Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

We have a restricted Windows 7 computer that hides and prevents non-admin users from accessing the C Drive using the following policies:

However, they are able to circumvent this by typing the following into Explorer: \\localhost\C$

How can I disable this path but allow other UNC paths. For example they are allowed to access a shared folder on a different computer. eg. \\192.168.2.1\SharedTransfer

Note: Simply Enabling the Group Policy: Remove Run menu from Start Menu will not work as this blocks all UNC paths.

Update
The user, called Site User, is not a member of the Administrator group directly or indirectly. It is only a member of the group Users.

Accessed the following from: Control Panel\All Control Panel Items\Administrative Tools\Computer Management (Local) > System Tools > Local Users and Groups

Local Users and Groups
 - Groups
      - Administators
             - Administrator
             - Service User (our admin user)
      - Users
             - NT AUTHORITY\Auntenticated Users (S-1-5-11)
             - NT AUTHORITY\INTERACTIVE (S-1-5-4)
             - Site User (user account in question)
share|improve this question
2  
By default only users in the local Administrators group can access the dollar sign shares. If users can access these shares, then you have granted more permissions the user then they should have somewhere. Fix the permissions problem. –  Zoredache Dec 11 '12 at 0:02
    
@Zoredache How can I check and fix these permissions? Can you please submit an answer and I will try it. –  Ryan R Dec 11 '12 at 0:13
    
Updated question. The user is not part of the administrator group. –  Ryan R Dec 13 '12 at 17:35
    
Are you testing as Service User or Administrator, or are you testing as Site User? –  Scott Chamberlain Dec 13 '12 at 20:11
    
Testing as Site User. –  Ryan R Dec 13 '12 at 20:39

4 Answers 4

up vote 3 down vote accepted
+50

You can disable the "Administrative share" from being created with GPP.

If you navigate to Computer Configuration / Preferences /Windows Settings / Network Shares, you’ll find this hidden gem. Right-click the Network Shares node to create a new share policy.

Source: http://sdmsoftware.com/group-policy-preferences/controlling-shares-on-windows-systems/

Would that solve your problem?

share|improve this answer

I'd like to point out that Group Policies are just registry entries and depend on applications being programmed to read and obey them. If you really want to prevent local users from accessing the C: drive, you should set the permissions on the Security tab in its Properties dialog. This is separate from its sharing permissions. You could for example add a Deny permission (under Advanced) for your "Site user". (this is in addition to preventing them from accessing the C$ share, however you solve that issue)

share|improve this answer
    
This is also a very valid point. –  Ryan R Dec 19 '12 at 18:50

@Zoredache How can I check and fix these permissions? Can you please submit an answer and I will try it.

Open the Administrators group on local machine, see who are the members of that group. Check the people who are accessing \\localhost\C$ are not members of any of the groups (or are members of groups who are members of that group, Administrators <= GroupA <= GroupB <= User).

Once the user, group, or nested group that is a member of Administrators has been removed (via a change in the group policy settings or by hand) the users will no longer be able to access the \\localhost\C$ share.

share|improve this answer
    
I have updated the question. The user is not part of the Administrator group. –  Ryan R Dec 13 '12 at 17:34
    
Can you list the members of the local administrators group (not the one in the domain) –  Scott Chamberlain Dec 13 '12 at 17:48
    
Updated question. –  Ryan R Dec 13 '12 at 17:57
    
This answer, based on Zoredache's comment, is correct. By default only administrators can access the "administrative shares". There's little security to be gained by either a) disabling the administrative shares, or b) denying user access to them. If the remote user is an administrator they can just create any share they want (e.g. \\192.168.2.1\DriveC). If you're following a corporate security policy, then i would just turn off the admin shares. Security policies usually have little to do with security. Timely Schneier blog post –  Ian Boyd Dec 15 '12 at 2:14

There is no general method to disable administrative shares. Only the command:

NET SHARE C$ /delete

can be executed in order to disable such a share in a networked computer. The problem is that the share is automatically recreated after reboot.

A common workaround is to create a batch file to disable administrative shares (they can be viewed by running the NET SHARE command) and scheduling it to run at every system startup by using the Windows Task Scheduler.

source

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.