Preventing access to local HDD

[tbalazs]

I have users' my documents folders redirected to shares on the server. Is there any way I can force them to save all files they create to the server and effectively block access to their workstation's (Win2K Pro) HDD?

 

[Jpoandl]

I've never tried this one...but you may consider loading NTFS on all of your 2K Pro's. Then Change permissions so that users have only READ access. (Make sure your users aren't memebers of the local administrators group.)

I'm not sure that this would actually work though...

Just a thought.. Joseph L. Poandl
MCSE 2000

 

[Cryptospy]

Its more headaches than your probably after. Programs need the right to be able to create/modify/delete files on your local computer. You may want to look into a third party peice of software, or, if you are on a w2k domain, create policys, preventing them from traversing folders and drives...

Cryptospy

 

[jahlmer]

Or, impliment terminal services and lock down the system with kiosk. Check out the following article:

http://www.microsoft.com/technet/tr...l/windows2000serv/deploy/confeat/grppolsc.asp

 

[tbalazs]

OK, thanks everyone. Jahlmer, I think kiosk might be too tight and Jpoandl and Cryptospy, I really don't want the headaches it looks like I'd get from radically restricting local permissions. Essentially, I want to make sure that everything users save gets backed up. If they're to remain able to save locally, is the best way to have a logon script that will copy new docs to the server?

 

[Jpoandl]

I'm not too sure about logon scripts. I would think this would slow down logon time tremendously.

In my environment, we have spent the time instructing users that it is important to save files to network drives. That the network drives get backed up every night. That saving files locally is a big risk.

Our user community understands this phylisophy and works with it successfully. (Informing the end-users like this really was a huge task a few years back. But now almost everyone has a home computer...and if they don't they have been working on one for many years. I find that the end-users are more computer savey now a days.

If this is not a possibility, I know backup products like ARCSERVE and BACKUPEXEC have agents to backup workstations. This might be more efficient for you.

Also, I've seen products that will copy directories on the client machine to the server. You configure the directories that you want copied and then on the log OUT, the files are copied to the server. Then you just have to back up the server. However, I can't remember the name of the software that did this for us. (It was pretty cheap.)

Hope this helps..
Joseph L. Poandl
MCSE 2000

 

[tbalazs]

So perhaps I could use a GPO to run a logoff script?
Tony.

 

[thmpsnt]

Have you entertained the though of running a Citrix Metaframe solution? It all depends on the level of your user, but is very effective in reducing administration costs in time, and resources. If you don't want to force everyone into full Metaframe session, you can also "publish" apps from Metaframe, so as to reduce strain on local workstations (allowing hardware to be usefull and not so obsolete longer), as well as reduces deskside calls for reinstalls of applications, and other app issues.

 

[Guest_imported]

I believe you can use a program by IOMEGA that allows a person to save to 2 seperate places at once...

you can select a mapped drive as the second source.

Program costs about 30$, compusa just had a 30 rebate going on with that prog but its over now...