Solved

Access to C: drive on TS Server Group Policy

Posted on 2015-02-06
9
61 Views
Last Modified: 2015-02-13
hey guys,

I have one user who needs access to the C: Drive on a terminal server. It looks like there's a Gpo or two blocking access for all users. How do i allow this for one user?
0
Comment
Question by:Cobra25
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
  • +3
9 Comments
 
LVL 17

Expert Comment

by:bigeven2002
ID: 40594296
Hello
If you have admin access to the server you can login and then right click the c drive and choose properties and then security tab.  Click edit and add their user account to the list and give read and write access but not full control.

By default non admin users have read only access to most folders outside their own user directory.
0
 
LVL 4

Author Comment

by:Cobra25
ID: 40594303
Will that override any GPO's?
0
 
LVL 88

Expert Comment

by:rindi
ID: 40594367
There is no reason why anyone should have access to the root of C:\. Only the OS needs to access that. If your user needs to access the root of C:\, he's doing something wrong.
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
LVL 4

Author Comment

by:Cobra25
ID: 40594371
They need to modify some software settings for an application, only them. So there is a reason.
0
 
LVL 17

Expert Comment

by:bigeven2002
ID: 40594401
Ah ok the first gather the path to the software folder within c:\program files or program files (x86) and add the user to read write there.  As for overriding gpo I believe this does since it is a manual entry.

If prefer doing this thru gpo I think you can create a new domain group called software edit or something like that, add the user to that group.  Then in gpo set that group to have read write permission to the program files folder.  I'm not sure where this gpo setting is at the moment though.
0
 
LVL 6

Expert Comment

by:rgorman
ID: 40594448
No, local security permissions won't override the GPO settings to hide C drive.  You will need to find the GPO and deny apply the GPO under the GPO security settings for that one user.  Then when the user can see C drive then you will need to modify the NTFS security on the folder they need access to if they don't already have permissions.
0
 
LVL 88

Expert Comment

by:rindi
ID: 40594459
There are no software settings in the root of C:\, so there is still no reason. Setting files should be in \ProgramData\ProgramName\, and never in C:\.
0
 
LVL 2

Expert Comment

by:Axis52401
ID: 40594557
Group policy is applied in a specific order, LSDO, Local --> Site --> Domain --> OU. The default domain policy does not restrict users from installing software. This restriction is, by default, setup by configuring who is a member of the local admins group. That being said giving access to the C:\Program Files probably won't be enough. Software programs often require access to the registry so honestly you'll probably have to use Restricted Groups and make that user a member of the local admin groups. I doubt giving access to the directories will be enough.
0
 
LVL 11

Accepted Solution

by:
loftyworm earned 500 total points
ID: 40594631
You may also set the GPO to ignore the specific user with a deny setting.  (This is bad practice) but it will work.
GPO management >GPO > Delegation>Advanced>OBJECT>Apply Group Policy (Check "DENY")(scroll down)

Also, there is a way to have the GPO over ridden by the local GPO.  Loopback processing is the keyword.
http://itfreetraining.com/70-640/group-policy-loopback-processing/
0

Featured Post

Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
A procedure for exporting installed hotfix details of remote computers using powershell
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question