Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On Windows XP I want to create a new user for browsing only. Thus I want it to have access only to the download Folder. While this can be archived with file privileges easily, I cannot find a way to "hide" (as in "there is no way to access it") complete drives from the user. So the files that are in the root of the drive can be listed (not read) which poses a (quite small) security thread that I'd like to eliminate.

Edit

Obviously there is not much use in hiding my main partition where the system files are on. So this is about "hiding" partitions which are unrelated to both, my browser and files of the operating system.

Also to clarify "hiding" a bit more: From the perspective of the restricted user "hidden" drives should be unmounted. However, the restricted user is only used as a secondary login, so my main user is logged in at the same time and should continue to access the files happily.

share|improve this question

2 Answers 2

I believe you want this policy, perhaps in tandem with Hyppy's suggestion.

http://technet.microsoft.com/en-us/library/cc978514.aspx

Keep in mind the following:

This policy does not prevent users from using programs to access local and network drives.

Any programs that rely on these drives will still operate normally. Furthermore, unless they're locked down with proper NTFS permissions, users will be able to get a look at files on these drives using programs.

share|improve this answer

Using Group Policy, you can hide specific drives in My Computer.

Detailed explanation here: http://support.microsoft.com/kb/231289

share|improve this answer
    
Although this would hide them, I believe they'd still be accessible if the individuals typed in the drive letter. –  pk. Mar 25 '11 at 20:16
    
Well, the drives still need to be accessible in some fashion, otherwise the user wouldn't be able to run the web browser. Disabling the Run command and Command Prompt would also help out too I suppose. –  Hyppy Mar 25 '11 at 20:19
    
Well if I use a portable browser (FF in my case) I only need to access the directory and the system files. However, if I also have a Partition "D:" there is no need for the user to see it at all. –  Mene Mar 25 '11 at 21:56
    
How about deny permissions on the entire drive for the users' group? –  Hyppy Mar 26 '11 at 18:18
    
yes, thats what I want to do, but when accessing the drives properties through explorerer there is no permissions tab –  Mene Mar 29 '11 at 10:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.