Prevent Local Data Saves

[Hamins]

Hi,

We have a network running a single Windows 2003 Std. server (Acts as file/print server, DC, DHCP, DNS etc.) with around 25 XP clients. All the data lies centrally on the server. The users are not supposed to save data locally on the client PCs they're working on. Is there any way (GPO etc.) to prevent users from saving any data onto the local (client PC) drives ?

Also, is there any way to preventing users from installing any application onto the client PCs ?

A detailed response would be really appreciated.

Thanks !

[tain]

Depending on your cash availability and how important it is that this policy be enforced, these things are AWESOME:

http://www.centuriontech.com/products/centurionguard/

I've used them for public access PCs. Kiss your tech support worries goodbye! You get a fresh new client just like you intended every time you boot it up.

[Hamins]

Interesting product. However, I'm looking for lost-cost solution, using the existing resources (Active Directory/GPO). Thanks anyway, Tain

[Ctrl-X]

Some reading you may find interesting: Profile and Folder Redirection In Windows Server 2003

[Hamins]

Thnx for your response Ctrl-X. However, I know of roaming profiles and folder re-direction, and have already implemented them on the network. I'm looking for a way to deny users from saving anything onto the local drives. They should be able to save all work related data in a specific folder on the server.

Anyone know how to do that ?

[Ctrl-X]

You could apply NTFS restrictions to all local folders that might be used to save data. Unfortunately users would still need write access to some folders (Temp, local profile), so a determined user could always find a "workaround".

[yianniv]

There are two very useful settings in GP under:

User Configuration/Administrative Templates/Windows Components/Windows Explorer:

- Hide these specified drives in My Computer

- Prevent Access to drives from My Computer

The first only hides the drive (e.g. c:) but you can still access it by typing it in the address bar.

The second does ...well prevent access.

The user still has access to %temp% and other critical folders. Read the relevant Help in the setting.

A small hint, you will save yourself a lot of trouble if you don't give administrative rights to your users.

Regards,

Yianni

[tarquel]

yianniv hehe you just beat me to it.

By far, the cheapest way - along with the suggestion of not giving admin rights to users who aren't admins

EDIT: forgot to mention thats how i do it hehe

Cheers

Nath

Edited September 26, 2006 by tarquel

[Hamins]

None of the users have admin rights. However, they can still save data on the Local HDD of the client PCs. They can also install certain programs.

[tarquel]

if none of them have admin rights, then follow the advice of yianniv's post to do what you are after.

Regards

Nath

[Hamins]

Thanks for your response guys. I've already tried most of the above mentioned suggestion, but they don't work. Some programs still get installed.