Jaan Posted February 12, 2018 Posted February 12, 2018 We are currenlty testing windows 10 GPOs in our test lab. On our windows 7 machines with 7 only GPOs (WMI filters), users are unable to access the local machines disk via \\computername\c$ (C: is hidden in file explorer) or any other location for that matter eg \\file-server\d$ as they get a pop saying that its disabled. On the windows 10 machines, users are able to access the local machines c:\ in file explorer via \\computername\c$ (C: is hidden in file explorer) and when trying to access a server share eg \\file-server\d$ as they get confirm your user credentials (which they don't have.) sure i'm just over looking a gpo here but can't see the forest because of the trees! Anybody got any pointers please?
Steve21 Posted February 12, 2018 Posted February 12, 2018 Remove Run menu from Start Menu is the one that blocks UNC paths by explorer (e.g. run bars etc) But there's also the adminshare access in terms of physical permissions? Steve 1
Jaan Posted February 12, 2018 Author Posted February 12, 2018 Thanks i'll give that a try now. I purposefully skipped that one as it doesn't list anything after 8.1 as a supported OS. Now i'm wondering what else i've missed!
6Foot2 Posted February 12, 2018 Posted February 12, 2018 We haven't deployed Windows 10 yet, but perhaps this Microsoft spreadsheet will help: Link: Group Policy Settings Reference for Windows and Windows Server You can use the filtering capabilities that are included in this spreadsheet to view a specific subset of data, based on one value or a combination of values that are available in one or more of the columns. In addition, you can click Custom in the drop-down list of any of the column headings to add additional filtering criteria within that column... 3
Jaan Posted February 12, 2018 Author Posted February 12, 2018 Yeah the GPO you recommend i change worked! Thanks again for your input.
Steve21 Posted February 12, 2018 Posted February 12, 2018 I purposefully skipped that one as it doesn't list anything after 8.1 as a supported OS. Now i'm wondering what else i've missed! Don't believe Microsoft, it's not like they make Windows! Always better to apply all and remove one by one haha Steve
abaxter2 Posted February 12, 2018 Posted February 12, 2018 (edited) Just to mention that the "Remove Run from the Start menu" does not stop the user using the Windows 10 search on the taskbar - if a user types a UNC into the windows 10 search / cortana that is on the task bar, the user will get access / promoted for a username and password. https://social.technet.microsoft.com/Forums/lync/en-US/10eb0df5-2a34-4ea0-a5b7-eeb551990d50/windows-10-gpo-to-lock-down-search-access-to-unc-and-c?forum=winserverGP https://community.spiceworks.com/topic/2001244-can-you-stop-windows-10-browsing-unc-from-search https://www.tenforums.com/tutorials/2854-hide-show-search-box-cortana-icon-taskbar-windows-10-a.html Edited February 12, 2018 by abaxter2 2
Jaan Posted February 14, 2018 Author Posted February 14, 2018 I hate the fact there isn't a simple GPO to remove the taskbar search icon........ Which method did you use abaxter2?
Steve21 Posted February 14, 2018 Posted February 14, 2018 HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search SearchboxTaskbarMode - Set to 0 to hide it completely, 1 is just search, and 2 is search+cort Steve 3
Driftingashore Posted March 23, 2018 Posted March 23, 2018 HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search SearchboxTaskbarMode - Set to 0 to hide it completely, 1 is just search, and 2 is search+cort Steve This hides the button (which is a start), but it looks like - here at least - users can still just type from the start menu and browse to c$ (etc) shares from the box that pops up, so really this just makes it a bit more obscure. Anybody got any ideas on how to stop this?
Steve21 Posted March 23, 2018 Posted March 23, 2018 Haven't got a machine to hand to test it on, but did you actually apply the original GPO to stop UNC paths being run? That was a 2nd part of a fix you linked above Steve
Driftingashore Posted March 23, 2018 Posted March 23, 2018 If you're referring to the "Remove Run menu from Start Menu" policy, then yes, we have that enabled. I'd be interested in knowing if it doesn't work for you, as that means there's probably a setting somewhere we've missed..
Jaan Posted March 23, 2018 Author Posted March 23, 2018 Just tested this. And from the start menu if i start to type "\\computername\c$" i can access the c drive
Driftingashore Posted March 23, 2018 Posted March 23, 2018 (edited) I know there's a GPO to kill Cortana, but I haven't tried it because it's a machine policy and I don't really want to kill it for everybody - just the pesky kids. Not sure if it'd help or not, but it's no good for me anyway. Computer Configuration > Administrative Templates > Windows Components > Search> Allow Cortana My frantic googling today has led me to these; neither prevent entering shares from start, but aim to prevent access to c$ / admin shares to users without disabling them. I haven't tested either, so be careful - just posting them in case they're helpful. Hopefully they're not a dead end.. https://social.technet.microsoft.com/Forums/windowsserver/en-US/b168408e-a540-4e3a-92cc-3121486ceb78/admin-shares-available-to-nonadministrative-users-over-loopback-address?forum=winserversecurity https://serverfault.com/questions/835716/how-to-prevent-access-to-127-0-0-1-c-or-localhost-c/835962 Edited March 23, 2018 by Driftingashore
Driftingashore Posted March 23, 2018 Posted March 23, 2018 I don't want to disable the admin shares because they're useful; I just hope to prevent access to the c$ / admin$ shares for students and exam users. They can't do a whole lot there except browse the drive or save files to the root of C:\ but I'd rather not have anyone browsing the drive to discover / launch software that isn't meant for them or save any files to the local machine (though I consider the latter to be a little unlikely). At the moment this is a hypothetical issue more than anything though.
mavhc Posted March 23, 2018 Posted March 23, 2018 Set permissions so they can't save, and so they can't run things they shouldn't be able to, problem solved. Also fixes apps that don't use standard dialog boxes bypassing the policy
mickyuk Posted April 19, 2018 Posted April 19, 2018 Set this binary key and all works fine with windows 10. We are using LTSB version 10.0.14393 build 14393 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\DefaultSecurity]"SrvsvcShareAdminConnect"=hex:01,00,04,80,64,00,00,00,70,00,00,00,00,00,00,00,\ 14,00,00,00,02,00,50,00,03,00,00,00,00,00,18,00,03,00,0f,00,01,02,00,00,00,\ 00,00,05,20,00,00,00,20,02,00,00,00,00,18,00,03,00,0f,00,01,02,00,00,00,00,\ 00,05,20,00,00,00,25,02,00,00,00,00,18,00,03,00,0f,00,01,02,00,00,00,00,00,\ 05,20,00,00,00,27,02,00,00,01,01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,\ 00,00,00,05,12,00,00,00 1
xlandhenry Posted April 20, 2018 Posted April 20, 2018 If you want to prevent them from running things not meant for them, best way is to use AppLocker in my opinion.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now