creating policy's

[miguel1973]

Hi,
I am currently playing about with active directory with the hope of implementing it on our new domain. I am wanting to deny users access to certain drives on the domain controller. How do I go about this? is it through creating policy's?

Thanks
Miguel

 

[GrnEyedLdy]

Miguelmiggs,

Your drives, just as your other Win2K resources can be protected with the ACL (Access Control List)

Keep in mind that if a user 'browses' the network the only things that will be visible to them will be resources you have 'shared' out.

Your drives are an 'administrative' share, in that Windows has made them hidden shares and shared them out with the extension '$'. Only those who know to specifically add the '$' to the drive spec could indeed access them. For example you could go to a RUN line and type \\servername\c$ and this will allow you access to the C drive of 'servername'. However if you only typed \\servername\c, you could not get there.

However, anything that was 'shared' out on the C drive would show up to users browsing the network. You can then lock the shares down using NTFS permissions in the ACL.

http://archive.devx.com/security/bestdefense/2001/mh0401/mh0401-1.asp

Hope this helps,

Patty

 

[allenEd]

Another way to secure and hide objects is to place them in an OU and disable "list Directory contents" (or something), to what ever group you want to disallow access or viewing, in the ACL....

 

[Seaspray0]

The clients on the network will only be able to access shares that are made available. If its not shared, then it can't be accessed over the network... only locally. To see what shares you currently have, right click my computer, manage, shared folders. grneyedlady is correct about the $ sign, those shares will be hidden. Also, the c$, d$, etc drive shares have administrative rights assigned to them (must be an administrator to access) and you can't remove those shares because they are built in. The recommended practice is to create folders, and then share the folders. Share permissions are normally kept 'loose' and you then clamp down with NTFS permissions.

If you are concerned about the drives being accessed by a direct login to the server, the default is to allow only specific groups the local login right... see domain controllers group policy\computer configuration\windows settings\security settings\local policies\user rights assignment. The average domain user can't log directly into the server.

So, your resources are protected by either not sharing them, sharing them but restricting access through NTFS permissions, or not allowing them to access them through a direct login to the server through a group policy.

 

[miguel1973]

Hi Guys,
Thanks for all the replies.

Miguel