Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to accomplish the following task: A user must not have rights to save in his/her Desktop, My Documents, My Music, My video, My picture, etc.

I have already prevent & hide all drives via GPO, but still user are able to store files in the locations listed above. How can I configure the desired behavior?

Server OS = Window server 2008 R2

Client OS = Window XP, Vista & Window 7

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

It's very easy if you are using Window server 2008 Server.

Just create a Group Policy Object, go to Computer Configuration > Policy > window Setting > Security Setting > File System and there - Right click and add %userprofile%\Desktop ....etc and there you can specify the rights on user or Groups.

share|improve this answer
add comment

This is possible with a logon script, but it's a bit tricky, and would require testing to ensure that it works correctly for the target environment. It makes assumptions about the ACE entries in the ACL (system, Administrators, and the user), and that the user is the owner (they typically are). It isn't bullet-proof security, but it can help minimize the casual "save a 2 GB iso file to the roaming profile desktop folder" scenario.

In broad strokes, when a user logs on, at the end of the last logon script, ACL their Desktop and other locations so that they have Read and Execute permission.

In the logOFF script, revert the permissions back to normal.

At the start of the logON script, there should also be a check to reset the permissions to normal in the event that the logoff script failed.

There are a variety of ACL tools to use: icacls, fileacl, setacl.

Determining the correct path can be performed using the following PowerShell syntax:

[Environment]::GetFolderPath("DesktopDirectory")  

That should be used to ensure that the operation is performed on the redirected location, and not the local location.

To obtain a list of all the Environment Special Folder locations:

[Environment+SpecialFolder]::GetNames([Environment+SpecialFolder])  

That typically returns:

Desktop
Programs
Personal
MyDocuments
Favorites
Startup
Recent
SendTo
StartMenu
MyMusic
DesktopDirectory
MyComputer
Templates
ApplicationData
LocalApplicationData
InternetCache
Cookies
History
CommonApplicationData
System
ProgramFiles
MyPictures
CommonProgramFiles

Note that there are both Desktop and DesktopDirectory special folders.

Here is a sample PowerShell command to use FileAcl set the Desktop folder to Read and Execute for a user:

$user = [System.Environment]::ExpandEnvironmentVariables("%USERDOMAIN%\%USERNAME%")
$exe = "C:\util\FileAcl\FileAcl.exe "
$arg1 = [System.Environment]::GetFolderPath("DesktopDirectory")
$arg2 = "/S"
$arg3 = "`"NT AUTHORITY\SYSTEM`":F"
$arg4 = "/S"
$arg5 = "`"" + $user + "`"" + ":RX"
$arg6 = "/S"
$arg7 = "`"BUILTIN\Administrators`":F"
$arg8 = "/REPLACE"
$arg9 = "/PROTECT"
$allArgs = @($arg1, $arg2, $arg3, $arg4, $arg5, $arg6, $arg7, $arg8, $arg9)


&$exe $allArgs  

To set the folder to Modify permission for the user, arg5 would be:

$arg5 = """ + $user + """ + ":RWXD"

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.