Solved

Access to C: drive on TS Server Group Policy

Posted on 2015-02-06
9
59 Views
Last Modified: 2015-02-13
hey guys,

I have one user who needs access to the C: Drive on a terminal server. It looks like there's a Gpo or two blocking access for all users. How do i allow this for one user?
0
Comment
Question by:Cobra25
  • 2
  • 2
  • 2
  • +3
9 Comments
 
LVL 17

Expert Comment

by:bigeven2002
ID: 40594296
Hello
If you have admin access to the server you can login and then right click the c drive and choose properties and then security tab.  Click edit and add their user account to the list and give read and write access but not full control.

By default non admin users have read only access to most folders outside their own user directory.
0
 
LVL 4

Author Comment

by:Cobra25
ID: 40594303
Will that override any GPO's?
0
 
LVL 88

Expert Comment

by:rindi
ID: 40594367
There is no reason why anyone should have access to the root of C:\. Only the OS needs to access that. If your user needs to access the root of C:\, he's doing something wrong.
0
Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

 
LVL 4

Author Comment

by:Cobra25
ID: 40594371
They need to modify some software settings for an application, only them. So there is a reason.
0
 
LVL 17

Expert Comment

by:bigeven2002
ID: 40594401
Ah ok the first gather the path to the software folder within c:\program files or program files (x86) and add the user to read write there.  As for overriding gpo I believe this does since it is a manual entry.

If prefer doing this thru gpo I think you can create a new domain group called software edit or something like that, add the user to that group.  Then in gpo set that group to have read write permission to the program files folder.  I'm not sure where this gpo setting is at the moment though.
0
 
LVL 6

Expert Comment

by:rgorman
ID: 40594448
No, local security permissions won't override the GPO settings to hide C drive.  You will need to find the GPO and deny apply the GPO under the GPO security settings for that one user.  Then when the user can see C drive then you will need to modify the NTFS security on the folder they need access to if they don't already have permissions.
0
 
LVL 88

Expert Comment

by:rindi
ID: 40594459
There are no software settings in the root of C:\, so there is still no reason. Setting files should be in \ProgramData\ProgramName\, and never in C:\.
0
 
LVL 2

Expert Comment

by:Axis52401
ID: 40594557
Group policy is applied in a specific order, LSDO, Local --> Site --> Domain --> OU. The default domain policy does not restrict users from installing software. This restriction is, by default, setup by configuring who is a member of the local admins group. That being said giving access to the C:\Program Files probably won't be enough. Software programs often require access to the registry so honestly you'll probably have to use Restricted Groups and make that user a member of the local admin groups. I doubt giving access to the directories will be enough.
0
 
LVL 11

Accepted Solution

by:
loftyworm earned 500 total points
ID: 40594631
You may also set the GPO to ignore the specific user with a deny setting.  (This is bad practice) but it will work.
GPO management >GPO > Delegation>Advanced>OBJECT>Apply Group Policy (Check "DENY")(scroll down)

Also, there is a way to have the GPO over ridden by the local GPO.  Loopback processing is the keyword.
http://itfreetraining.com/70-640/group-policy-loopback-processing/
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

INTRODUCTION The purpose of this document is to demonstrate the Installation and configuration of the Data Protection Manager product. Note that this demonstration was prepared on the basis of Windows OS is 2008 R2 and DPM 2010. DATA PROTECTI…
A procedure for exporting installed hotfix details of remote computers using powershell
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…

766 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question