll tolerate the rest in order to stay supported, likewise with roaming profiles \ Sysprep...

 

Edit: just did it from the Windows GUI and copied the resulting files across into the mandatory profile

Edited May 28, 2012 by gshaw

[bmagurn]

This seems to be the only viable option I've found after searching on the issue for 20 minutes.

 

grimadmin dot com. They've got a command line util to manage libraries. Which would allow you to remove the default C:\Users\Public... and have it work kinda the way it used to in XP, just redirecting to their networked document location.

 

I would post a link, but. The spam bots don't trust me.

[Jamo]

This seems to be the only viable option I've found after searching on the issue for 20 minutes.

 

grimadmin dot com. They've got a command line util to manage libraries. Which would allow you to remove the default C:\Users\Public... and have it work kinda the way it used to in XP, just redirecting to their networked document location.

 

I would post a link, but. The spam bots don't trust me.

 

Only 20 minutes? lol

 

I went down the copying custom XML files to the users. Made the mistake of making the files read only though..... yeah don't do that..... causes some strange 'read only' documents folder, but the sub folders underneath are writable! Confused a few staff that did!

[SYNACK]

I customise the library file to remove the public locations.

 

Other than that, it's never been a problem at all. I have no idea why people are butchering Windows & removing them totally, putting them in an unsupported scenario.

 

Agreed, I have been using them across three sites for two years and have had exactly one problem with them caused by a corrupted profile. Guess what the fix was for that, delete the library and it creates a new one automagiclly.

[sonofsanta]

Necro time!

 

Further to the below:

 

In a GPO that applies to the user, go to User Configuration > Preferences > Windows Settings > Folders

 

Create a new Folder preference and set the action to Delete

Set Path to %USERPROFILE%\Documents

Tick the following: Delete this folder (if emptied), Recursively delete all subfolders (if emptied), Delete all files in folder(s), and Allow deletion of read-only files/folders

 

On the Common tab:

 

Tick Run in logged-on user's security context (user policy option)

Tick Item-level targeting and click the Targeting... button

 

 

Add a new File Match item:

Match type: Folder exists

Path: %USERPROFILE%\Documents

 

Click OK twice.

 

Doing all that still didn't remove the Documents folder, as had been noted, and is generally a bit destructive. But there is A Better Way.

 

Do everything above, except instead of Delete, use Update and tick hidden. Everything else the same. Bam. Sorted.

 

You're welcome

[zbjsy]

that didnt work for me, still see 2 locations c:\users\public\documents and h:\

how can i remove c:\users\public\documents ? succesfffuly removed all the other ones

[sonofsanta]

that didnt work for me, still see 2 locations c:\users\public\documents and h:\

how can i remove c:\users\public\documents ? succesfffuly removed all the other ones

 

Did you follow my post above? (i.e. setting the folder to Hidden, instead of deleting it)

[zbjsy]

yes i did

[zbjsy]

do i change %userprofile% to c:\users\public\documents ?

[sonofsanta]

If you're trying to remove the public folders, I think the way I did it on my network was to run this code as a logon script batch file:

COPY /Y %0\..\w7_libraries_configuration_documents.xml "%APPDATA%\Microsoft\Windows\Libraries\Documents.library-ms"
COPY /Y %0\..\w7_libraries_configuration_music.xml     "%APPDATA%\Microsoft\Windows\Libraries\Music.library-ms"
COPY /Y %0\..\w7_libraries_configuration_pictures.xml  "%APPDATA%\Microsoft\Windows\Libraries\Pictures.library-ms"
COPY /Y %0\..\w7_libraries_configuration_videos.xml    "%APPDATA%\Microsoft\Windows\Libraries\Videos.library-ms"

with the following XML files in the script folder alongside the batch file

 

w7_libraries_configuration_documents.xml

 @shell32.dll,-34575
 S-1-0
 1
 true
 imageres.dll,-1002
 
   {7d49d726-3c21-4f05-99aa-fdc2c9474656}
 
 
   
   
 
 
   
     @shell32.dll,-34577
     true
     false
     
       knownfolder:{FDD39AD0-238F-46AF-ADB4-6C85480369C7}
     
   
 

 

w7_libraries_configuration_music.xml

 @shell32.dll,-34584
 S-1-0
 1
 true
 imageres.dll,-1004
 
   {94d6ddcc-4a68-4175-a374-bd584a510b78}
 
 
   
   
 
 
   
     @shell32.dll,-34586
     true
     false
     
       knownfolder:{4BD8D571-6D19-48D3-BE97-422220080E43}
     
   
 

 

w7_libraries_configuration_pictures.xml

 @shell32.dll,-34595
 S-1-0
 1
 true
 imageres.dll,-1003
 
   {b3690e58-e961-423b-b687-386ebfd83239}
 
 
   
   
 
 
   
     @shell32.dll,-34597
     true
     false
     
       knownfolder:{33E28130-4E1E-4676-835A-98395C3BC3BB}
     
   
 

 

w7_libraries_configuration_videos.xml

 @shell32.dll,-34620
 S-1-0
 1
 true
 imageres.dll,-1005
 
   {5fa96407-7e77-483c-ac93-691d05850de8}
 
 
   
   
 
 
   
     @shell32.dll,-34622
     true
     false
     
       knownfolder:{18989B1D-99B5-455B-841C-AB7C74E4DDFC}
     
   
 

 

I cannot, for the life of me, remember nor find where I got these files from, but I imagine it was on here somewhere.

[zbjsy]

many thanks, how are you coping them over via gpo ?

[sonofsanta]

many thanks, how are you coping them over via gpo ?

 

The batch script I detailed first runs as a logon script in the user policy. If the XML files are sat alongside it in the Logon folder for that policy, it will copy them over.

 

It obliterates any customisation that users have done on their own libraries, but that wasn't an issue for me.