macclad17 Posted January 30, 2012 Posted January 30, 2012 I work in a school and i am trying to make it so that the students when they are logged in cannot create folders and put files in this on the C: obviously i know i could change the settings for this on every single machine in the school but i am trying to work out a way of doing this maybe with the registry edit or a script so that i can roll it out across the school. Working in XP. Thanks Macclad
macclad17 Posted January 31, 2012 Author Posted January 31, 2012 ye the pupils computers are all on a domain.
chazzy2501 Posted January 31, 2012 Posted January 31, 2012 Snipped this from the MSDN website: Hiding/Preventing Access to Drives You can use Group Policy settings to hide and restrict access to drives on the RD Session Host server. By enabling these settings you can ensure that users do not inadvertently access data stored on other drives, or delete or damage programs or other critical system files on drive C. The following settings are located in the Group Policy Management Console under User Configuration\Policies\Administrative Templates\Windows Components\Windows Explorer: •Hide these specified drives in My Computer. You can remove the icons for specified drives from a user’s My Computer folder by enabling this setting and using the drop-down list to select the drives you would like to hide. However, this setting does not restrict access to these drives. •Prevent access to drives from My Computer. Enable this setting to prevent users from accessing the chosen combination of drives. Use this setting to lock down the RD Session Host server for users accessing it for their primary desktop. These are group policy settings you can access them from (active directory users and computers) on your domain controller. Right click on their folder and select properties, then group policy. you should see at least one GPO if you edit one to include the above changes that should stop their access. You may want to spend some time watching some technet videos on managing a 2003 server, it should cover active directory and group policy. heres a start:Step-by-Step Guide to Understanding the Group Policy Feature Set good luck 1
macclad17 Posted January 31, 2012 Author Posted January 31, 2012 We would rather not stop the pupils from being able to see the drive completely just to stop giving them access to creating folders and then writing to them. Obviously if there is no other way to do this then we will take the steps posted above so thanks for your response.
macclad17 Posted January 31, 2012 Author Posted January 31, 2012 We don't that's what were trying to stop them from being able to do.
gl3nnym Posted January 31, 2012 Posted January 31, 2012 Surely it's just easier to hide the drive with restrictions to pupils? Out of sight out of mind and all that.
macclad17 Posted January 31, 2012 Author Posted January 31, 2012 just for extra security really, i don't care if they can see it as long as they can't write on to it. Just trying to cover our backs 100%
CyberNerd Posted January 31, 2012 Posted January 31, 2012 Hiding the drives is a workaround. Making the permissions secure is a fix.
gl3nnym Posted January 31, 2012 Posted January 31, 2012 Hiding the drives is a workaround. Making the permissions secure is a fix. We have the drives hidden and pupils cannot write/view the drive either. Never had a problem.
CyberNerd Posted January 31, 2012 Posted January 31, 2012 We have the drives hidden and pupils cannot write/view the drive either. Never had a problem. Thats a fix then
macclad17 Posted January 31, 2012 Author Posted January 31, 2012 So whats the best way to hide the drives then across a domain?
CyberNerd Posted January 31, 2012 Posted January 31, 2012 So whats the best way to hide the drives then across a domain? You can't - that's why it is a bodge. All it takes is for a kid to bring in a computer/tablet/phone and go \\computername\c$ and they still get write access to the C:\ drive. Macs and Linuxes won't even hide the $ share ( because windows only 'hides' it from windows clients) Like I said, the way to fix it is by securing the permissions - probably using a startup script.
macclad17 Posted January 31, 2012 Author Posted January 31, 2012 Okay well for now the drives have been hidden across the school, this is until i can work out a way of stopping write access!
msi Posted January 31, 2012 Posted January 31, 2012 (edited) You can't - that's why it is a bodge. Yes you can. See below. All it takes is for a kid to bring in a computer/tablet/phone and go \\computername\c$ and they still get write access to the C:\ drive. Suggest reading this article to understand the difference between Authenticated Users and Domain Users: Differences between Authenticated Users, Domain Users, and Everyone groups Also, it can be done domain-wide. You just need to know how to use Group Policy. ... and you really need to understand the concepts of ACLs, the difference between rights and security, builtin groups, domain groups, etc. Start here: Group Policy Management Console > Computer Configuration > Policies > Windows Settings > Security Settings > File System ... and don't blame me if you accidentally turn all of your domain computers into doorstops in the single click of a button ... and don't say I recommended you actually do this. Because it's a really dumb idea unless you only use software that is properly written. Which, in a school, is highly unlikely Edited January 31, 2012 by msi
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now