REPOST: Context menu reveals server drive

[Guest]

Archived from groups: microsoft.public.windowsnt.terminalserver.misc (More info?)

Original Posting:
Our new implementation of Citrix Metaframe XP and Server 2003 farm has a
flaw I'd like to eliminate. When a user right-clicks and Explores the Start
menu they are able to see the C: drive of whatever server their session is
on. Anyone know a GPO setting or other way to prevent this?

TIA, Dave

I received a response from a Microsoft MVP that was useful, but the document
to which I was referred seems to only offer the possibility of removing the
shortcut/context menu entirely from Windows Explorer. I don't want to remove
the context menu completely, I only want to remove the ability to explore
the Start Menu button, which provides users a shortcut to the terminal
server's C: drive. Any other suggestions?

Dave

 

[Guest]

Archived from groups: microsoft.public.windowsnt.terminalserver.misc (More info?)

I would create a custom Start Menu and use folder redirection.
Store the custom Start Menu on a network share on a file server.

I suppose you hide the local server drives?
As you have noticed, hiding things has often a very limited
effect, and it's only cosmetic. Whatever GPO or reghack you use to
hide drives from users, there will be applications that show the
drives anyway.

Examples are the command window, all "Save as" dialog boxes in
standard applications like Office, the address field in Internet
Explorer, and there are lots more.
What I mean to say is: if you don't want your users to have access
to a part of the file system, you'll need NTFS permissions.

--
Vera Noest
MCSE,CCEA, Microsoft MVP - Terminal Server
http://hem.fyristorg.com/vera/IT
*----------- Please reply in newsgroup -------------*

"David Levine" <davidlevine@hotmail.com> wrote in
news:uAmXA42bEHA.3016@tk2msftngp13.phx.gbl:

> Original Posting:
> Our new implementation of Citrix Metaframe XP and Server 2003
> farm has a flaw I'd like to eliminate. When a user right-clicks
> and Explores the Start menu they are able to see the C: drive of
> whatever server their session is on. Anyone know a GPO setting
> or other way to prevent this?
>
> TIA, Dave
>
> I received a response from a Microsoft MVP that was useful, but
> the document to which I was referred seems to only offer the
> possibility of removing the shortcut/context menu entirely from
> Windows Explorer. I don't want to remove the context menu
> completely, I only want to remove the ability to explore the
> Start Menu button, which provides users a shortcut to the
> terminal server's C: drive. Any other suggestions?
>
> Dave

 

[Guest]

Archived from groups: microsoft.public.windowsnt.terminalserver.misc (More info?)

Thank you again Vera. We have already redirected My Docs and Desktop to a
place other than where the users' roamng profiles are stored. This is a good
idea. However, as you point out, many other glimpses to the servers' system
drives are available even though we do hide that drive via GPO. So maybe we
just need to make sure that nothing sensitive is visible there.

David
"Vera Noest [MVP]" <Vera.Noest@remove-this.hem.utfors.se> wrote in message
news:Xns952E753591B3Fveranoesthemutforsse@207.46.248.16...
> I would create a custom Start Menu and use folder redirection.
> Store the custom Start Menu on a network share on a file server.
>
> I suppose you hide the local server drives?
> As you have noticed, hiding things has often a very limited
> effect, and it's only cosmetic. Whatever GPO or reghack you use to
> hide drives from users, there will be applications that show the
> drives anyway.
>
> Examples are the command window, all "Save as" dialog boxes in
> standard applications like Office, the address field in Internet
> Explorer, and there are lots more.
> What I mean to say is: if you don't want your users to have access
> to a part of the file system, you'll need NTFS permissions.
>
> --
> Vera Noest
> MCSE,CCEA, Microsoft MVP - Terminal Server
> http://hem.fyristorg.com/vera/IT
> *----------- Please reply in newsgroup -------------*
>
> "David Levine" <davidlevine@hotmail.com> wrote in
> news:uAmXA42bEHA.3016@tk2msftngp13.phx.gbl:
>
> > Original Posting:
> > Our new implementation of Citrix Metaframe XP and Server 2003
> > farm has a flaw I'd like to eliminate. When a user right-clicks
> > and Explores the Start menu they are able to see the C: drive of
> > whatever server their session is on. Anyone know a GPO setting
> > or other way to prevent this?
> >
> > TIA, Dave
> >
> > I received a response from a Microsoft MVP that was useful, but
> > the document to which I was referred seems to only offer the
> > possibility of removing the shortcut/context menu entirely from
> > Windows Explorer. I don't want to remove the context menu
> > completely, I only want to remove the ability to explore the
> > Start Menu button, which provides users a shortcut to the
> > terminal server's C: drive. Any other suggestions?
> >
> > Dave
>