Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One of our servers, TTSA, has no group policies applied to it when logging in as a local admin (other than the local policy), yet access to the C:\ and D:\ are still restricted.

I've checked the local policy, and sure enough there is no restriction on these drives set (Administrative Templates -> Windows Components -> Windows Explorer -> Hides these specified drives in My Computer / Prevent access to drives from My Computer).

Does anybody know what else could be restricting access to these drives for local admin, or if there is perhaps more settings in GP that could be causing this that I am unaware of? Thanks.

share|improve this question
1  
Have you tried running RSOP? That should rule out Group Policy. Is it a terminal server by any chance? Also you say as a local admin - have you tried creating a brand new local admin account and seeing if that has the issue. –  Dan May 29 '12 at 10:15
    
@Dan - It is indeed a terminal server. Just run RSoP (neet tool, much easier then scouring through the output from the cmd GPresult), and neither of the keys mentioned in my post are in there. Will try creating a new admin account now and see if that does the trick. Thanks. –  David Gard May 29 '12 at 10:32
    
I have hunch - I can't remember the reg path, but I suspect that the regkeys are in the Terminal Services installation folder thing (You know the whole "change user /install" thing). Let me Google! –  Dan May 29 '12 at 10:34
    
Ha, created a new admin account (in the exact same groups as the built-in local admin), and it allowed me access. Just having a look at your answer now. Thanks. –  David Gard May 29 '12 at 10:45
1  
Ah, if that worked then it's probably NOT the issue in my answer. You can either use regedit to edit the other users NTUSER.DAT file, or just delete the account and start again (Probably easier) –  Dan May 29 '12 at 10:46
show 5 more comments

2 Answers

What I suspect has happened is that a user with GPO's applied has installed software by using the

change user /install

command. Browse to the following registry location

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\

And see if you have a key anywhere under there called "Policies". (Possibly \Software\Policies) If so, then this key is probably being applied, at logon, to all users (Including administrators). I'm afraid this is off the top of my head and I don't have a Terminal Server to view right now, but hopefully this will point you the right way.

You'll need to delete it (Take a backup first!) in order to resolve this issue.

share|improve this answer
    
Did have a quick look, and as you suspected above, this was not the answer. Have sorted though, thanks for you help along the way. –  David Gard May 29 '12 at 11:33
add comment
up vote 2 down vote accepted

It appears that the issue is because, once applied at any time through Group Policy, the 'Prevent access to drives from My Computer' policy setting is not reset in registry when a policy that sets it is no longer called.

To fix, change the 'NoViewOnDrive' key in the location below to '0' (to allow access to all drives) -

HKEY_LOCAL_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Here is a detailed description of the key, and how to restrict access to specified drives if required - http://www.pctools.com/guides/registry/detail/1157

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.