Disable viewing of C: drive from Internet Explorer 1

[RiderJon]

Hi:

I have 2 questions about restricting a user's (with limited access or otherwise) ability to do certain things.

It has XP pro.

Question 1:
For a lab user, I am trying to restrict the ability to access C: drive by using internet explorer and typing "C:".

Is that possible?



Question 2:
Is there a regisry hack or something, to disable the "new" command in the context menu. (i.e. Right click on desktop and select "new&quot.

Note: I DON'T want to disable the right clicking completely. I know the registry setting for that.

Thank you for your time and help. Please post if I was unclear on anything.







RiderJon
"I might have created ctrl+alt+del,
But Bill made it famous" - Dr. Dave

 

[bcastner]

A1. Hide Drives

You can use TweakUI, a registry edit, or Group Policy.

All do the same thing to the registry:


Hide drive C for current user
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

Hide drive C for all user
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

The key and value for Drive C in both cases:
"NoDrives"=dword:00000004

There are two items in GroupPolicy you can apply to local drives, first of which is the "Hide the drive in My Computer" (Under User Configuration->Administrative Templates->Windows Explorer); the second one is "Prevent access to drives from My Computer". This uses GP to make the registry change above.

The first GP hides the specific drives being viewed by users, it is similar to "Hidden" a file or folder, which does not deny users the ability to read, write or delete files in that drive if the user knows the Path. e.g., in Internet Explorer, they could still C:
The second GP sounds promising. However, if you use this on the system volume the result is likely to be: every time a user logs on, they get a error message that says, "This operation has been canceled due to restrictions in effect on this computer. Please contact your system administrator."

Solution: change the permission in c: drive so that it's only Read & Executable or restricted in the fashion you want.

A2. Disable New.

The above should be sufficient to bar New entrties.

However, Delete:
HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers\New

 

[RiderJon]

BCastner:

1)

I have tried that already without avail. There's one key the "restrict" complete access to (a,b,c,d ... drives, ofcourse 4 for hard). Next key - one you mentioned - merely hides it when you go to file-> save. But users can still access it from Internet Explorer.

Haven't tried the Administrative Group Policy. But I would rather have a registry setting.


2)
If I delete those, tehn users with admin privileges won't be able to use it. I tried it too. Any other settings I can modify in HKEY_CURRENT_USER?

Thanx


RiderJon
"I might have created ctrl+alt+del,
But Bill made it famous" - Dr. Dave

 

[RiderJon]

Oh by the way, I just want to hide the C: drive (hard drive). I still want users to be able to save in the desktop.

Quesion 3:
Infact, I want to force them to save to a specific folder. Is there a way? By disabling access to C: drive like you mentioned, I have forced them to save on removable media or desktop.

I have created that folder using registry and made it un-renameable and un-deletable.

Thanx.

RiderJon
"I might have created ctrl+alt+del,
But Bill made it famous" - Dr. Dave

 

[bcastner]

Please re-read my comment on the first issue. I explained the limitation of the Hide Drive feature, and provided a solution.

There is no registry only solution other than the second Group Policy I discussed above. But please see the caution.

As for the second issue, it is a computer setting applicable to all users.

The shell extensions are controlled by:

[HKEY_CLASSES_ROOT\*]
[HKEY_CLASSES_ROOT\Directory]
[HKEY_CLASSES_ROOT\Drive]
[HKEY_CLASSES_ROOT\Folder]

Which are all machine-specific portions of the registry.

 

[bcastner]

You can control the location of the user Profile. You can create roaming mandatory profiles in a Domain setting.

You can create more granularity in your NTFS permissions by setting for the folder the necessary permissions to allow a save, and denying inheritance.

 

[RiderJon]

BCastner:

Bear with me, as I am working on a NT computer and won't have access to a XP until later tonight. (I am testing the XP machine to make lab changes soon).

1)
How do you change the permissions on the C: drive? Never done that before. Is it right click -> properties or something. Also, if I want users to be able to save to the desktop but not anywhere else, so what settings should I allow them: "Write only" ?

2)
I guess it's ALL or NONE then. Wanted just users, not admin, to not be able to use new.

3)
Anyway, to force users to save to a specific folder.


Thanx for the feedback.



RiderJon
"I might have created ctrl+alt+del,
But Bill made it famous" - Dr. Dave

 

[bcastner]

NTFS permissions will be available to you when:
. Use Simple File Sharing is disabled;
. The drive is convert[ed] to the NTFS filestore.

The six basic NT permissions have been expanded beginning with Win2k into 13 seperate permissions, with six groupings.

If you do not mind a little reading:

http://www.pcguide.com/ref/hdd/file/ntfs/secPerm-c.html

 

[RiderJon]

Bcastner,

That's awesome. Thanx. Let me try that later today, might go home early. BTW, where is this permission set? Is it right click -> properties. Or is it part of XP pro only.

(well, if it's part of NTFS, then it's gotta be in HOme too). Anyway, I will look into it tonight. Sucks not to have a XP right now.

Anyway, here's a star for you. Have a good holiday.



RiderJon
"I might have created ctrl+alt+del,
But Bill made it famous" - Dr. Dave

 

[bcastner]

right-click, Security

 

[khushi2b]

If you are still looking for an easier solution, you could look into buying Fortres for public access computers. It will do exactly what you are looking for.