Block copy files From File Server to Desktop

WinWorker 61

Hi,

Here in my company I installed a File Server with old files (oldest than 2019), and I need to available these files for a consult for all employees. However, these files mustn't be copied by any user into their desktops (without change permissions). In short: this File Server will be an Archive server. Is it possible?

Thank you.

MotoX80 32,551 Reputation points

2020-11-03T21:21:55.34+00:00

Just change the permissions on the share to allow only a certain local or AD group to access the share. Then add/remove users as they require access. Or remove the share completely.

Accepted answer

MotoX80 32,551 Reputation points

2020-11-04T20:11:52.627+00:00

To expand on DSPatrick's comment, if you allow the users to run Word/Excel on their desktop and read the documents through a file share, then they can do a "file save as" and put it anywhere that their account has write access. Or just use the Explorer and do a copy/paste. You can't stop it if the user has read access.

You have to eliminate the file share from the data access path.

I don't know if any exist, but one thought would be to investigate some 3rd party software that implements a "display only" flavor of Word/Excel in a browser. The users would log on to a web site, select the folders and view the files. The users would be able to see the data but there would be no "save as" option to copy the data. Your organization may have to write your own web application to accomplish that. The web app would need to run on the archive server so that the file can be accessed directly and not through a file share.

Do you have Citrix or a Terminal server where you can publish applications? I am not an expert with MS Office applications, but I would expect that there is some way that you could customize the menu and remove "save as". Turn the archive server into a terminal server and run the published "no save as" versions to allow users to read the data through the published apps.

You could also enable RDP to the archive server and install Office there. Again, you would remove the network share and the users would directly access the file system. You would need to implement firewall rules to block SMB access from the archive server to other file servers and the users desktops.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

7 additional answers

WinWorker 61 Reputation points

2020-11-10T15:30:19.94+00:00

Hi all,

I'm back with another question, like the opposite: Is there a way to avoid copying older files (from 31/12/2018 back) to my current File Server? By this, I'd be avoiding copying files from my Archive server to my File Server.

Thank you
Please sign in to rate this answer.
MotoX80 32,551 Reputation points

2020-11-10T22:53:53.91+00:00

Sorry, I don't quite understand the data flow. Is the user running a process (explorer/word/excel) on their desktop, or via RDP on the file server or on the archive server? Are they going through the network share on the archive server, through the network share on the file server, or accessing the local file system somewhere?

If the combination of user+process+computer has read access to the old files, and write access to new server then you won't be able to stop it.

You could always write a Powershell script that analyzes the files on the new file server and alerts you if it finds a file with a create date from 31/12/2018 or older. Run that script daily on the assumption that in normal cases the users will obey your rules and not copy the files. You'll have to analyze all of your files to see which date property you need to analyze and see if any of the current files would produce a false match.

MotoX80 32,551 Reputation points

2020-11-11T12:30:46.507+00:00

I have not looked at FSRM in several years, but this is your best bet for a software solution.

https://learn.microsoft.com/en-us/windows-server/storage/fsrm/fsrm-overview

https://learn.microsoft.com/en-us/windows-server/storage/fsrm/checklist-apply-file-screen-to-volume-or-folder
Sign in to comment
WinWorker 61 Reputation points

2020-11-12T13:02:05.927+00:00

Hi @MotoX80

First of all, thank you for answering. Well, I think FSRM doesn't work in this case since it isn't working with old files. I didn't find a feature so that I could block copying files to my File Server earlier than 31/12/2018, and this resource is what I'm looking for.

Is there a tool, or command to avoid copying older files than 31/12/2018 in my File Server? Or, quite the contrary, there is a command or tool to avoid copying files from my archive server? One of these options would solve my problem.

Thank you
Please sign in to rate this answer.
MotoX80 32,551 Reputation points

2020-11-13T00:29:59.067+00:00

FSRM is the only tool that I know of that attempts to manage files like that.

Even if you find some 3rd party tool that could block the the files, if your users have read access to \ArchiveServer\Data, then they can copy the files to their desktop, make some trivial change, and then save the files on \NewFileServer\Data. Your NewFileServer would have no way of knowing where the file came from and it would look like a newly created file.

As I replied earlier you can easily write a Powershell script to analyze the Created and Modified dates on files. There may be a legitimate reason that your users would need to put a file with an "old" timestamp on your new file server. Threaten the users with termination if you catch them copying files from the archive server.

The only way to guarantee that the archived file data can't be copied is to implement a display only application that is used to access the archived files. You have to eliminate the network share.

WinWorker 61 Reputation points

2020-11-13T17:03:06.86+00:00

Hi @MotoX80

I'll give up. I think that's not possible. I hope workers here don't copy back the files to File Server...anyway.

Thank you very much.

MotoX80 32,551 Reputation points

2020-11-13T17:26:07.407+00:00

Good luck.
Sign in to comment
code.work 0 Reputation points

2024-02-27T08:45:18.6733333+00:00

do you know how make this ??
Please sign in to rate this answer.
MotoX80 32,551 Reputation points

2024-02-27T22:48:11.76+00:00

Please read all of the comments in this discussion.

https://community.spiceworks.com/topic/1717954-how-to-lock-a-shared-file-from-being-copied

If your users have read access through the file share, then they can copy the file. You would have to get rid of the file share and implement some other technology like "Publish it via RDS (Terminal Services)" as the one user suggested and lock down what that TS session can access.
Sign in to comment

Share via

Block copy files From File Server to Desktop

7 additional answers