Restrict Folder or File Create or deletion or modify on local domain users.

Question

Restrict Folder or File Create or deletion or modify on local domain users.

rs.ath 0

I am Sys Admin, I need to implement for local users that the local domain users cannot create or modify for folder or file they should have only access to store or create on the Server based network folder.

From Windows Server 2019 how i can implement and disabled all the drives only access for network folder.

Provide me the detailed guide with all steps.

glebgreenspan 2,245 Reputation points

2024-04-08T13:46:21.4633333+00:00
Hello

Step 1: Create and Configure Group Policy Objects (GPOs)

Open Group Policy Management Console (GPMC):

Log in to your Windows Server 2019 domain controller.

Press Win + R, type gpmc.msc, and press Enter to open the Group Policy Management Console.

Create a New GPO for Drive Restrictions:

In the GPMC, expand your domain name, right-click on "Group Policy Objects," and select "New."

Enter a name for the new GPO (e.g., "Restrict Local Drives") and click "OK."

Edit the New GPO:

Right-click on the newly created GPO and select "Edit" to open the Group Policy Management Editor.

Step 2: Configure Drive Restrictions for Local Users

Navigate to User Configuration:

In the Group Policy Management Editor, expand User Configuration > Policies > Administrative Templates > System > Removable Storage Access.

Configure Removable Disks: Deny write access:

Double-click on "All Removable Storage classes: Deny all access" policy.

Select "Enabled" to restrict access to all removable storage devices.

Click "OK" to apply the policy.

Configure Floppy Drives: Deny write access:

Double-click on "Floppy Drives: Deny write access" policy.

Select "Enabled" to restrict access to floppy disk drives.

Click "OK" to apply the policy.

Step 3: Configure Folder Redirection for User Data

Create Shared Network Folders:

Set up shared network folders on your Windows Server 2019 for user data storage.

Assign appropriate permissions to these folders based on user roles and requirements.

Configure Folder Redirection GPO:

In the Group Policy Management Editor, navigate to User Configuration > Policies > Windows Settings > Folder Redirection.

Right-click on "Documents," "Desktop," or other user profile folders and select "Properties."

Choose "Basic - Redirect everyone's folder to the same location."

Enter the UNC path of the network folder (e.g., \server\share%USERNAME%) where user data will be redirected.

Select appropriate options for policy removal and conflict resolution.

Click "OK" to apply the folder redirection policy.

Step 4: Apply GPOs to User Groups or Organizational Units (OUs)

Link GPOs to Specific OUs:

In the Group Policy Management Console, navigate to the desired Organizational Unit (OU) containing the target user accounts.

Right-click on the OU and select "Link an Existing GPO."

Choose the GPOs you created (e.g., "Restrict Local Drives" and "Folder Redirection") and click "OK."

Force Group Policy Update:

On client machines, open Command Prompt with administrative privileges.

Run the command: gpupdate /force to force an immediate update of group policies on client computers.

Step 1: Create and Configure Group Policy Objects (GPOs)

Open Group Policy Management Console (GPMC):

Log in to your Windows Server 2019 domain controller.

Press Win + R, type gpmc.msc, and press Enter to open the Group Policy Management Console.

Create a New GPO for Drive Restrictions:

In the GPMC, expand your domain name, right-click on "Group Policy Objects," and select "New."

Enter a name for the new GPO (e.g., "Restrict Local Drives") and click "OK."

Edit the New GPO:

Right-click on the newly created GPO and select "Edit" to open the Group Policy Management Editor.

Step 2: Configure Drive Restrictions for Local Users

Navigate to User Configuration:

In the Group Policy Management Editor, expand User Configuration > Policies > Administrative Templates > System > Removable Storage Access.

Configure Removable Disks: Deny write access:

Double-click on "All Removable Storage classes: Deny all access" policy.

Select "Enabled" to restrict access to all removable storage devices.

Click "OK" to apply the policy.

Configure Floppy Drives: Deny write access:

Double-click on "Floppy Drives: Deny write access" policy.

Select "Enabled" to restrict access to floppy disk drives.

Click "OK" to apply the policy.

Step 3: Configure Folder Redirection for User Data

Create Shared Network Folders:

Set up shared network folders on your Windows Server 2019 for user data storage.

Assign appropriate permissions to these folders based on user roles and requirements.

Configure Folder Redirection GPO:

In the Group Policy Management Editor, navigate to User Configuration > Policies > Windows Settings > Folder Redirection.

Right-click on "Documents," "Desktop," or other user profile folders and select "Properties."

Choose "Basic - Redirect everyone's folder to the same location."

Enter the UNC path of the network folder (e.g., \server\share%USERNAME%) where user data will be redirected.

Select appropriate options for policy removal and conflict resolution.

Click "OK" to apply the folder redirection policy.

Step 4: Apply GPOs to User Groups or Organizational Units (OUs)

Link GPOs to Specific OUs:

In the Group Policy Management Console, navigate to the desired Organizational Unit (OU) containing the target user accounts.

Right-click on the OU and select "Link an Existing GPO."

Choose the GPOs you created (e.g., "Restrict Local Drives" and "Folder Redirection") and click "OK."

Force Group Policy Update:

On client machines, open Command Prompt with administrative privileges.

Run the command: gpupdate /force to force an immediate update of group policies on client computers.

1 answer

Your answer

Answer 1

rs.ath 0

upon all the steps you given . Tried the policy is not implementing for the users device .

the some policy gets applied , but restriction folders and files creation or modify is not getting properly.'

Share via

Restrict Folder or File Create or deletion or modify on local domain users.

1 answer

Your answer