Group Policy compounding method for Windows Server R2 control site hiding and restricting access to any drive letter

Setting items for domain-controlled hidden drive characters

In 组策略管理编辑器 , open the user configuration → policies → Administrative templates →windows component →windows Explorer, which has two items:

1. Hide these specified drives in My Computer
2. Prevent access to drives from my computer

Set only * The first item will allow the drive character to disappear in the Explorer window, but you can still access the disk by opening the file location of the shortcut , and setting the second item * both to hide the drive letter and to prevent the user from accessing the disk directly in the resource manager through other means.

System default configuration scheme

In the edit window of both of these options, the discovery system provides only the following scenarios by default:

• Limit A and B only
• Limit c only
• Limit D only
• Limit ABC only
• Limit ABCD only
• Restrict all disks
• No Limit

If you need to limit the combination of the drive letter to exist, then enable the selection, but generally do not meet the requirements.

To add a method that restricts any disk options

To restrict all disks except the E disk, for example:

1. Copying template files

Copy the folder below the * * C:\Windows\ path PolicyDefinitions to the C:\Windows\SYSVOL\sysvol\xxx.com\Policies * * Path ( XXX.com is the name of the domain network set, assuming the system disk is C disk;

2. Modify the template file

Locate the file in * * C:\Windows\SYSVOL\sysvol\xxx.com\Policies\PolicyDefinitions, WindowsExplorer.admx open it with Notepad, and look for "NoDrives" * *, Locate the following code snippet:

  
 

   
  

  
<policy    name  =   "NoDrives"    Span class= "ATN" >class =   "User"    displayname  =   "$" (string. NoDrives) "   explaintext  =   "$" (string. NODRIVES_HELP) "   presentation  =   "$ (presentation. NoDrives) "   key  =   "Software\microsoft\windows\currentversion\policies\explorer"  >   
   
  

  
 <parentCategory ref="windows:WindowsExplorer" />
   
  

  
 <supportedOn ref="windows:SUPPORTED_Win2k" />
   
  

  
 <elements>
   
  

  
 <enum id="NoDrivesDropdown" valueName="NoDrives" required="true">
   
  

  
 <item displayName="$(string.ABOnly)">
   
  

  
 <value>
   
  

  
 <decimal value="3" />
   
  

  
 </value>
   
  

  
 </item>
   
  

  
 <item displayName="$(string.COnly)">
   
  

  
 <value>
   
  

  
 <decimal value="4" />
   
  

  
 </value>
   
  

  
 </item>
   
  

  
 <item displayName="$(string.DOnly)">
   
  

  
 <value>
   
  

  
 <decimal value="8" />
   
  

  
 </value>
   
  

  
 </item>
   
  

  
 <item displayName="$(string.ABConly)">
   
  

  
 <value>
   
  

  
 <decimal value="7" />
   
  

  
 </value>
   
  

  
 </item>
   
  

  
 <item displayName="$(string.ABCDOnly)">
   
  

  
 <value>
   
  

  
 <decimal value="15" />
   
  

  
 </value>
   
  

  
 </item>
   
  

  
 <item displayName="$(string.ALLDrives)">
   
  

  
 <value>
   
  

  
 <decimal value="67108863" />
   
  

  
 </value>
   
  

  
 </item>
   
  

  
 <item displayName="$(string.RestNoDrives)">
   
  

  
 <value>
   
  

  
 <decimal value="0" />
   
  

  
 </value>
   
  

  
 </item>
   
  

  
 </enum>
   
  

  
 </elements>
   
  

  
 </policy>
  
 

Add a paragraph to the displayName Note:

  
 

   
  

  
 <item displayName="$(string.NotE)">
   
  

  
 <value>
   
  

  
 <decimal value="67108847" />
   
  

  
 </value>
   
  

  
 </item>
  
 

valueCalculation of:

Low, bits on (1 bit per drive)

Can be seen:

value	value (binary)	represents the limit of the drive letter
3	11	Ab
4	100	C
8	1000	D
7	111	Abc
67108863	1..1 (26)	ALLDrives

That is, a 26-bit binary number represents a combination of 26 drive characters:

• The lowest digit represents a, the highest digit represents z;
• Each digit represents a drive letter, which is limited to 1 for the drive letter, and 0 for No limit

Therefore, to set only allow access to the E-drive, which is to restrict all drive characters except E, the binary number should be:

Zyxwvutsrqponmlkjihgfedcba
11 1111 1111 1111 1111 1110 1111

Converted to decimal, the resulting value value should be: 67108847

3. The final step

For a system that uses Chinese, the file is found in * * * * C:\Windows\SYSVOL\sysvol\xxx.com\Policies\PolicyDefinitions\zh-CN, WindowsExplorer.adml also opened with Notepad, Find the following stringtable code snippet:

  
 

   
  

  
 <stringTable>
   
  

  
 <string id="ABCDOnly">仅限制驱动器 A、B、C 和 D</string>
   
  

  
 <string id="ABConly">仅限制驱动器 A、B 和 C</string>
   
  

  
 <string id="ABOnly">仅限制驱动器 A 和 B</string>
   
  

  
 <string id="ALLDrives">限制所有驱动器</string>
   
  

  
 <string id="ClassicShell">启用经典外观</string>
   
  

  
 <string id="ClassicShell_Help">此设置允许管理员将特定的 Windows Shell 行为还原到经典外观行为。
  
 

Add a sentence in it:

 
   
  

  
    
   
<string id="NotE">限制除E外所有驱动器</string>
 
   
  

Finally, go to 隐藏“我的电脑”中的这些指定的驱动器 and 防止从“我的电脑”访问驱动器 Select Enable Just added * * To restrict all drives except e * *.

From for notes (Wiz)

Windows Server R2 Controls how the site hides and restricts access to any drive letter Group Policy compounding method