Solved

Access to C: drive on TS Server Group Policy

Posted on 2015-02-06
9
57 Views
Last Modified: 2015-02-13
hey guys,

I have one user who needs access to the C: Drive on a terminal server. It looks like there's a Gpo or two blocking access for all users. How do i allow this for one user?
0
Comment
Question by:Cobra25
  • 2
  • 2
  • 2
  • +3
9 Comments
 
LVL 17

Expert Comment

by:bigeven2002
ID: 40594296
Hello
If you have admin access to the server you can login and then right click the c drive and choose properties and then security tab.  Click edit and add their user account to the list and give read and write access but not full control.

By default non admin users have read only access to most folders outside their own user directory.
0
 
LVL 4

Author Comment

by:Cobra25
ID: 40594303
Will that override any GPO's?
0
 
LVL 88

Expert Comment

by:rindi
ID: 40594367
There is no reason why anyone should have access to the root of C:\. Only the OS needs to access that. If your user needs to access the root of C:\, he's doing something wrong.
0
 
LVL 4

Author Comment

by:Cobra25
ID: 40594371
They need to modify some software settings for an application, only them. So there is a reason.
0
NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

 
LVL 17

Expert Comment

by:bigeven2002
ID: 40594401
Ah ok the first gather the path to the software folder within c:\program files or program files (x86) and add the user to read write there.  As for overriding gpo I believe this does since it is a manual entry.

If prefer doing this thru gpo I think you can create a new domain group called software edit or something like that, add the user to that group.  Then in gpo set that group to have read write permission to the program files folder.  I'm not sure where this gpo setting is at the moment though.
0
 
LVL 6

Expert Comment

by:rgorman
ID: 40594448
No, local security permissions won't override the GPO settings to hide C drive.  You will need to find the GPO and deny apply the GPO under the GPO security settings for that one user.  Then when the user can see C drive then you will need to modify the NTFS security on the folder they need access to if they don't already have permissions.
0
 
LVL 88

Expert Comment

by:rindi
ID: 40594459
There are no software settings in the root of C:\, so there is still no reason. Setting files should be in \ProgramData\ProgramName\, and never in C:\.
0
 
LVL 2

Expert Comment

by:Axis52401
ID: 40594557
Group policy is applied in a specific order, LSDO, Local --> Site --> Domain --> OU. The default domain policy does not restrict users from installing software. This restriction is, by default, setup by configuring who is a member of the local admins group. That being said giving access to the C:\Program Files probably won't be enough. Software programs often require access to the registry so honestly you'll probably have to use Restricted Groups and make that user a member of the local admin groups. I doubt giving access to the directories will be enough.
0
 
LVL 11

Accepted Solution

by:
loftyworm earned 500 total points
ID: 40594631
You may also set the GPO to ignore the specific user with a deny setting.  (This is bad practice) but it will work.
GPO management >GPO > Delegation>Advanced>OBJECT>Apply Group Policy (Check "DENY")(scroll down)

Also, there is a way to have the GPO over ridden by the local GPO.  Loopback processing is the keyword.
http://itfreetraining.com/70-640/group-policy-loopback-processing/
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
A safe way to clean winsxs folder from your windows server 2008 R2 editions
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

919 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now