Stop students being able to create folders on the C: drive in XP

[macclad17]

I work in a school and i am trying to make it so that the students when they are logged in cannot create folders and put files in this on the C: obviously i know i could change the settings for this on every single machine in the school but i am trying to work out a way of doing this maybe with the registry edit or a script so that i can roll it out across the school. Working in XP.

 

Thanks Macclad

[slugshead]

Do you not have a domain?

[macclad17]

ye the pupils computers are all on a domain.

[chazzy2501]

Snipped this from the MSDN website:

 

Hiding/Preventing Access to Drives

 

You can use Group Policy settings to hide and restrict access to drives on the RD Session Host server. By enabling these settings you can ensure that users do not inadvertently access data stored on other drives, or delete or damage programs or other critical system files on drive C.

 

The following settings are located in the Group Policy Management Console under User Configuration\Policies\Administrative Templates\Windows Components\Windows Explorer:

•Hide these specified drives in My Computer. You can remove the icons for specified drives from a user’s My Computer folder by enabling this setting and using the drop-down list to select the drives you would like to hide. However, this setting does not restrict access to these drives.

•Prevent access to drives from My Computer. Enable this setting to prevent users from accessing the chosen combination of drives. Use this setting to lock down the RD Session Host server for users accessing it for their primary desktop.

 

These are group policy settings you can access them from (active directory users and computers) on your domain controller. Right click on their folder and select properties, then group policy. you should see at least one GPO if you edit one to include the above changes that should stop their access.

 

You may want to spend some time watching some technet videos on managing a 2003 server, it should cover active directory and group policy.

 

heres a start:Step-by-Step Guide to Understanding the Group Policy Feature Set

 

good luck

[macclad17]

We would rather not stop the pupils from being able to see the drive completely just to stop giving them access to creating folders and then writing to them. Obviously if there is no other way to do this then we will take the steps posted above so thanks for your response.

[macclad17]

We don't that's what were trying to stop them from being able to do.

[gl3nnym]

Surely it's just easier to hide the drive with restrictions to pupils? Out of sight out of mind and all that.

[macclad17]

just for extra security really, i don't care if they can see it as long as they can't write on to it. Just trying to cover our backs 100%

[slugshead]

we always hide C, never had a problem

[macclad17]

thanks, worth knowing!

[CyberNerd]

Hiding the drives is a workaround.

Making the permissions secure is a fix.

[gl3nnym]

Hiding the drives is a workaround.

Making the permissions secure is a fix.

 

We have the drives hidden and pupils cannot write/view the drive either. Never had a problem.

[CyberNerd]

We have the drives hidden and pupils cannot write/view the drive either. Never had a problem.

 

Thats a fix then

[macclad17]

So whats the best way to hide the drives then across a domain?

[CyberNerd]

So whats the best way to hide the drives then across a domain?

 

You can't - that's why it is a bodge.

 

All it takes is for a kid to bring in a computer/tablet/phone and go \\computername\c$ and they still get write access to the C:\ drive.

Macs and Linuxes won't even hide the $ share ( because windows only 'hides' it from windows clients)

 

Like I said, the way to fix it is by securing the permissions - probably using a startup script.

[macclad17]

Okay well for now the drives have been hidden across the school, this is until i can work out a way of stopping write access!

[msi]

You can't - that's why it is a bodge.

 

Yes you can. See below.

 

All it takes is for a kid to bring in a computer/tablet/phone and go \\computername\c$ and they still get write access to the C:\ drive.

 

Suggest reading this article to understand the difference between Authenticated Users and Domain Users:

 

Differences between Authenticated Users, Domain Users, and Everyone groups

 

Also, it can be done domain-wide. You just need to know how to use Group Policy.

 

... and you really need to understand the concepts of ACLs, the difference between rights and security, builtin groups, domain groups, etc.

 

Start here:

 

Group Policy Management Console > Computer Configuration > Policies > Windows Settings > Security Settings > File System

 

... and don't blame me if you accidentally turn all of your domain computers into doorstops in the single click of a button

 

... and don't say I recommended you actually do this. Because it's a really dumb idea unless you only use software that is properly written. Which, in a school, is highly unlikely

Edited January 31, 2012 by msi