[sims] SIMS drive - S: permissions

[petben]

I want to set ntfs permissions on the sims S: drive on win2008r2. don't want to go too granular. I imagine there are a number of folders that need modify (nova, exams etc) but is there any guidance on tying down the current 'staff Full control' which is how crapita left it?

[mcrompton01]

Hi,

 

We have the whole drive set to read only apart from the following folders which have the Modify permission:

\SIMS\SNOVA

\SIMS\Options

\SIMS\Star\ctfout

\SIMS\Star\ctfin

\SIMS\ascout

\SIMS\examin

\SIMS\examout

\SIMS\examhold

\SIMS\attend

 

These folders were given to us from our County Support unit, however there may be more but we haven't found any in two years.

 

Mark

[petben]

thanks, how about docstorage?

 

it disturbs me any staff member can type S: into the address bar and browse the S drive but I can't see how to stop that. S is hidden in my computer but I can't stop them browsing via this method. can't set gpo to restrict 'run' command (which would do it) but this stops software (such as Edexcel livetext) that needs to display and browse folder content working....

[mcrompton01]

We have DOCSTORAGE on a separate drive that is not mapped, shared or accessible to staff.

 

We don't have the worry about the 'run' command as this is disabled at our site and the F: drive (for us) is hidden from users. We had to take drastic steps after one teacher mistook the F:\ drive for their home directory and deleted anything not to do with history.

 

That was a fun day

[petben]

thanks, do you not have applications on mapped drives that for example are just collections of resources and hence need to be browsed, usually from an index.html or something?

[mcrompton01]

We have loads of programs with resources but in most cases we use a public drive that is mapped but hidden with a shortcut to the program e.g index.html or we create virtual CDs. If there are shared resources that need to be browsed we place them on the student or staff shared area and just tell them to look there. For example all the Cubase examples/help are on the student shared.

[petben]

going slightly off topic here but presumably even if the drive is hidden if they type the mapped drive letter into an explorer address bar they can browse the drive?

[mcrompton01]

No, if they enter the drive letter into the address bar they get the error message 'Resource not allowed'. However if they create a shortcut to the drive letter they can browse it, got no real way of stopping that unless I use File Server Resource Manager to prevent .lnk files being created.

[petben]

ok last question!

how do you get the 'resource not allowed' message to display? my mapped drive is set in group policy preferences to be hidden and it doesnt appear in my computer but they can def browse it in that way...

[mcrompton01]

very good question, I'll try and figure it out today when I get in to work. Found it:

 

-> User Configuration

-> Administrative Templates

-> Start Menu and Task Bar

-> Remove Run menu from Start Menu

 

This stops them using the run box and IE/Explorers address bars to type in Drive Letters/UNC paths. Not very helpful I know as your first post says you need this disabled (to show the run box).

Edited February 5, 2013 by mcrompton01