NTFS permissions setting

[Jeremy Schubert]

At our school, we have student computers with two partitions, c and d. The
c drive is frozen with deep freeze. The d drive is not frozen so students
can use it to render videos.
I have developed a program that allows the teachers to create sub folders on
the d drive and assign modify permissions to specific students.
Since teachers can do that, I have only given students the permission to
read and view contents on the root of d so that they can navigate to and
open their folders.
But I also have to make the students local administrators so they can use
their video editing programs poperly.
So, when students try to create a folder on their own on the root of d, they
get a message saying you can't do that. But they can go into the properties
for the d partition and manipulate the Security (NTFS) settings. Even
though they can't seem to create a folder when they give themselves full
rights (because their global group is denied), I'd like to know how to hide
the permissions from them if possible (or at least have it so they can't
manipulate the permssions even if they can see them).
Any suggestions? Thanks,
Jeremy

 

[Richard Giagnacovo]

Ideally, it would be better to sort out the permissions and group
memberships to prevent student users making any permission changes
whatsoever. However, if I understand you correctly, I think you want to
hide the 'Security' tab from the 'Properties' dialogue box.

Do you apply group policies to your student accounts? The easiest way
to do this would be using Group Policy. The location of the policy is,
User Configuration, Administrative Templates, Windows Components,
Windows Explorer, Hide Security tab - set this to enabled.

 

[Jeremy Schubert]

Thank you for the GPO Richard. I will use that to start with.
I have denied the global student group access to the folder but I think
they're still able to see the security settings because they need to be
local administrators (for their video editing programs to work). Does this
sound right? What settings do I need to make so the global group can see
but cannot modify the permissions?

Thanks, Jeremy