GPO to prevent users from accessing the root folder of their profile doesn't work

Hi,
Here's the scenario:
In a Windows 2012 RDS I created two groups called RemoteApp users and remote desktop users.
These groups are defined in the collection for the corresponding RD Session hosts.
These groups are not included in any other group, but they are located under an OU -called  Remote Users.
In the domain controller I have created a GPO named "Restrict access to root drive"  which is linked to the Remote Users OU.
The GPO I selected is - "Prevent users from adding files to the root of their users files folder"
This doesn't seem to work. I have waited more than a few hours to allow the 90 minutes update, plus used the gpupdate /force
but when a user clicks on the RemoteApp (Excel in this example) then access to the C: drive (which is the root folder of the user's profile) is enabled, and the user can create folders and save files under C:.
I tried to run gpresult for the specific user but the GPO I created wasn't mentioned.
I thought this would be a straight forward mechanism, but somehow it looks like something is missing.
I have read about loopback and expanding, but not sure if this is what needs to be done, and if yes - I'd appreciate if I can get  step by step instructions. Everything I found so far was VERY vague.
Thanks !
One more detail that may be relevant - the DC is a Windows Server 2012, and the session host is a Windows 2012 R2.

> These groups are not included in any other group, but they are located
> under an OU -called  Remote Users.
>
> In the domain controller I have created a GPO named "Restrict access to
> root drive"  which is linked to the Remote Users OU.
>
The USER accounts need to be in the OU your GPO is linked to. Despite
their name, GPOs do NOT apply to groups, but to users (and computers).
Groups only provide an additional layer of filtering...
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Similar Messages

  • Whenever I try to open Firefox it says cannot establish connection, maybe your firewall is preventing us from accessing the web.

    Whenever I try to open Firefox it says cannot establish connection, maybe your firewall is preventing us from accessing the web. Even though I've let Firefox through my firewall, this message still appears. And whenever I try to redownload it, it just says installation failed. It does this with all installations... Is there something wrong with my computer? How do I fix it?

    Sometimes you only disable the user interface of security software, but the firewall or anti-virus services are still running in the background.
    It is possible that your security software (firewall, anti-virus) blocks or restricts Firefox or the plugin-container process without informing you, possibly after detecting changes (update) to the Firefox program.
    Remove all rules for Firefox and the plugin-container from the permissions list in the firewall and let your firewall ask again for permission to get full unrestricted access to internet for Firefox and the plugin-container process and the updater process.
    See:
    *https://support.mozilla.org/kb/Server+not+found
    *https://support.mozilla.org/kb/Firewalls
    *https://support.mozilla.org/kb/fix-problems-connecting-websites-after-updating

  • I need help in resolving a problem that prevents me from accessing the iTunes store.  Message reads " iTunes cannot contact the iTunes store" and also says that my laptop is no longer authorized to access my account.  Help!

    I need help in resolving a problem that prevents me from accessing the iTunes store.  Message reads " iTunes cannot contact the iTunes store" and also says that my laptop is no longer authorized to access my account.  Help!

    Go up to the top of your screen on iTunes and click on 'Store'.  Then go down to 'Authorize This Computer'.  That should cover part of it unless you've already authorized a bunch of other computers to use your account.  If that's the case, you'll have to go to one of those computers and click the button just below it to 'deauthorize your account' from that computer.  If you're not able to access the store, check your internet connection to make sure you are connected.  Hope this helps.. good luck!     

  • Is it possible to prevent users from using the ''Purge'' option from the ''Recover deleted items'' in Office 365?

    Hi,
    After speaking with a Microsoft engineer over the phone, I've been told that there is no way to prevent users to go to their OWA and manually Purge specific items from the ''Recover deleted items''. The Microsoft tech told us to place the desired mailboxes
    on a litigation-hold and that all data will be recoverable... but only from the time you place the mailbox onto Litigation-Hold and previous items, which doesn't take effect for new-coming emails. 
    1- From what I understand, any new items coming in the mailbox after the Litigation-Hold is put in place will still be ''purgeable'', right?
    2- Is there a way (PowerShell, Security group, etc.) that can prevent a user from using the Purge option?
    We are very surprised that there is absolutely no thread that talks about this issue, which in our opinion, is a major legal and security flaw from Office 365. This is a main concern for us to actually go with Office365. For instance, this means that at
    any given time, if a user exchanges emails with a competitor, they can manually purge emails sent and receive as soon as it is sent/received, even after Litigation-Hold is in place.
    Thank you for your reply and let us know if you have more questions.
    Normand Bessette, IT support technician, Newad Media

    Thank you for the reply.
    Is there still a way to prevent users from using the Purge option, like with a Powershell script to disable Purge?

  • How to prevent user from deactivating the adobe software

    I am working in a training center, We've got 20 machines here installed with Adobe CS3 production premium (not using network license). The problem now i foresee is the software deactivate problem, i found user can deactivate the adobe software even they dont have XP administrator rights.
    And what i know about activation of adobe software is that there is a limit of activation count of 30 tries and after that i have to call the adobe technical support for help.
    Is there any way that i can prevent user from deactivating the software in terms of registry modification or what other kinds of method.
    Thanks
    Ivan

    If you have 20 machines I assume you have a volume license, which does not require de/activation anyway.
    If you have 20 separate licences... well, the only thing I can think of is to block the Adobe Activation domains of adobe.com through the firewall of your network. You should probably contact Adobe directly for more specific info.

  • I need to prevent unauthorized users from accessing the application pages

    Hi^^,
    I have created an application in jsp and servlets. It has several pages like manager, supervisor accountant. I need to prevent unauthorised users from accessing these pages. In other words I need to implement a filter. Anyone who types a url other than that of the login page needs to be blocked. However I am not able to conceptualize the code that is going to be inside the doFilter() method. Please help
    Sincerely,
    Prashant

    Hi^^,
    I admit that there were some mistakes in the previous posting. I have corrected the mistakes and now there is going to be no compile time error. However when i put in the login id and the password it is redirecting me to the login page. I think that the front end jsp is directing the control to the controller servlet. But as "YOU" have pointed out in your previous post,
    "by default requestDispatcher.forward(...) does not pass through the filter change. If the user requests the login page from their browser however, then they will still get the error message, which may not be appropriate."
    I feel we need to somehow make the code pass through the requestDispatcher.forward(...) method of the servlet.
    I am again posting the corrected code.
    package com;
    import java.io.*;
    import javax.servlet.*;
    import javax.servlet.http.*;
    public class SecurityFilter implements Filter
      public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws   ServletException, IOException
      HttpServletRequest req = (HttpServletRequest)request;
      HttpServletResponse res = (HttpServletResponse)response;
      String X = req.getRequestURI();
      if(X.equals(http://localhost:8080/MyProject/LoginPage.jsp))
         //writing code for passing through the filter
         final class MyGenericFilter implements javax.servlet.Filter
          public FilterConfig filterConfig;
          public void doFilter( final ServletRequest request, final ServletResponse response, FilterChain chain) throws java.io.IOExeption, javax.servlet.ServletException
          chain.doFilter(request,response);
          public void init(final FilterConfig filterConfig)
          this.filterConfig = filterConfig;
          public void destroy()
    else
       HttpSession session = req.getSession();
       String username = (String)session.getAttribute("username");
       if(null==username)
         request.setAttribute("Error","Session has ended. Please login");
         RequestDispatcher rd = request.getRequestDispatcher("Login.jsp");
         rd.forward(request,response);
         chain.doFilter(request,response);
        else
         RequestDispatcher rd = request.getRequestDispatcher("X");
         rd.forward(request,response);
    public void init(final FilterConfig filterConfig)throws ServletException
          public void destroy()
      Edited by: pksingh79 on Aug 12, 2008 5:23 AM

  • We are using version 3.6 on several machines. Is there a way to restrict users from accessing the about:config page?

    Prevent users from making modifications to the about:config page?

    You can do this with the [https://addons.mozilla.org/en-US/firefox/addon/3911/ Public Fox] add-on.
    It can be used to password protect access to about:config. To prevent the user from disabling/uninstalling the add-on, it also allows you to password protect the add-ons manager. You can also lock down other parts of Firefox such as the options dialog and clear history.

  • Is there a way to prevent users from changing the Advanced, Connection, Settings Tab?

    I need to stop network users from changing the proxy settings to avoid the firewall. Is there any way to disable or prevent them from getting to the advanced, connections tab, and changing the settings for the proxy?

    You can lock the corresponding prefs, then users won't be able to change the settings.
    See http://kb.mozillazine.org/Locking_preferences
    See also http://kb.mozillazine.org/about%3Aconfig_entries

  • Prevent users from printing the List of Business Partner window

    Hi All
    I have had this request and not sure if it possible.
    He wants to prevent the users from printing the List of business partner.
    That is when you do a search on the marketing documents.
    when do a search it brings up the window, List of Business Partners.
    they can go to file print...choose table and print the list of BP.
    is there anyway to prevent that?
    Thank you
    Jerusha

    is it a smartform
    You have to disable from ADOBE end
    sfpoutputparams-NOPRINT = X
    when calling the function module FP_JOB_OPEN.
    Unfortunately the PDF converter, which converts the output
    of a Smartform, does not allow to disable the print button.
    Please see note 841850 about this. Only the PDF-based forms
    support this features (class CL_FP_PDF_OBJECT also belongs
    to the PDF-based forms).

  • Mx.core.Window - prevent user from closing the window?

    Hi,
    mx.core.Window has properties 'maximizable' &
    'minimizable', but there doesn't seem to be any 'closable'
    property. In my application I'm creating another window (apart from
    the main application window) that needs to be open the whole time
    the application is running. If I can't prevent the user from
    closing the window, then I'll have to rig up some code to
    automatically re-open it if the user closes it. I'm hoping there's
    a way to prevent the user from closing the window in the first
    place though.
    I'll much appreciate any ideas - thanks :)

    Listen for the window's closing event and call
    preventDefault().

  • Prevent User from Editing the Credit Limit Field

    Hi
    I would like to find out if there is a way to restrict user that has full authorisation to BP Master Data from changing a specific field on the Master Data.
    The scenario is that we allow an user to edit BP Master Data but would like to prevent the user from changing the credit/committment limit fields as it has financial risk and only managers can do so.
    If there any way within the stand SAP authorization that can achieve this requirement?
    BR,
    Jimmy

    Hi Jimmy,
    This would not be achievable through standard authorization.  You may try SP_Transaction_Notification instead.  Search within forum, there are many threads discussing this SP.
    Thanks,
    Gordon

  • Prevent user from closing the applications

    Hello,
    we would like to deploy to our users web application using Internet Explorer which is published over RemoteApps. Because this application takes long time to load we would like to prevent user from closing application. So we would like that session and application
    stays opened when the user clicks on close button on Internet Explorer that is published over RemoteApps.
    In other words, we would like to disconnect client from RemoteApp session, but stay logged in and keep the application running in the background.
    Is this possible to do?
    Thank you!
    Best wishes,
    Marko

    Hello,
    thank you all for your answer. I guess this is not a good news. Any other idea how to solve this problem - to start Internet Explorer web application as soon as possible.
    Last week I have found a VB script on one forum that would close the RemoteApp Windows without closing the appliaction on server but I can't find it today. Does anybody know something about this script?
    Thank you!
    Best wishes,
    Marko

  • Is there a way to prevent AD users from accessing the VPN?

    I have ASA 5510's that authenticate users to the Active Directory. Is there a way to prevent users, that even though they are validated through the AD from being to establish a VPN connection?

    Haven't tested this lately, but with the ipsec client, you used to be able to go to an AD user's "dial-in" tab, and there was a check box there for "allow remote access" or something that. If this was checked, they could authenticate via IAS, if not, they couldn't. This allowed only selected users within AD to use the VPN. Not sure if this is still the case, but it's a start...

  • Is there a configuration option to prevent an unprivileged user from accessing the firefox profile manager and/or firefox safe mode?

    I'm designing a locked-down Firefox user profile for use on public computers (common room in an apartment building). I can use existing plugins and add-ons to prevent access to about:config and to lock down the various firefox preferences but this is moot if a user can still access the firefox profile manager or can start firefox in safe mode. Is there any configuration setting that could prevent this?

    Hi...
    Reinstalled 10.7.3 from the Combo Updater from apples website.
    The only way to reinstall the Mac OS X or repair the startup disk running v10.7.3 Lion, is to use Lion Recovery The combo update does not do that.
    How much free space on the startup disk? Not enough free space can account for the problems with your apps.
    Right or control click the MacintoshHD icon. Click Get Info. In the Get Info window you will see Capacity and Available. Make sure there's a minimum of 15% free disk space.
    and no web-pages will load.
    Try using OpenDNS as suggested here >  Safari 5.0.1 or later: Slow or partial webpage loading, or webpage cannot be found
    Use OpenDNS for better speed, more security, includes anti phishing filters, prevents browser redirects, and it's free.
    Open System Preferences / Preferences then select the Network tab. Click the Advanced tab then click the DNS tab.
    Click +
    Enter these addresses exactly as you see them here.
    208.67.222.222
    Click +
    208.67.220.220
    Then click OK.
    edited by:  cs

  • Prevent users from accessing Exchange online from non ActiveSync Device

    I will try and make this question as clear as I can-
    We recently switched from an on-prem Exchange to Exchange online. Previously, the only three ways of accessing our email was VPN, ActiveSync and webmail. However, it now appears that any user can use any device that accepts an Exchange email account and
    start getting their emails. I understand this is the idea of cloud email, but as a HIPAA organization, this presents a serious security risk. My question is this-how can I track how users access email? I know I can limit things based on IP(http://technet.microsoft.com/en-us/library/hh526961(v=ws.10).aspx),
    but then it would work if they had a VPN connection and we allow certain users to access our servers using their home PC if they use a VPN connection. But now they do not need that. 
    Is there any way to track what devices and users are accessing our hosted Exchange environment, or is this just the nature of hosted email?

    Hi Dkurz8814,
    using Office 365 / Exchange Online you are able to limit access to the Mailbox to OWA and ActiveSync only.
    1. Please logon as an Administrator to the Office365 Admin Center and choose "Users" -> "Active Users".
    2. Now click on your user and view the users properties. Choose more from the menu on the left.
    3. Now choose "Edit Exchange Settings", and choose "Mailbox functions" on the left.
    Now you find some Settings how to access to your mailbox. Disable POP3, IMAP, MAPI, .... so you can get the desired result. On that page you can also check for connected devices via ActiveSync.
    You may also use the set-casmailbox to do the same
    http://technet.microsoft.com/de-de/library/bb125264(v=exchg.150).aspx in case you need a more automatic tool.
    Please let me know if that answered your question.
    Regards,
    Martin

Maybe you are looking for