Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using a Windows 2003 R2 server and an XP system. I want to save any file (like- .doc, .xls, audio and video file) directly on the server from XP system.

There must be no option to save the file locally or XP system. If any one want to file locally then a message will be generated and display information for permission denied. How I can prevent to save functionality on my XP system?

Is there any policy to prevent that?

share|improve this question

2 Answers 2

You might want to look into using Roaming Profiles. This fits your description very closely. Simply store all user profiles on a remote location.

Please note that an XP user profile cannot be reused in Vista/7. If you decide to upgrade to Windows 7, you will create a second version of each profile for Windows 7 workstations (negating some of the value).

share|improve this answer
    
thanks a lot. But one thing is that after creating a roaming profile for a user or system, it will be prevent to save any files (as I mentioned) on local system or not by using another user account on same system with same domains. plz reply –  Ghost Answer Mar 17 '12 at 7:58
    
Windows will cache the profile locally when a user logs in, then do a differential synchronization every time thereafter. I believe you can set it to use the server-side profile exclusively, but this will make logins very slow. Test it in your environment first –  Joel E Salas Mar 17 '12 at 8:11
1  
A roaming profile won't prevent the user from saving files to locations on the local machine outside of the profile. They can browse from the Save As dialog box to any location on the local machine outside of the Documents and Settings folder and save the file. In addition, there isn't any way to "run" the profile from the server exclusively. A roaming profile is always loaded locally on the computer. It may be deleted when the user logs off but there's no way to prevent it from being loaded on the local computer in the first place. –  joeqwerty Mar 17 '12 at 11:49
    
Thank you for clarifying! –  Joel E Salas Mar 17 '12 at 18:43

Its not possible to completely prevent people from saving files locally if they are determined to do so. Users need, at the very least, a local temporary directory that they can write to in order for their account to work and they can always find where this is to hide files in.

What you can do, however, is the following

  • Use a roaming or mandatory profile that's configured to keep things on the server as much as possible instead of on the local workstation.
  • Use a group policy (GPO) for folder redirection, and redirect all users normal folders (documents, IE favourites, etc) to their home share location on a server
  • Use a GPO to disable any off line files synchronisation
  • Use a GPO to set disk permissions for users to be very restricted in where they can write (this is the default for non admin users if you were using windows 7, so to be honest I'd think about an upgrade here as it will make things easier).
  • Use a GPO to delete profiles cached on the local machine, ensuring that anything that is left behind in a user temp folder will not live long.
  • You can use a GPO setting to hide drives to actually hide the c: drive from explorer, and this will hide it from the file dialogues of any applications that respect the explorer settings, thus ensuring that users cannot use it as a save target. However, far too many applications don't respect this setting, and therefore if you have a lot of apps on these workstations (rather than just one or two you can test) then this setting turns out to be more trouble than its worth.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.