witch Posted March 15, 2012 Posted March 15, 2012 We have right-click disabled by group policy and the head of ICT is asking for it to be restored as he finds it difficult to get by without it. He mentioned 'save target as' and 'open in new tab' as two examples of things the students cannot do. Can you give me some arguments for and against? I know they could delete or rename desktop shortcuts but whilst annoying that wouldnt really matter as they are redirected. They could look at the properties of a file but they wouldnt be able to change security permissions or anything, would they? This is a middle-deemed-secondary - Years 5 to 8
sippo Posted March 15, 2012 Posted March 15, 2012 We give right click access as part of an IT course students need to create new shortcut, rename files etc. With redirected start menu's and desktops, I don't see it being an issue. Yes they might be able to rename icons whilst logged on but as soon as they log off it resets anyway.
Arcath Posted March 15, 2012 Posted March 15, 2012 I never disable right click. I redirect the desktop to a share that they only have read access to (much to the dismay of the staff) so they can't rename stuff even if they wanted too.
3s-gtech Posted March 15, 2012 Posted March 15, 2012 We currently disable, but much has changed since this was set - including the move to mandatory profiles. I need to look at re-enabling it, it does rather hobble things without.
witch Posted March 15, 2012 Author Posted March 15, 2012 Are there other things apart from the desktop that they could potentially sabotage? We have roaming profiles here
DMcCoy Posted March 15, 2012 Posted March 15, 2012 There is no valid reason for disabling right click (which can't be bypassed easily anyway). Sure you can get to the properties of some items, but these can all be locked in other places in the policy.
cneilson6 Posted March 15, 2012 Posted March 15, 2012 We have right click disabled for students but enabled for staff. Though i agree it is possible to lock down anything that might be accessed via right click it does add an extra layer of security
pete Posted March 15, 2012 Posted March 15, 2012 If your network is configured correctly, you have no reason to disable right-click. If your network is incorrectly configured and you're relying on right-click removal as a band-aid, you're stuffed anyway.
witch Posted March 15, 2012 Author Posted March 15, 2012 (edited) If your network is configured correctly, you have no reason to disable right-click. If your network is incorrectly configured and you're relying on right-click removal as a band-aid, you're stuffed anyway. Thanks for that... That's the whole point of this - what MIGHT they be able to access if the network is incorrectly configured - right-click has always been disabled since the server was installed - not by me - and so it may be that because of that, some configuring isn't in place which should be there. I'm just asking for a bit of advice to make sure that I havent missed something before I re-enable it. Several people, whose opinions I value, have right-click disabled and I am asking the question as to why this is? Edited March 15, 2012 by witch
cromertech Posted March 15, 2012 Posted March 15, 2012 We have right click enabled here. I even allow pinning items to the taskbar for win7. As the students have roaming appdata this allows them to access more commonly used programs quickly and without me having to fill the taskbar with icons at staff request. Just make sure you go through the things that can be done with a right click (and there are too many to list TBH) and see if they should sensibly be disabled or not. Sorry can't be too much more help really but as long as you remove the obvious disallow access to start menu and task bar preferences disallow access to command line (shift and right click will allow to open command window at location) That should prevent serious problems as most other options are related to their own profile and if they stuff that up there's really only one person to blame 1
witch Posted March 15, 2012 Author Posted March 15, 2012 Can you tell me where those are? Can't find them in the policy settings
pete Posted March 15, 2012 Posted March 15, 2012 (edited) Thanks for that... That's the whole point of this - what MIGHT they be able to access if the network is incorrectly configured - right-click has always been disabled since the server was installed - not by me - and so it may be that because of that, some configuring isn't in place which should be there. I'm just asking for a bit of advice to make sure that I havent missed something before I re-enable it. Several people, whose opinions I value, have right-click disabled and I am asking the question as to why this is? Why not try to see what you can break or access on a student account with right-click enabled? I suspect you'll probably be able to make a hideous pink-on-pink colour scheme so you can't tell what's what on the screen, you'll be able to create shortcuts to local and network locations (and applications) if you know or can browse the path, you'll be able to view the details of any shortcuts, shares, etc. In short, if your file permissions (or desired access rights) to things on the network are incorrectly configured, the kids will be able to make easy shortcuts to them and run/browse/them. For example, if you're storing scripts or programs in Netlogon or Sysvol, the kids will be able to access them. Unless you're also disabling browsing of UNC paths (can work around that too). So, are your file permissions appropriate? Have you set the Control Panel/Display GPOs to prevent unreadable pink? Can a kid reset their daft personalisations by logging out / rebooting the machine to clear the cached profile? Have you run access enumerator (free tool) against your shares to check the permissions you think are set are accurate? There's so many things the person who installed your server could have got wrong, that's it's not really right-click that's the issue. Edited March 15, 2012 by pete 1
cromertech Posted March 15, 2012 Posted March 15, 2012 Can you tell me where those are? Can't find them in the policy settings user config /admin templates /start menu and task bar/ prevent changes to taskbar and start menu settings and user config/admin templates/system/ prevent access to command prompt 1
witch Posted March 16, 2012 Author Posted March 16, 2012 It's not quite as bad as that, @pete! I set up most of the policies so I know what is there and what isn't - I just needed to know if I had missed anything. So far I havent found anything that they can do if right-click is enabled, so hopefully all will be well now. Unless anyone knows any different......
3s-gtech Posted March 16, 2012 Posted March 16, 2012 (edited) Just found what's stopping us here - lovely Intel graphics drivers give students full access to mess with the display settings from the desktop context menu. Just need to find how to remove the entries for these, probably some fairly simple registry tweaks. Everything else undesireable is already locked out. Will try http://www.intowindows.com/how-to-remove-intel-menu-graphics-properties-graphics-options-intel-tv-wizard-from-windows-7-desktop-context-menu/ Edited March 16, 2012 by 3s-gtech 1
witch Posted March 16, 2012 Author Posted March 16, 2012 We havent got Intel drivers and I can't see anything like that so hopefully all will be well
Earthling Posted March 16, 2012 Posted March 16, 2012 I have it disabled more on principle than anything else. We had a problem for a while with the Intel graphics control panel in the system tray, kids/teachers rotating the screen etc. I stamped on that, by disabling Rotation and removing the icon from the system tray. But I notice some of the latest drivers don't have the 'disable rotation' anymore. TBH, I don't have the time to look at it again, I've had no requests about enabling the Context Menu, so until then, it'll stays disabled.
Flakes Posted March 16, 2012 Posted March 16, 2012 Its disabled here, they can do everything they need to through the file/edit menus, no need for right click. as for opening things in a new tab just give them a mouse with a middle button(scrollwheel) as middle click opens link in new tab by default. 2
36Degrees Posted March 16, 2012 Posted March 16, 2012 as for opening things in a new tab just give them a mouse with a middle button(scrollwheel) as middle click opens link in new tab by default. You learn something new every day!
p858snake Posted March 16, 2012 Posted March 16, 2012 We have right-click disabled by group policy and the head of ICT is asking for it to be restored as he finds it difficult to get by without it. He mentioned 'save target as' and 'open in new tab' as two examples of things the students cannot do. Disabling right click doesn't effect it in most apps... I don't remember using it in IE was a issue (IE6 at least)... Just found what's stopping us here - lovely Intel graphics drivers give students full access to mess with the display settings from the desktop context menu. Just need to find how to remove the entries for these, probably some fairly simple registry tweaks. Everything else undesireable is already locked out. Will try How To Remove Intel Menu (Graphics Properties, Graphics Options, & Intel TV Wizard) From Windows 7 Desktop Context Menu Even if yo9u hide that, they can still use the keyboard shortcuts =(
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now