I'm trying to lock down security for on my companies workstations. Is it possible to prevent my users from being able to save music files to there local drives (and even further shared drives) through group policies?
If so, how do I go about configuring group policies to achieve this goal?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
You cannot restrict file types from being saved on a workstation level via GPO. You would need to use 3rd party software or from what I have heard 2008 will do this. You can restrict file types on shares on the servers though.
http://blogs.techrepublic.
http://www.petri.co.il/for
Alternately you could do a software restiction policy to prevent users from opening Media Player. This will allow them to save the files, but not open them unless they download a 3rd party app to play them.
http://support.microsoft.c
I am not aware of any native way to prevent writing file types to a desktop however as far as a file server, in Server 2008, you can apply a filter type to prevent file types.
http://technet.microsoft.c
Perhaps a scheduled task that searches the local drive for music and then deletes it would wok. It would not prevent the end user from creating them but if they keep getting deleted then perhaps they would stop saving them.
How's about just hidding the local drive and not letting them save anything to it? You can do this through a GPO
(User Configuration\Administrati
Note: users can still access the drive by other methods, ie they could map to it using net use.
I also disable the cmd prompt for users. I have one user I had to lock down completely, I did it through his registry settings. Shown below.
I don't allow users to save anything to their local drive, everything is on shared drives and I use Active Directory to deny or grant them permission to specific folders. They can save to the My Document folder, but I remap its location. It is much easier to backup one server than many PC's. You could then also do a quick search & destroy on the server for any music files. I also shut off streaming audio radio stations via DNS. it's a little harder because you have to know what stations they listen to. You then put that site as a forward looking entry. Instantly blocked. I also blocked YouTube and Instant Messanger via this method. It is also a good way to shutdown online gamers.
Create a text file with the following simple scripts:
cd\
c:
del /F /S /Q *.mp3; *.m3u; *.rm
The above script will look for files in C drive and delete all the three type of files specified above. In the same you need to add for D Drive and E Drive depending on the number of partitions you have. The reason for "Cd\" and "C:" parameters is that we want to have C drive as the root for our search and delete specified files in its subfolders and their subfolders.
How to make it happening:
You can either add it to the workstation's scheduled task or add to startup
Hope this helps. please be aware that users may change the mp3 file extension to txt which this script will skip. If you wish to avoid that problem, i would suggest you to use a software that does a format scan.
Business Accounts
Answer for Membership
by: ashwin_kumar525Posted on 2009-01-13 at 07:04:20ID: 23363355
I dont think there is a way to do it using group policies but you can create a simple batch file to delete the music files and let it run on startup as log on script or periodically run it on all the computers.