william-swc

Hi, I need to add a security group to %systemroot% to grant modify permissions for a select group of students. I have tried creating a GPO computer configuration > Windows Settings > Security Settings > File System. I added a file for %SystemRoot% and added the security group in the permissions and granted modify rights. It is set to configure the file or folder then propogate inheritable permissions to all subfolders. This hasn't worked. The students need to run a piece of software which everytime it runs copies a dll file to c:\windows\. Am I applying the permissions right? thanks for any help William

Ok I've let my boss know where I'm at with this. The security issues are as follows: 'The policy change made to the printer properties hides the printer ok but any user can search for any computer (this includes all servers and their shares, etc) or any users details stored within AD on the network.' What can I do to lock this down?

As far as I'm concerned I'd be ok with it, but one of my bosses is real anal about security and says that if a student doesn't need something then they shouldn't even see it. I've made a few adjustments to a test GPO and am awaiting his feedback so will let you know.

Ok another problem has come to light related to this. I'm happy enough for the Find Printers dialog box to pop up however the user can click on browse location and view the whole AD structure! This would provide an unacceptable security risk. Is there anyway to get around this?

exactly, we use Desktop Authority to push out the printers so we don't have to worry about that.

thanks for the replies, I've already looked at all the options within Group Policy including what you suggested Richard. I think Michael that your suggestion could work for us. My only problem now is convincing the other campuses to do that too. Thanks again William

I know it's old but instead of creating a new thread I decided to resurrect! I too am looking a resolution to this problem. Our users use the windows classic menu as defined by group policy. This has only recently been enforced and as a security measure we have removed the search button from the start menu and explorer. The users don't have access to C drive and can only store their info on a personal network share. As you can imagine there have been a few complaints after they arrived back after summer break and weren't able to search their personal space. We have managed to enable search button and prevent them from searching the entire network and local hard drives however I can't find a way to remove the find printers button in the context menu of search. When I use the find printers button it allows me to display a list of shared printers across all 4 campuses! Using Group Policy we have ensured that users cannot connect to any of these printers however we want to remove the find printers option completely. Is there a script available or an option within group policy to perform this function?