2

I have two Windows 2012 R2 Domain Controllers and will be implementing 7 Windows 2008 R2 remote desktop servers once their setup and testing is complete (I have one built now that is my test server). I've set up a group policy that redirects the users' My Documents, Music, Pictures, Videos, and Downloads folders to a file server I've built running Windows 2012. The problem I'm having is removing access to the Public Libraries - C:\users\public\documents, music, downloads, etc. - as I don't want anybody to have the ability to save to the local machine. With my test user I know that I can right click My Documents, select the public folder, then click remove for each of the five public folders I don't want them to have access to but I'm looking for a better solution as I don't want to have to remove all 5 folders for all 150+ users manually.

I've looked through the GPOs and searched Google and Server Fault and this doesn't appear to be anything that I can do via group policy. I've started looking into logon scripts but I'm not sure where to begin and I've seen some complaints that the logon scripts simply hide the folders from the navigation panel while leaving them as a usable save location.

I'm sure there is something I'm overlooking somewhere and I hope that you guys may be able to provide some guidance.

1
  • Undesirable side-effect of disablement is perpetually repeated logged events "Error verifying known folder...."
    – guest
    Dec 23, 2019 at 16:45

3 Answers 3

4

It is possible with Group Policy. Those folders are Known Folders and you can disable them through Group Policy. Have a read at these links:

http://msdn.microsoft.com/en-us/library/windows/desktop/bb776911(v=vs.85).aspx

http://technet.microsoft.com/en-us/library/dd744697(v=ws.10).aspx#WS_DisableKnownFolders

http://msdn.microsoft.com/en-us/library/windows/desktop/dd378457(v=vs.85).aspx

So you'll configure the GPO setting with the GUID of the KnownFolder that you want to disable.

I do this exact thing in an RDS farm that I manage for one of my clients.

3
  • That's pretty much exactly what I was looking for. I am still having a small issue - the public Music, Video, and Picture folders are not showing up....however the Public Documents folder is still there. Any ideas? Jan 15, 2015 at 18:55
  • If it was already created then I believe you have to remove it manually. THE GPO should prevent it from being recreated.
    – joeqwerty
    Jan 15, 2015 at 19:16
  • That's what it seemed to say in the pages you linked to...I've just read that deleting the public folders outright is a bad idea. Plus, the public music, videos, etc. were already created and it removed access to those. I double checked to make sure I didn't screw up the GUIDs and they appear to be correct. Jan 15, 2015 at 19:34
2

Libraries are XML documents stored in %APPDATA%\Roaming\Microsoft\Windows\Libraries. You can create a policy to delete those files, or replace with libraries configured per your requirements.

0

Change the NTFS permissions on C:\Users\Public. That will make it non-writable regardless of whether the users have the subfolders in their libraries or they navigate to it directly.

While you're at it, make sure they can't create folders in C:\ or the root of any other drives.

To customize libraries for better UX, see the other answers.

3
  • I thought about that but I want to avoid as many, "I'm trying to save to my documents and it's telling me it's been restricted" phone calls as I can. I'd rather just not have them see those locations as an option. Jan 15, 2015 at 18:28
  • The phone will still ring, but with a different problem - instead of "I can't save to my docs!" it will be "Why don't I see my docs?"
    – Clayton
    Jan 15, 2015 at 19:07
  • I've redirected their user specific My Documents to a fileserver. In my testing they still have their My Documents - its just not stored locally. I want to remove the public folders so they don't try to select them as a save location and get a warning. Jan 15, 2015 at 19:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .