Path= Lockdown GPO setting?

Question

Hello,

Is there a way to lock down the default path from a GPO? 

Is there a way to lock down the default path and not let any changes happen?

Is there a way to protect or lock down the path as a administrator?

Answer 1

You wont see some GP settings unless you are running in an actual domain. If this is for a one-off computer, then you would need to configure permissions manually. But, as I noted, folders like Program Files, Windows\System32, and other non-user specific folders paths require administrative permissions to modify, so this is somewhat moot.

Answer 2

Hello William,

thanks for the reply,

When you said "That said, if you want to set permissions on folder/files that are not otherwise protected, then you can use GPO by going to Computer Configuration > Windows Settings > Security Settings > File System."

I looked into this there is no file system tab inside of this to lock out changes to the path, is there another location in the GPO editor I should look into?

There is no file system under security settings there is policies however.

Answer 3

Hi and thanks for reaching out. My name is William, I’m an Independent Advisor. I'll be happy to help you out today.

Which paths? If you mean the paths in the screen shot taken from the environmental variables, those paths are already protected from being modified by standard user accounts. You need to be an admin to modify those paths, and in some case you cannot even modify those paths or their files without running in the context of the system account (using psexec, for example) or without taking ownership of the folder/files.

That said, if you want to set permissions on folder/files that are not otherwise protected, then you can use GPO by going to Computer Configuration > Windows Settings > Security Settings > File System.