WHere is this policy?????? / Hide drives

[bran2235]

Ok, I can't believe this but I set a policy somewhere in AD to restrict / hide drives in users' MY COMPUTER (i.e. M:\ N:\ O:\ etc.)... a long time ago.

I happen to be looing in AD and noticed this: When I was looking at my Citrix Server OU, this policy was 'NOT CONFIGURED' !!?? (hide and prevent access were both Not configured). How in the world is this policy happening then??? Anyone have any suggestions???

I have loopback processing turned on and have a CTX Server OU...

Thanks,
Brandon

 

[Ogi]

Have you looked at the Local Computer Policy? gpedit.msc

It's in there!

Cheers,
Carl.

 

[bran2235]

Sorry OGI- wrong-

My users are on thin clients!!!!

Cheers,
Brandon

 

[bran2235]

My bad Ogi- I thought you meant on the user's PCs...

Well, users are on thin clients and I looked at the Server's Local Policy(s) and nothing is set/configured there... My server(s) gets all policies from the Server OU that it sits in...

Any more ideas?? This is killing me!!

Thanks again,
Brandon

 

[ascotta]

ogi & bran2235

I this not the old calculate the drive letter hex number job ?

Cheers
Scott

 

[bran2235]

You are correct Scott- This is how I know that I have done it, in addition to looking at my users' My Computer... The problem is that the policy is 'not configured' under both the "hide drives" and the "Prevent access" in my Citrix Server OU. It's also not a local policy on the server(s) either.. Weird!! I don't know how my users are not able to see the Servers drives !!!

Don't get me wrong, I definitely don't want them to see the MNOP drives... I just want to understand HOW or where this policy is getting used/implemented!!

Any ideas Scott??

Thanks,
Brandon

 

[ascotta]

I have it also in a couple of places. Let me dig about and get back.

Cheers
Scott

 

[ascotta]

User Configuration>Administrativce Templates>Windows Components>Windows Explorer

I think is what you arelooking for to hide all drives.

What I found was the old Project in a box stuff that gave some registry edit to be done
HKCUSoftware\Microsoft\Windows\CurrentVersion\Policies\Explorer
I think this can be done by HKUsers default user.
I did it in W2K3 bu the above user conf and hide all drives.

Cheers
Scott

 

[bran2235]

Yes, I understand the location in the GPO... in my Citrix Server OU, I went to the location you specified and it says NOT CONFIGURED!!! BUT, I know I have configured this policy before to hide specific drives- because it is working!!!

I am just trying to figure out why the policy to hide my server drives is working if it actually says "NOT CONFIGURED"...

Any ideas?

Thanks,
Brandon

 

[ascotta]

I am now grasping at straws but do you have a gpo further up that would be applied to this server ?

Cheers
Scott

 

[bran2235]

Well Scott, that's just it- My Citrix boxes are all in their own OU! NOT inheriting any higher up policies!! Mann this is killing me...

Is there any tool in the resource kit that would help??

Thanks,
Brandon

 

[KCDave03]

if the users cannot see the drives then the policy is active. when I did mine, I just imported the adm just below were I would normally go to diable drive access.

 

[bran2235]

KCDave-
Where did you import the adm file??/how??

Thanks,
Brandon

 

[bran2235]

Ok, folks- UPDATE:
I went to the system.adm file on each metaframe (winnt\inf\system.adm) and the adjustments were already there (I must have done these a long time ago) "Hide M, N, O, and P drives"...

I also checked my default domain policy system.adm file (%systemroot%\sysvol\sysvol\ YOUR DOMAIN NAME \policeis\{31B2F340-016D-11D2-945F-00C04FB984F9}\Adm\System.adm This one I had edited a long time ago too to reflect the same adjustments.
Now, when I look at my 'Default Domain Policy' and and go to UserConfig | Admin Templates | Windows Components | Windows Explorer | and enable the HIDE THESE SPECIFIC DRIVES, my drop down DOES SHOW THE NEW STRING (hide M, N, O, and P drives)...

Now, I am trying to edit my GPO for my Citrix Servers OU. When I go to the same location (above) w/in the OU and enable the HIDE THESE SPECIFIC drives, the drop down list is the default--- no new strings show up (?)

Anyone know why this is?? I thought that each OU uses the default domain policy's system.adm file by default and then you edit it for each OU ??

Do I need to find the specific system.adm file for my Citrix Server OU and then make the changes??? If so, HOW??

I hope all of the above makes sense!!
Thanks,
Brandon