Solved

Access to C: drive on TS Server Group Policy

Posted on 2015-02-06
9
55 Views
Last Modified: 2015-02-13
hey guys,

I have one user who needs access to the C: Drive on a terminal server. It looks like there's a Gpo or two blocking access for all users. How do i allow this for one user?
0
Comment
Question by:Cobra25
  • 2
  • 2
  • 2
  • +3
9 Comments
 
LVL 17

Expert Comment

by:bigeven2002
ID: 40594296
Hello
If you have admin access to the server you can login and then right click the c drive and choose properties and then security tab.  Click edit and add their user account to the list and give read and write access but not full control.

By default non admin users have read only access to most folders outside their own user directory.
0
 
LVL 4

Author Comment

by:Cobra25
ID: 40594303
Will that override any GPO's?
0
 
LVL 87

Expert Comment

by:rindi
ID: 40594367
There is no reason why anyone should have access to the root of C:\. Only the OS needs to access that. If your user needs to access the root of C:\, he's doing something wrong.
0
 
LVL 4

Author Comment

by:Cobra25
ID: 40594371
They need to modify some software settings for an application, only them. So there is a reason.
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 
LVL 17

Expert Comment

by:bigeven2002
ID: 40594401
Ah ok the first gather the path to the software folder within c:\program files or program files (x86) and add the user to read write there.  As for overriding gpo I believe this does since it is a manual entry.

If prefer doing this thru gpo I think you can create a new domain group called software edit or something like that, add the user to that group.  Then in gpo set that group to have read write permission to the program files folder.  I'm not sure where this gpo setting is at the moment though.
0
 
LVL 6

Expert Comment

by:rgorman
ID: 40594448
No, local security permissions won't override the GPO settings to hide C drive.  You will need to find the GPO and deny apply the GPO under the GPO security settings for that one user.  Then when the user can see C drive then you will need to modify the NTFS security on the folder they need access to if they don't already have permissions.
0
 
LVL 87

Expert Comment

by:rindi
ID: 40594459
There are no software settings in the root of C:\, so there is still no reason. Setting files should be in \ProgramData\ProgramName\, and never in C:\.
0
 
LVL 2

Expert Comment

by:Axis52401
ID: 40594557
Group policy is applied in a specific order, LSDO, Local --> Site --> Domain --> OU. The default domain policy does not restrict users from installing software. This restriction is, by default, setup by configuring who is a member of the local admins group. That being said giving access to the C:\Program Files probably won't be enough. Software programs often require access to the registry so honestly you'll probably have to use Restricted Groups and make that user a member of the local admin groups. I doubt giving access to the directories will be enough.
0
 
LVL 11

Accepted Solution

by:
loftyworm earned 500 total points
ID: 40594631
You may also set the GPO to ignore the specific user with a deny setting.  (This is bad practice) but it will work.
GPO management >GPO > Delegation>Advanced>OBJECT>Apply Group Policy (Check "DENY")(scroll down)

Also, there is a way to have the GPO over ridden by the local GPO.  Loopback processing is the keyword.
http://itfreetraining.com/70-640/group-policy-loopback-processing/
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Suggested Solutions

When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
Citrix XenApp, Internet Explorer 11 set to Enterprise Mode and using central hosted sites.xml file.
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now