Hi,
M said:
I have tried this info and found working:
http://www.gruppenrichtlinien.de/HowTo/Laufwerke_ausblenden.htm
But when I tried accessing the drive thru cmd, I can still see and access
files from drive c: for example which I already restrict it on GPO. How can
I handle this case?
In cmd.exe it should work,if you deny acces to them aswell and not only
hide them but not in command.com or any other program that is not using
the explorer API.
This policy (or lets say Reg-Entry) can only restrict the explorer.exe
and all other programs that uses open/close dialogs from the explorer.exe
If you are running an old Office 2000 you cxan access everything, if you
are using e.g Total Commander as an alternate Filebrowser, everything is
accessable etc.
It´s only depending on the explorer.exe like a lot of other policies
do aswell.
So, you can´t accomplish your task only by hidding the driveletters.
The user needs to read the files from C: or D: so there is alwqays a way
to access the drive. otherwise he wouldn´ßt be able to start his
environment or even start a program.
Combine it with NTFS Permissions and perhaps Software Restriction Policies
to only allow the programs that you define and don´t care that some
people "see" the files. As long as they can´t manipulate them or read
critical data they fine.
Mark
