Restrict Access to Selected drives using Group Policy

[Raffye.Memon]

Hello,

I've been trying to restrict access to drives for all computers on domain.

There is a policy where we can restrict access to C , D or All drives.. !! but wont let me choose drives. i want to restrict.

I want give access to C , X , Y and Z drives only, All other drives will be restricted.... X , Y , Z are mapped drives.

My DC is Windows server 2008 R2, i goggled for the custom Admin templates, but looks like 2008r2 using Admx formats which cannot be edited. !

Thanx for the help !

[Teebor]

I normally do this through Registry - http://www.pctools.c...try/detail/148/

I've not used it this but it looks like it calculates the values for you - http://www.wisdombay.com/hidedrive/index.php

[Raffye.Memon]

Thanx that will work for sure... !

Will deploy the .Reg file for this.. ! but it would be good if there is a way to impose group policy on certain groups and users .. !

[+BudMan MVC]

And why can you not use group policy to deploy whatever reg entries you want? Which could in turn only be deployed to whatever users/groups you want.

Im a bit confused at what your trying to accomplish anyway?

Is there some partition on the computer users should not have access too? Like what?? A recovery partition? Why would a partition on the disk that users are not suppose to have access to even be mounted? As to mapped drives -- at a complete loss here, shares you do not want users to access you would set with normal ntfs/share permissions -- why you would try and restrict access to shares in group policy makes no sense to me at all.

Are you trying to block access to removable media like a cd/dvd or usb drive? Why can users not have access to drive letters on their machine? And then maybe I can help you figure out the best way to do it - but currently Im lost to the point of what your trying to actually accomplish.

[Teebor]

The reason I usually do it is I have users who need to run applications from a network share but they don't need to know its on a network share or be able to browse the contents of that share.

Also as an extra lock down tend to hide drives like the local C drive, they can't write to it (to save files they later whine about loosing) so why should they be able to see it? I tried booting a PC without it not being able to see the C drive but it didn't work :p

[+BudMan MVC]

"but they don't need to know its on a network share or be able to browse the contents of that share"

What? Anyone interested in looking at the properties of the shortcut they are clicking will see where its running from. As to not browsing -- again this normally done with permissions on the share/ntfs not through trying to hide the drive letter from them.

If you don't want users writing files to drives, ok -- this again is simple ntfs permissions. Hiding the letter from them accomplishes what exactly?? Sorry I just do not see this as an extra anything other than waste of time on the admin side doing such things.

[Raffye.Memon]

actually we have a company policy which recently imposed... that users are not allowed to save anything on local hard drives.. ! but we already have D and E drives on computers.. ! i have backuped all the data from those drives to servers .. but users still save stuff on these drives. i just want to lock down the access to any drives other then system drive and 3 network drives. already deployed .reg files via GP . ! but still want to know is there a way to do it via admin templates... ! like i edited system.adm back when we were using 2003 server.. !

[Raffye.Memon]

and its only hiding the drives.. ! user still able to browse to drive typing D: and E: in address bar . ! :(

[+BudMan MVC]

"but we already have D and E drives on computers.."

Why??

if users are not allowed to save files there, then change ntfs to prevent it or just delete the partition/remove the drive.

[Raffye.Memon]

^ doing that on 80+ computers will be a pain.. ! :)

anyways registry setting above .. its working fine...now... ! thanx alot !

Thanx alot budman .. ! u are always here to give a helping hand.. ! GOD bless you bro ! :)

[+BudMan MVC]

Well yeah it would be a PITA, but to be honest it would be the correct way.. Not saying you have to do it all it an afternoon ;)

Glad you setting worked for you, but its pointless to have space being wasted on the machine the user can not use. Do you store recovery images there or what?

I would really get around to changing the machines drive makeup if your not going to let them use them.. Go with maybe smaller GB SSDs to get speed and use less juice for laptops, etc. No reason to have a TB drive in machine if users can not even write to them ;)

[Raffye.Memon]

No space is not wasted.. iam using it for system images or anything else i wanted to use... ! have FTP access to these drives.. ! :)