Solved

UNC Paths - Access to this resource has been disallowed

Posted on 2013-02-04
19
11,694 Views
Last Modified: 2013-02-07
Win7
Win2008 domain

I am getting the error:

"Access to this resource has been disallowed"

when trying to open .html intranet UNC paths. I know it is related to 'remove run' policy being set, but we are a school and defintely want run to be removed. Do you know if it is possible to disable the run menu while still allowing access to UNC shares etc via Explorer?
0
Comment
Question by:Pete
19 Comments
 
LVL 25

Expert Comment

by:SStory
ID: 38850970
If you do something like

     iexplore.exe <UNC path>

does it work? If so, it probably has to do with a remove run policy.  Just putting in a UNC path with a .HTML file will try to run the associated browser.
0
 
LVL 3

Expert Comment

by:gaurav2rawat
ID: 38851064
You could try upgrading the browser, or as it says in the article: "type the Web address without "http://".

http://support.microsoft.com/default.aspx?scid=kb;EN-US;250915
0
 
LVL 3

Expert Comment

by:gaurav2rawat
ID: 38851076
If that doesn't work one way to get around it is by: hiding run prompt instead of deleting it.

- Remove GPO settings for "Remove Run"

-Then setup GPO Preference for the Start Menu to hide the Run item
0
 
LVL 1

Author Comment

by:Pete
ID: 38851086
hiding rather than removing run seems like a good idea.

how do I hide it using GPP?
0
 
LVL 3

Accepted Solution

by:
gaurav2rawat earned 500 total points
ID: 38851141
If you're running server 2008 then Right-click the GPO that you want to edit, and then click Edit.

In the console tree, expand Computer Configuration or User Configuration, expand Preferences, there you should be able to edit the start menu settings

This is how you do it at registry level
Hive: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Name: NoRun
Type: REG_DWORD
Value: 1
0
 
LVL 1

Author Comment

by:Pete
ID: 38851147
I will test but wouldn't that leave "windows key - R" shortcut still working?
0
 
LVL 3

Expert Comment

by:gaurav2rawat
ID: 38851173
The registry key stops windows-R too; I haven't quite tested it with the group policy preferences, so that you'll have to test yourself.

Goodluck.
0
 
LVL 1

Author Comment

by:Pete
ID: 38851184
That reg key is the key that is changed when you set the 'remove run from the start menu' in group policy. this is already set, and this is the setting that is causing the problem!
0
 
LVL 3

Expert Comment

by:gaurav2rawat
ID: 38851211
Yes I know that's why I was saying I haven't quite tested it with GP preference but I found it as a solution in this article regarding the same problem-

http://community.spiceworks.com/topic/172385-yikes-remove-run-menu-from-start-menu-gpo-also-locks-down-unc-browsing
0
 
LVL 1

Author Comment

by:Pete
ID: 38851748
I've been looking at this all day. a test GPO with 'remove run' set actually still let's the software open the link to the unc intranet path (the software is a flash window that opens IE9 when a user clicks 'resources' link - the resources are on the intranet)....but my student GPO clicking the same link just opens a blank IE9 window and if its refreshed I get the disallowed tab error.
what's going on do you think? is there a GPO to allow intranet shortcuts or something?
0
 
LVL 3

Expert Comment

by:gaurav2rawat
ID: 38852136
I researched on it and it seems to be a limitation of Microsoft which hasn't been addressed there are only a few workarounds-

Like Hiding run from desktop properties but with that windows+R key would not be blocked

Second option is to remove run using gpo and then enable mapped drives if needed.
0
 
LVL 1

Author Comment

by:Pete
ID: 38852213
my drives are mapped, but I get the same error when a link:

P:\maths\link.html
or
\\domain\apps\maths\link.html

I'm happy if a mapped drive solution can be found, I would only need to change the shortcuts
0
 
LVL 9

Expert Comment

by:Zenvenky
ID: 38853950
Are you able to open \\servername and \\IP address. If any one or both the options are failing and asking for credentails then its a secure channel issue. if you are referring to server then unjoin and rejoin it or reset secure channel domain wide using nltest.

NLTest
0
 
LVL 1

Author Comment

by:Pete
ID: 38853998
no credentials never get asked for,
0
 
LVL 3

Expert Comment

by:gaurav2rawat
ID: 38854174
what error do you get when you try to add the mapped drive?
0
 
LVL 1

Author Comment

by:Pete
ID: 38854190
browsing a mapped drive:
"Access to this resource has been disallowed"
0
 
LVL 3

Expert Comment

by:gaurav2rawat
ID: 38854231
did you try it using a logon script ?
It should work with a logon script.
0
 
LVL 1

Author Comment

by:Pete
ID: 38854243
can you please read the original question again, the drive maps fine.
0
 
LVL 3

Expert Comment

by:gaurav2rawat
ID: 38854537
I am sorry for not looking into that carefully enough...
I tried to reproduce the same problem by "disabling run" through gp preference,
and I'm not getting any errors while accessing the mapped drives.
Check your permissions, if still not able to find anything, then I'd advise you to try creating a new mapped drive from scratch using the help of these links-
http://blogs.technet.com/b/grouppolicy/archive/2009/03/27/group-policy-preferences-not-applying-on-some-clients-client-side-extension-xmllite.aspx

http://technet.microsoft.com/en-us/library/cc770902.aspx
0

Join & Write a Comment

I was supporting a handful of Windows 2008 (non-R2) 2 node clusters with shared quorum disks. Some had SQL 2008 installed and some were just a vendor application that we supported. For the purposes of this article it doesn’t really matter which so w…
Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now