0

On Windows XP I want to create a new user for browsing only. Thus I want it to have access only to the download Folder. While this can be archived with file privileges easily, I cannot find a way to "hide" (as in "there is no way to access it") complete drives from the user. So the files that are in the root of the drive can be listed (not read) which poses a (quite small) security thread that I'd like to eliminate.

Edit

Obviously there is not much use in hiding my main partition where the system files are on. So this is about "hiding" partitions which are unrelated to both, my browser and files of the operating system.

Also to clarify "hiding" a bit more: From the perspective of the restricted user "hidden" drives should be unmounted. However, the restricted user is only used as a secondary login, so my main user is logged in at the same time and should continue to access the files happily.

2 Answers 2

1

I believe you want this policy, perhaps in tandem with Hyppy's suggestion.

http://technet.microsoft.com/en-us/library/cc978514.aspx

Keep in mind the following:

This policy does not prevent users from using programs to access local and network drives.

Any programs that rely on these drives will still operate normally. Furthermore, unless they're locked down with proper NTFS permissions, users will be able to get a look at files on these drives using programs.

0

Using Group Policy, you can hide specific drives in My Computer.

Detailed explanation here: http://support.microsoft.com/kb/231289

5
  • Although this would hide them, I believe they'd still be accessible if the individuals typed in the drive letter.
    – pk.
    Mar 25, 2011 at 20:16
  • Well, the drives still need to be accessible in some fashion, otherwise the user wouldn't be able to run the web browser. Disabling the Run command and Command Prompt would also help out too I suppose.
    – Hyppy
    Mar 25, 2011 at 20:19
  • Well if I use a portable browser (FF in my case) I only need to access the directory and the system files. However, if I also have a Partition "D:" there is no need for the user to see it at all.
    – Mene
    Mar 25, 2011 at 21:56
  • How about deny permissions on the entire drive for the users' group?
    – Hyppy
    Mar 26, 2011 at 18:18
  • yes, thats what I want to do, but when accessing the drives properties through explorerer there is no permissions tab
    – Mene
    Mar 29, 2011 at 10:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .