For our installation image for Windows 10 (Education version), I'd like to prevent users from creating new folders on the
C:\. The installation is used by students sharing PCs in a class room, and therefore we want to keep the main directory of the disk clean (they all have home directories to store their data). In the current installation of Windows 7 I could very simply edit the permissions using the standard Windows GUI. With Windows 10, it fails.
What I already tried:
- Changing the permissions from the GUI → Failed to enumerate objects in the container (Access is denied).
- Taking ownership of the
C:\directory from the GUI → Access is denied
- Adding a Deny entry from the GUI, without changing the existing permissions → Access is denied
- Changing the permissions using
caclsfrom an elevated command prompt → Access is denied
- Taking ownership from an elevated command prompt using the
takeown /f c:\ /acommand → Access is denied
takeowncommands from a command prompt running under the SYSTEM user (obtained with
psexec64) → Access is denied
Despite the fact that it should not be a security risk to allow users to create their own folder at
C:\ (new files are not permitted), this is not what we want, because we would like to make sure people use their home (which has backups and snapshots, unlike the local PC hard drives).
The permissions on
C:\ look the same that were on a Windows 7 Enterprise installation, including the mandatory label (
icacls displays in both cases
Mandatory Label\High Mandatory Level:(OI)(NP)(IO)(NW)), and the owner is the same (
TrustedInstaller), so I wouldn't expect to see a difference between Windows 7 and Windows 10 on this.
Now, there is an option that actually works: using
cacls from the Windows 10 recovery command prompt. However, although this solution is fine for the image deployment, we also have several machines that need to be corrected manually because we can't reimage them. Despite the fact that I can boot the Windows 10 recovery over PXE (using
memdisk and an ISO image of the CD), it would be very helpful if this could be done from within the actual OS running on the machines. Even better if it can be one with a GPO.