Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have a mapped drive M: in our Server 2008 R2 64 AD Domain.

There is an important exe and a windows help file on the drive that all users need to access from there.

How can I remove the security restriction on the windows help chm file, so that also the content and not only the table of contents is visible? And also I would like to remove the confirmation dialog that prompts on each start of the exe file.

Please note that I cannot move the files to a local drive, they need to be started from the mapped M: AD share. And I need a centralized solution, I cannot walk to each client computer, actually I am at a different location and have only RDP access to the DCs. So i think an AD Group Policy Setting should do it, but which one and how?

Maybe the file permissions on the share also need to be adjusted?

This is how the drive is mapped:

enter image description here

share|improve this question
    
I'm not sure what I'm looking at in your group policies because I must admit my German is lousy: assuming they are related to your question, could you repost them from a system with English locals, please ? –  Stephane Jun 6 '13 at 11:59
    
What you see is only the AD definition of the share. I would prefer english machines also, but it was not possible to install in english from the media that we have. We do not have an english domain controller. –  Alojz Janez Jun 6 '13 at 13:48
    
You can install the group policy admin tool on any Windows workstation: no need to do it from a DC. –  Stephane Jun 6 '13 at 13:57

1 Answer 1

up vote 1 down vote accepted

CHM located on network shares have been blocked by Microsoft for security reason.

You can bypass this restriction by making the following modification to your registry database:

In the HKLM\SOFTWARE\Microsoft\HTMLHelp\1.x\ItssRestrictions key, add a new string value called UrlAllowList

In this key, add all the pathes where your CHM can potentially be located separated by comas. Beware that you'll need to list all the possible pathes (UNC names and drive mappings if they can be reached in both way) and that you will have to add each value twice: once alone and once with the string file:// in front

For instance, assuming your CHM file is in the w:\program\help path, you will need to enter the following data value:

UrlAllowList=w:\program\help\;file://w:\program\help\

share|improve this answer
    
Thank you. So this has to be done on the client? I will look for a way to change all client registries using the AD tools. –  Alojz Janez Jun 6 '13 at 13:45
    
It is OK for us to list all the paths. We have only one important chm file. –  Alojz Janez Jun 6 '13 at 13:46
    
You can do that using the registry part of your group policy preferences. If you do that on the client, you'll need to do it from an admin, elevated process –  Stephane Jun 6 '13 at 13:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.