Solved

How do I prevent use of Windows Explorer Address Bar to get to C drive?

Posted on 2008-10-30
8
4,309 Views
Last Modified: 2013-12-05
On Windows Server 2000, using Terminal Services, I have hidden the C and D drives via AD Group Policy, but in Windows Explorer, how to I prevent use of the Address bar to get to C:\?   The C drive (and it's contents) needs the NTFS permissions to be Everyone, so I cannot prevent users from access to the C drive while in Windows Explorer through NTFS permission changes.   I thought that perhaps there would be an AD Group Policy and/or reg hack for this, but I cannot find it.  Goal is for users to get a simple "Access Denied" message if they type C:\ in the Windows Explorer Address bar.
0
Comment
Question by:uswrad
  • 5
  • 2
8 Comments
 
LVL 38

Expert Comment

by:Rich Rumble
ID: 22852178
You can't, and that AD Group Policy thing is a joke. And if you think about it, hiding it from the my computer screen is the best you can do. Programs run as the person who started them, so if you open IE, your name is in the process list as the username. So if username can't view the C: or some interupt happens, the program will never be run in the first place.
Perhaps there is another way... what is the real goal? Prevent software installs?
-rich
0
 

Author Comment

by:uswrad
ID: 22853225
The goal is to publish Windows Explorer on a MS Windows Server 2000 Terminal Services server (already being done) and at least block the obvious ways that a user could accidentally get into trouble (like going to the Server C drive instead of his local client C drive.  

My real problem is that this was already accomplished several years ago on some servers we have by an outside consultant but we did not document how he accomplished it and he is no longer available.  We are just wanting to do what is already working on older servers on our newer servers (still Windows Server 2000 server).   We tried the obvious AD setting under the User config area  titled "Prevent access to drives from My Computer." However, blocking access through this group policy setting prevents Windows Explorer from running for a user (as you mention in your post above).

We are launching Explorer.exe from a simple command line script (after the script simply maps the drives/resources the user SHOULD have access to), so I'm wondering if there might be a "switch" that prevents direct use of the Address bar OR (as second option for a solution) removes/hides the Address bar all together.
0
 
LVL 38

Expert Comment

by:Rich Rumble
ID: 22853366
You can simply go to view and uncheck address bar? is that what you wanted.
Also, there are quite a few switches for explorer
http://support.microsoft.com/kb/307856
But they don't do what you want necassarily, you could use them in combination to do what you  want, disable the buttons and address bars, then call "Explorer /e,C:\some_folder\you_want" and there is not apparent way to go up or down directories.
This may also help: http://www.microsoft.com/windowsxp/downloads/powertoys/xppowertoys.mspx
-rich


0
Use Case: Protecting a Hybrid Cloud Infrastructure

Microsoft Azure is rapidly becoming the norm in dynamic IT environments. This document describes the challenges that organizations face when protecting data in a hybrid cloud IT environment and presents a use case to demonstrate how Acronis Backup protects all data.

 
LVL 38

Expert Comment

by:Rich Rumble
ID: 22853466
The registry settings are:http://support.microsoft.com/?kbid=842903
You should be able to make the setting as an admin, copy the profile to all users and it should stick, until someone sees they can put a check next to them in view...
-rich
0
 

Accepted Solution

by:
uswrad earned 0 total points
ID: 22957328
I finally found the correct specific group policy setting that blocks users from typing C:\ (or any paths to drives) in the Address bar.   It is NOT under the Windows Explorer group policy area and it does not have a name that you would predict.

Under User Configuration/Administrative Templates/Start Menu and Taskbar, enabled Remove Run menu from Start Menu

Here is part of what is stated in the Description for this policy setting:
"Allows you to remove the Run command for the Start menu, Internet Explorer, and Task Manager.   If you enable this setting, the following changes occur:  (1) The Run command is removed from the Start menu.  (2) The New Task (Run) command is removed from Task Manager.  (3) The user will be blocked from entering the following into the Internet Explorer Address Bar:
- A UNC path: \\<server>\<share>
- Accessing local drives:  e.g., C:
- Accessing local folders:  e.g., \temp>"

Enabling this group policy, along with the one that hides the local C and D drives makes for a nice published Windows Explorer environment where users cannot easily accidentally make folder/file level changes to the Citrix server side, but can get to the file resources they desire and should get to.
0
 
LVL 38

Expert Comment

by:Rich Rumble
ID: 22966824
neat, does it prevent short-cut keys? Like Windows-Key+R http://labmice.techtarget.com/articles/keyboard.htm Just curious.
-rich
0
 
LVL 9

Expert Comment

by:Derek Schauland
ID: 24486863
richrumble - enabling this group policy setting does indeed prevent Windows Logo shortcuts like Win+R
0
 
LVL 38

Expert Comment

by:Rich Rumble
ID: 24486909
Does it remove the "new task" option in task manager (ctrl+alt+delete File->new task(run))
-rich
0

Featured Post

Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Some time ago I faced the need to use a uniform folder structure that spanned across numerous sites of an enterprise to be used as a common repository for the Software packages of the Configuration Manager 2007 infrastructure. Because the procedu…
Know what services you can and cannot, should and should not combine on your server.
This tutorial gives a high-level tour of the interface of Marketo (a marketing automation tool to help businesses track and engage prospective customers and drive them to purchase). You will see the main areas including Marketing Activities, Design …
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now