Solved

Group policy for write access to C: drive only

Posted on 2010-08-13
15
5,660 Views
Last Modified: 2013-12-04
Hi experts,

I have a Windows 2008R2 domain with several computers and regular non admin users. The problem is that they use a program that needs write permisseion only on the root drive C: in Windows XP.
How can I fix this with a GPO without giving them more permission than needed?

Thanks.
0
Comment
Question by:helhas
  • 6
  • 6
  • 3
15 Comments
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 33428613
directly to C-drive or some folder on C-drive?
0
 
LVL 5

Expert Comment

by:rov17
ID: 33428623
there is a GP to hide drivers if you want to protect them

User Configuration, Administrative Templates, Windows Components, and Windows Explorer.
Click Hide these specified drives in My Computer.
Click to select the Hide these specified drives in My Computer check box.

http://support.microsoft.com/kb/231289
0
 
LVL 5

Expert Comment

by:rov17
ID: 33428651
You also can use the option of "Prevent access to drives from My Computer" if you don't want to hide it.

User Configuration
Administrative Template
Windows Components
Windows Explorer
"Hide these specified drives in My Computer"
"Prevent access to drives from My Computer"
0
 

Author Comment

by:helhas
ID: 33428771
Hi,

I don't want to hide anything, I just want to give them write permission directly to the C-drive.
Don't ask who wrote this piece of crap software, but I need to get it working.

Thanks.
0
 
LVL 5

Expert Comment

by:rov17
ID: 33428823
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 33429113
I would suggest to modify standard RootSec.inf Security Template and apply it to GPO for those workstations which need write access to C-drive.

If you need help just let me know.
0
 

Author Comment

by:helhas
ID: 33429491
@rov17: How would this login script look like? The link states you substitute your C: drive by another drive, but the program must have access to C:

@iSiek: I am still a newbie with security templates, any more info on how this can be done would be appreciated.
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 33432748
Windows Server has default security templates defined. Yo can find them in %windir%\security\templates
There are a lot of INF files which are some kind of registry settings. You can save copy of one of them called RootSec.inf which is responsible for giving default permission to C-drive. After OS is installed it is applied to secure C-drive (from XP above). You can freely modify that security template and save it as your own, then import to GPO and link to proper OU (with computers) where those default settings should be modified.

I will try to prepare some guide in PDF if you're interested doing it that way.
0
 

Author Comment

by:helhas
ID: 33432934
@iSiek: So I can copy the RootSec.inf and give it another name like MyRootSec.inf edit it and link it to a GPO which is linked to specific computers/users?
What do I need to edit in the file?
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 33436066
You have to run mmc -> File -> Add/Remove Snap-in -> Add -> Security Templates on one of your DCs,
then navigate to Security Tempate's node and look for %WINDIR%\Security\Templates\rootsec
click right mouse button on it and choose "Save as" then type new name i.e. "MyRootSec.inf"
Select new security template and navigate to "FileSystem" node. In the right pane click right mouse button on %SystemDrive%\ and choose "Properties". Now click on "Edit Security..." button, "Add" button and decide if you want to create special group for those users (all of them will have write access to C-drive on each computer with policy appplied) or add "Authenticated Users" group (then each authenticated user in domain will have write access to C-drive). Give that group "Modify" permissions and click twice "OK" button and save this template once again (choose "Save" on MyRootSec).

Now create new GPO and navigate to "Computer Configuration -> Windows Settings -> Security Settings" and click right mouse button on "Security Settings" node. Choose "Import Policy" and select your newly create security template (%WINDIR%\Security\Templates\MyRootSec.inf) and click "Open". Check if you have imported policy by checking node 'FileSystem" %SystemDrive%'s properties if that grooup is applied.

Now, link this GPO to OU where are workstations (because it is PC settings) and reboot them to apply changes. After reboot test, if your users have write access to C-drive.
0
 

Author Comment

by:helhas
ID: 33438449
Sounds like a perfect howto, I will try it out Tuesday next week and let you know if it worked.
Many thanks for your effort!
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 33440361
You're welcome. BTW, how many computers need these changes (if no more than 5 you can customize security template for each of them and apply it manually)?
0
 

Author Comment

by:helhas
ID: 33450220
Hi,

It seems that there is no rootsec.inf file in Windows 2008 R2.
What inf file do I need to copy?

Thanks.
0
 
LVL 39

Accepted Solution

by:
Krzysztof Pytko earned 250 total points
ID: 33452139
So, we need to create new security template :)

Follow this steps:

run mmc -> File -> Add/Remove Snap-in -> Add -> Security Templates
Navigate to C:\Users\ ... \Security\|Templates node and click on it right mouse button
Choose "New Template" and type its name (let's say MyRootSec)
Now, expand it and go to section  "File System"
In the middle window, click right mouse button and select "Add File..."
Select C-Drive from the list and click OK
Click "Add" button and decide if you want to create special group for those users (all of them will have write access to C-drive on each computer with policy appplied) or add "Authenticated Users" group (then each authenticated user in domain will have write access to C-drive). Give that group "Modify" permissions and click twice "OK" button and save this template once again (choose "Save" on MyRootSec).

Copy newly created security template from C:\Users|<probably Administrator>\Documents\Security\Templates to %WINDIR%\SYSTEM32\SECURITY\TEMPLATES and

Now create new GPO and navigate to "Computer Configuration -> Windows Settings -> Security Settings" and click right mouse button on "Security Settings" node. Choose "Import Policy" and select your newly create security template (%WINDIR%\Security\Templates\MyRootSec.inf) and click "Open". Check if you have imported policy by checking node 'FileSystem" %SystemDrive%'s properties if that grooup is applied.

Now, link this GPO to OU where are workstations (because it is PC settings) and reboot them to apply changes. After reboot test, if your users have write access to C-drive.
0
 

Author Closing Comment

by:helhas
ID: 33557568
The explanation could be better and in more detail.
0

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Online collaboration can help businesses be more efficient, help employees grow their skills and foster a team environment.
Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
With the power of JIRA, there's an unlimited number of ways you can customize it, use it and benefit from it. With that in mind, there's bound to be things that I wasn't able to cover in this course. With this summary we'll look at some places to go…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now