Shortcut to C: Drive

[simpsonj]

A nice security flaw in Windows 7 that I wondered if anyone else has fixed, as I can't find an elegant solution. Student logs in, right clicks in My Documents - New - Shortcut, types in C:\ and there you go, complete access to the C:\ Drive. This is despite having a GPO that is meant to restrict access to C: (How To Restrict Access To Drives In My Computer In Windows - How-To Geek).

 

I could prevent users from creating shortcuts (I think) however it is a mandatory part of the OCR or Cambridge Nationals ICT course, and would probably cause more trouble than it's worth. I'm loathe to change permissions on the C: drive as that tends to cause a lot of issues, and changing permissions on C:\Windows (the main folder I want to protect) appears to be a big no no.

 

Any other ideas?

[chazzy2501]

I don't allow right click in explorer, I also don't have a new shortcut link available. I even copied a shortcut from another folder and tried to edit it to point to c:\ but it wouldn't allow it. I can't say what GPOs I selected but I am saying it's possible.

[Steve21]

A nice security flaw in Windows 7 that I wondered if anyone else has fixed, as I can't find an elegant solution.

 

 

What are they doing in C anyway? I'm assuming exe's are blocked from running? Programs can be accessed anyway etc

 

Steve

[simpsonj]

What are they doing in C anyway? I'm assuming exe's are blocked from running? Programs can be accessed anyway etc

 

Steve

 

At the moment, it's just one student pushing the boundaries of my security. But it's a concern that I can't block this access, at least not without either potentially bricking the PCs through excessive permissions, or preventing shortcut creation.

[6Foot2]

We have prevented students from creating shortcuts and nobody is screaming yet.

[simpsonj]

I'll have a word with the ICT Teacher.

 

Maybe I can just prevent access to Right Click - New. If they need a shortcut ot anything they can just right click on the icon they want to shortcut to, and create it that way.

 

Thanks for the ideas!

[Davit2005]

Removed the My Documents link on the Start Menu here. Done before Win7 roll out so no one noticed the change :-).

[simpsonj]

Seems it's all or nothing to remove the context menu, which I don't think is really a viable option.

 

Interestingly, the running of shortcuts should be blocked by my Software Restrictions GPO, but it doesn't seem to want to block .lnk files, but will happily block .exes.

[simpsonj]

Best answer I've found so far: Disable Context Menu (New-Create Shortcut)

 

Requires a reg hack, which isn't my favourite method of fixing anything, but trying it to see if it works.

[simpsonj]

Just a final update, to achieve this in Windows 7, remove the NullFile Reg_SZ Data Value instead of the COMMAND data value.

 

*EDIT* Please note I have only tested this on a virtualised machine, and have not rolled it out across my network, so ensure to test this thoroughly as I do not know what else this might have an impact on! And, you know, you're messing with the registry, so ensure you've got a back up somewhere

Edited June 22, 2012 by simpsonj
Disclaimer added