Novell Home

Hiding Drive C from NT Users

Novell Cool Solutions: Trench

Digg This - Slashdot This

Posted: 4 Jun 1999
 

Current Version: Novell ZENworks 2

Russell M. has a cool solution to a problem we lamely attempted to address in a Q&A: How to hide Drive C from users on NT machines. This is a great example of how this community is supposed to work. We can't possibly know everything, so we do our best, and rely on everyone in the community to supply things they've learned in the School of Hard Knocks. So read this, and if you can shed additional light, by all means, chime in. And thank Russell if you see him.

This was on the ZENworks Ask the Experts page:

"Alexander A. wrote: We are defining NT user policies with ZEN. What can we do to hide the drive C in "My Computer" and "NT Explorer?"

Using the policy located at:

NT User System Policies
ZAK Policies
Windows NT
Drives
Restrictions
Show only Selected Drives

we only could hide the drive C in "My Computer". If you open "NT Explorer" you can see the drive C."

The answer you gave was: "We're not positive what's going on, but here's one thought. The policy needs to be associated to the workstation before Drive C: will be hidden. Associate the policy package to the workstation or workstation container and have the user login again to verify if Drive C: is available or not. If you've already done this and it still doesn't work, you'll need to call Support."

I think I can be of assistance to help with what's going on. When a drive is hidden in WINNT, it is only hidden from the graphical browsing functions. If you should ever happen to be on a hidden drive (like when you type C: and press Enter in a common file dialog box) the C: drive will show up. Although it will still not show in the drop-down list, you can now graphically navigate the hidden drive. You can also do this in Explorer with the goto command.

But here is the tricky part of the problem. Unless you tell Explorer where you want it to look (from a command line switch), it goes to whatever is the current default directory. Unless you have already been using Explorer to look around, this will probably be

c:\winnt\profiles\username
OR c:\winnt\system32,
OR c:\,

and just like in the common dialog box, if you happen to be exploring on a hidden drive, the drive becomes visible. Because of the Explorer tree view, it will also be available in the tree view pane. You will also find that as soon as you select a different object in the tree view pane, the C-drive will disappear (Explorer knows it wasn't supposed to be there, but doesn't know what to do about the fact that you are exploring a hidden drive, so it displays it anyway).

Solution

To keep this from occurring, you can change the Explorer icon(s) for the user to run Explorer with a command line switch. We frequently use this command to allow users to use Explorer on their home directory (h: in our environment):

Explorer /e,/root,h:\

This will open up a tree view Explorer with the root of the h: drive selected and expanded. We also often use:

Explorer /select,h:\

This will open up one of those window views. We like to use it because frequently our users will accidentally copy entire drives or tree structures in that right-hand pane of Explorer.

For more information on Explorer command line options look at Microsoft article Q152457.

One Gotcha

BTW, I have not found a way to change the default place Explorer goes to if you don't give it a command line. So even if you lock down the desktop and fix all the Explorer command line options, a person using windows-e on a Windows keyboard can still bring up Explorer looking at the C:drive. (According to the Microsoft website you can redirect this key to null so Explorer won't launch, but I haven't been able to make this work yet.)

I hope this helps.

About that Gotcha...

Tammy Dille sent the following:

Here are two registry hacks to change where Explorer and Find default. This was referenced in "Hiding Drive C from NT Users" by Russell M. under the "One Gotcha" section. So here is a solution that uses registry entries and not command line options.

To change the default drive focus of Explorer:

regedit
HKEY_CLASSES_ROOT\folder\shell\ explore\ddeexec
double click (default)
On the Value Data line, both instances of "%I" with the drive path you wish to start in.
ex: ExploreFolder("Y:\",Y:\,%S)
To change the default drive focus of Find:
HKEY_CLASSES_ROOT\Directory\shell\ find\ddeexec
double-click (Default)
On the Value Data line, replace both instances of "%I" with the path you wish to start in.
ex: FindFolder("Y:\",Y:\)

Additional Question

Here's a follow-up question. Anyone care to chime in?

Ryan M. wrote: In regard to your article "Hiding drive C: from NT users" I see some great ideas, but how does this affect MS Word? Last time I tried hiding drive C:, although it was hidden from Explorer, My Computer, etc., MS Word still cut through to it without any problem. I've been wrestling with this problem for a while. Any input?

Michael J. Prentice

To answer Ryan M.'s question. I stop MS Word and the rest of Office XX from looking to c:\My Documents by changing the following registry to point to their personal drive on the network (which happens to be the P: drive for me).

[HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\ Explorer\User Shell Folders]

"Personal"="p:\\"

Hope this helps.

Bill McKee

We hide the C drives from our users on all of our NT workstations, and don't have a problem with them being visible in any Office applications. There are, of course, a couple of caveats that help this work.

First, you must drag the "Personal" folder from under that user's drive to a network drive, or edit the preferences for file locations so that the default is not drive C. As long as it is not looking there by default, it will not show up in the list of available drives.

Also, you may have to set the temp variable to also point to a network drive (they must have write access, or Word won't lauch, so we set up a temp directory in each users's home directory to point NT's temp variable to). This is because some programs, such as our e-mail program, when you launch an attachment, will open up a temporarily saved copy from the temp directory. Once it is opened from there, Word uses that as the default directory, and you can get to any file that you have local rights to on the c drive, simply by browsing through from within Word.

I think that those two settings (I imagine you already did the first) will clear up your problem. If not, please let me know!

If you have any questions you may contact Bill at bill.mckee@lightnin.gensig.com

Herjo Scholten

I read the articles about hiding the C drive for NT users. We have about 10 computer rooms for students at the Utrecht University. At the moment we are migrating from NW411/Zen1.1 to NW51/Zen2. I tried all the suggestions from the two articles about this issue and I added another very simple one: remove the shortcut to Windows NT Explorer from the startmenu from the default users and replace it with a shortcut to My Computer. This way users can still browse the filesystem without using explorer. The windows-e option can also be disabled through policies. You can even choose to remove the command prompt shortcut so users never get at C.

So I tried all the options on one machine next to each other at the same time and it seems that the C drive is completely gone!


Novell Cool Solutions (corporate web communities) are produced by WebWise Solutions. www.webwiseone.com

© 2014 Novell