Solved

UNC Paths - Access to this resource has been disallowed

Posted on 2013-02-04
19
13,906 Views
Last Modified: 2013-02-07
Win7
Win2008 domain

I am getting the error:

"Access to this resource has been disallowed"

when trying to open .html intranet UNC paths. I know it is related to 'remove run' policy being set, but we are a school and defintely want run to be removed. Do you know if it is possible to disable the run menu while still allowing access to UNC shares etc via Explorer?
0
Comment
Question by:Pete
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
19 Comments
 
LVL 25

Expert Comment

by:SStory
ID: 38850970
If you do something like

     iexplore.exe <UNC path>

does it work? If so, it probably has to do with a remove run policy.  Just putting in a UNC path with a .HTML file will try to run the associated browser.
0
 
LVL 3

Expert Comment

by:gaurav2rawat
ID: 38851064
You could try upgrading the browser, or as it says in the article: "type the Web address without "http://".

http://support.microsoft.com/default.aspx?scid=kb;EN-US;250915
0
 
LVL 3

Expert Comment

by:gaurav2rawat
ID: 38851076
If that doesn't work one way to get around it is by: hiding run prompt instead of deleting it.

- Remove GPO settings for "Remove Run"

-Then setup GPO Preference for the Start Menu to hide the Run item
0
Free eBook: Backup on AWS

Everything you need to know about backup and disaster recovery with AWS, for FREE!

 
LVL 1

Author Comment

by:Pete
ID: 38851086
hiding rather than removing run seems like a good idea.

how do I hide it using GPP?
0
 
LVL 3

Accepted Solution

by:
gaurav2rawat earned 500 total points
ID: 38851141
If you're running server 2008 then Right-click the GPO that you want to edit, and then click Edit.

In the console tree, expand Computer Configuration or User Configuration, expand Preferences, there you should be able to edit the start menu settings

This is how you do it at registry level
Hive: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Name: NoRun
Type: REG_DWORD
Value: 1
0
 
LVL 1

Author Comment

by:Pete
ID: 38851147
I will test but wouldn't that leave "windows key - R" shortcut still working?
0
 
LVL 3

Expert Comment

by:gaurav2rawat
ID: 38851173
The registry key stops windows-R too; I haven't quite tested it with the group policy preferences, so that you'll have to test yourself.

Goodluck.
0
 
LVL 1

Author Comment

by:Pete
ID: 38851184
That reg key is the key that is changed when you set the 'remove run from the start menu' in group policy. this is already set, and this is the setting that is causing the problem!
0
 
LVL 3

Expert Comment

by:gaurav2rawat
ID: 38851211
Yes I know that's why I was saying I haven't quite tested it with GP preference but I found it as a solution in this article regarding the same problem-

http://community.spiceworks.com/topic/172385-yikes-remove-run-menu-from-start-menu-gpo-also-locks-down-unc-browsing
0
 
LVL 1

Author Comment

by:Pete
ID: 38851748
I've been looking at this all day. a test GPO with 'remove run' set actually still let's the software open the link to the unc intranet path (the software is a flash window that opens IE9 when a user clicks 'resources' link - the resources are on the intranet)....but my student GPO clicking the same link just opens a blank IE9 window and if its refreshed I get the disallowed tab error.
what's going on do you think? is there a GPO to allow intranet shortcuts or something?
0
 
LVL 3

Expert Comment

by:gaurav2rawat
ID: 38852136
I researched on it and it seems to be a limitation of Microsoft which hasn't been addressed there are only a few workarounds-

Like Hiding run from desktop properties but with that windows+R key would not be blocked

Second option is to remove run using gpo and then enable mapped drives if needed.
0
 
LVL 1

Author Comment

by:Pete
ID: 38852213
my drives are mapped, but I get the same error when a link:

P:\maths\link.html
or
\\domain\apps\maths\link.html

I'm happy if a mapped drive solution can be found, I would only need to change the shortcuts
0
 
LVL 9

Expert Comment

by:Zenvenky
ID: 38853950
Are you able to open \\servername and \\IP address. If any one or both the options are failing and asking for credentails then its a secure channel issue. if you are referring to server then unjoin and rejoin it or reset secure channel domain wide using nltest.

NLTest
0
 
LVL 1

Author Comment

by:Pete
ID: 38853998
no credentials never get asked for,
0
 
LVL 3

Expert Comment

by:gaurav2rawat
ID: 38854174
what error do you get when you try to add the mapped drive?
0
 
LVL 1

Author Comment

by:Pete
ID: 38854190
browsing a mapped drive:
"Access to this resource has been disallowed"
0
 
LVL 3

Expert Comment

by:gaurav2rawat
ID: 38854231
did you try it using a logon script ?
It should work with a logon script.
0
 
LVL 1

Author Comment

by:Pete
ID: 38854243
can you please read the original question again, the drive maps fine.
0
 
LVL 3

Expert Comment

by:gaurav2rawat
ID: 38854537
I am sorry for not looking into that carefully enough...
I tried to reproduce the same problem by "disabling run" through gp preference,
and I'm not getting any errors while accessing the mapped drives.
Check your permissions, if still not able to find anything, then I'd advise you to try creating a new mapped drive from scratch using the help of these links-
http://blogs.technet.com/b/grouppolicy/archive/2009/03/27/group-policy-preferences-not-applying-on-some-clients-client-side-extension-xmllite.aspx

http://technet.microsoft.com/en-us/library/cc770902.aspx
0

Featured Post

Major Incident Management Communications

Major incidents and IT service outages cost companies millions. Often the solution to minimizing damage is automated communication. Find out more in our Major Incident Management Communications infographic.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This article shows the method of using the Resultant Set of Policy Tool to locate Group Policy that applies a particular setting.
Always backup Domain, SYSVOL etc.using processes according to Microsoft Best Practices. This is meant as a disaster recovery process for small environments that did not implement backup processes and did not run a secondary domain controller that ne…
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question