Deny access to Drives

[Jay]

I want to deny access to all drives including c:\ for all
users except administrators on a stand alone win2k
machine. Is there a way to do this?

Thanks,

Jay

 

[Chriss3]

HOW TO: Apply Local Policies to all Users Except Administrators on Windows
2000 in a Workgroup Setting:
http://support.microsoft.com/default.aspx?scid=kb;en-us;293655

Hide these specified drives in My Computer

(User Configuration\Administrative Templates\Windows Components\Windows
Explorer)
http://msdn.microsoft.com/library/en-us/gp/239.asp


--
Regards,

Christoffer Andersson
No email replies please - reply in the newsgroup
If the information was help full, you can let me know at:
http://www.itsystem.se/employers.asp?ID=1

 

[Guest]

Chris,

Thanks for the info, but I need to know how to deny from
the run command in the start menu. I already denied
access the other ways. Sorry for not being specific.

Jay

 

[Chriss3]

Do you want to deny them just to see the drivers, or prevent them to save
data to the drives?

--
Regards,

Christoffer Andersson
No email replies please - reply in the newsgroup
If the information was help full, you can let me know at:
http://www.itsystem.se/employers.asp?ID=1

 

[Jay]

Both. I do not want them accessing the CDROM, Floppy, or
HD at all.

Thanks,

Jay

 

[emdee [MCSA]]

Both. I do not want them accessing the CDROM, Floppy, or
HD at all.

Thanks,

Jay



prevent them to save

Make a copy of the Original Hardware Profile and put it at the top of
the Hardware Profile list (with a zero second timeout).
Reboot the machine so you're in that Hardware profile and then disable
those devices in Device Manager.

If you need to get at the devices your self at a later date you'll need
to change the order of the Hardware Profiles so the originals at the top
and reboot.

--

_/ _/ _/_/_/
_/_/ _/_/ _/ _/
_/ _/ _/ _/ _/
_/ _/ _/ _/
_/ _/ _/ _/
_/ _/ _/_/_/

 

[emdee [MCSA]]

Make a copy of the Original Hardware Profile and put it at the top of
the Hardware Profile list (with a zero second timeout).
Reboot the machine so you're in that Hardware profile and then disable
those devices in Device Manager.

If you need to get at the devices your self at a later date you'll need
to change the order of the Hardware Profiles so the originals at the top
and reboot.

Apologies, this is a good plan for the Floppy and CD Drive.
Obviously you need a different approach for the HDD.

I'd suggest using the HIDE Drives and Prevent Access through my Computer
Group Policy options and ensure that the NTFS permission are set at
appropriate levels.

--

_/ _/ _/_/_/
_/_/ _/_/ _/ _/
_/ _/ _/ _/ _/
_/ _/ _/ _/
_/ _/ _/ _/
_/ _/ _/_/_/

 

[Herb Kraft]

Should be able to do this using the policy:
Local computer policy\user configuration\administrative templates\windows
explorer\prevent access to drives from my computer

Even though it says "My Computer", it really applies to all access.

From the explain tab:
Prevents users from using My Computer to gain access to the content of
selected drives.

If you enable this policy, users cannot view the contents of the selected
drives in My Computer, Windows Explorer, or My Network Places. Also, they
cannot use the Run dialog box, the Map Network Drive dialog box, or the Dir
command to view the directories on these drives.

To use this policy, select a drive or combination of drives from the
drop-down list. To allow access to all drive directories, disable this
policy or select the "Do not restrict drives" option from the drop-down
list.

Note: The icons representing the specified drives still appear in My
Computer, but if users double-click the icons, a message appears explaining
that a policy prevents the action.

Also, this policy does not prevent users from using programs to access local
and network drives. And, it does not prevent them from using the Disk
Management snap-in to view and change drive characteristics.

Also, see the "Hide these specified drives in My Computer" policy.