Locking down c drive and profiles
Hi, In my organization, we have a policy in place where the users aren't able to save the c drive. We used a GPO to lock down C:\, preventing users from accessing this partition. We have their My Documents folder, bookmarks, etc redirected to a server as well using GPO. So far, both these things work perfectly in Windows XP. The issue I'm having now is that we're migrating to Win 7, and users can access their personalized folder at C:\Users\%username%. Obviously, this doesn't comply to my organization's standards, since the users can still save to a part of the C drive. Is there any way that I can stop users from saving locally to this portion of the C drive? We've considered roaming profiles, but I've been instructed from higher-up's to stay away from that. So, at this point, that's not an option. Thanks in advance!
February 22nd, 2011 11:06am

You could use Folder Redirection GPOs to put the user Profile directory somewhere else??? http://technet.microsoft.com/en-us/library/cc771969.aspx I don't have time to test this one, but theoretically you could put the folders you need to on D:\ or secondary partition of the drive, or on some network share that the user has access to. Utilizing folder redirection with Offline File Sync works a lot better than using Roaming Profiles. Have a look, r/ johnJohn Wildes | Senior Enterprise Architect | United Airlines | Desktop Engineering
Free Windows Admin Tool Kit Click here and download it now
February 22nd, 2011 11:33am

Hi John, Thanks for your quick reply. I can't move it to another partition because theres only a couple of computers that have another partition, but if I move it to a network share, does that make it the same as a roaming profile? I apologize in advance if my questions are silly, I'm still very new at this. Thank you for your help Rohan
February 22nd, 2011 1:06pm

I thought so at first...but they are truly different technologies. Folder Redirection essentially uses Offline File Sync technology to keep files in sync with a network share. The files are stored in the C: location where Offline Files Cache is maintained, and presented to the user in MY DOCUMENTS / MY PICTURES / Etc , profile folders. There is some configuration that needs to be done on AD, and GPO's that need to be created, as well as having a network storage location for the files that belong to the users. Users State Virtualization is what Microsoft is trying to accomplish by using Folder Redirection, and less emphasis on "Roaming Profiles" as they've been used in the past. Here's a few links look at with respect to User State Virtualization. Microsoft User State Virtualization Portal http://technet.microsoft.com/en-us/windows/ff629664 By a group policy MVP http://www.grouppolicy.biz/2010/08/best-practice-roaming-profiles-and-folder-redirection-a-k-a-user-virtualization/ john John Wildes | Senior Enterprise Architect | United Airlines | Desktop Engineering
Free Windows Admin Tool Kit Click here and download it now
February 22nd, 2011 1:52pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics