Locking down c drive and profiles
Hi,
In my organization, we have a policy in place where the users aren't able to save the c drive. We used a GPO to lock down C:\, preventing users from accessing this partition. We have their My Documents folder, bookmarks, etc redirected to a server as well
using GPO. So far, both these things work perfectly in Windows XP.
The issue I'm having now is that we're migrating to Win 7, and users can access their personalized folder at C:\Users\%username%. Obviously, this doesn't comply to my organization's standards, since the users can still save to a part of the C drive.
Is there any way that I can stop users from saving locally to this portion of the C drive? We've considered roaming profiles, but I've been instructed from higher-up's to stay away from that. So, at this point, that's not an option.
Thanks in advance!
February 22nd, 2011 11:06am
You could use Folder Redirection GPOs to put the user Profile directory somewhere else???
http://technet.microsoft.com/en-us/library/cc771969.aspx
I don't have time to test this one, but theoretically you could put the folders you need to on D:\ or secondary partition of the drive, or on some network share that the user has access to. Utilizing folder redirection with Offline File Sync works
a lot better than using Roaming Profiles.
Have a look,
r/
johnJohn Wildes | Senior Enterprise Architect | United Airlines | Desktop Engineering
Free Windows Admin Tool Kit Click here and download it now
February 22nd, 2011 11:33am
Hi John,
Thanks for your quick reply. I can't move it to another partition because theres only a couple of computers that have another partition, but if I move it to a network share, does that make it the same as a roaming profile?
I apologize in advance if my questions are silly, I'm still very new at this.
Thank you for your help
Rohan
February 22nd, 2011 1:06pm
I thought so at first...but they are truly different technologies. Folder Redirection essentially uses Offline File Sync technology to keep files in sync with a network share. The files are stored in the C: location where Offline Files Cache
is maintained, and presented to the user in MY DOCUMENTS / MY PICTURES / Etc , profile folders. There is some configuration that needs to be done on AD, and GPO's that need to be created, as well as having a network storage location for the files that
belong to the users.
Users State Virtualization is what Microsoft is trying to accomplish by using Folder Redirection, and less emphasis on "Roaming Profiles" as they've been used in the past. Here's a few links look at with respect to User State Virtualization.
Microsoft User State Virtualization Portal
http://technet.microsoft.com/en-us/windows/ff629664
By a group policy MVP
http://www.grouppolicy.biz/2010/08/best-practice-roaming-profiles-and-folder-redirection-a-k-a-user-virtualization/
john
John Wildes | Senior Enterprise Architect | United Airlines | Desktop Engineering
Free Windows Admin Tool Kit Click here and download it now
February 22nd, 2011 1:52pm