Incorrect "Prevent Access to Drives from My Computer" Informational Message (315191)
The information in this article applies to:
- Microsoft Windows 2000 Professional SP1
- Microsoft Windows 2000 Professional SP2
- Microsoft Windows XP Professional
This article was previously published under Q315191 SYMPTOMS
There is a documentation error in the Windows 2000 Professional and Windows XP Professional "Prevent access to drives from My Computer" group policy informational message. The informational message for this group policy incorrectly states:
If you enable this setting, users cannot view the contents of the selected drives in My Computer or Windows Explorer. Also, they cannot use the Run dialog box, the Map Network Drive dialog box, or the Dir command to view the directories on these drives.
Although the Group Policy object (GPO) is applied, it is possible to browse the folder structure by clicking the plus sign (+) in the Folders pane of Windows Explorer. As soon as you click a folder name, the preceding informational message about the restriction appears. Lastly, it is still possible to use the dir command from a command prompt (Cmd.exe) against the according drive.
RESOLUTION
To disable the ability to browse from the Folders pane by clicking the plus sign in addition to setting the "Prevent access to drives from My Computer" group policy, also set the "Hide these specified drives in My Computer" for the appropriate drive.
For additional information about how to lock down a Windows 2000 Terminal Server session, click the following article number to view the article in the Microsoft Knowledge Base:
278295
How to lock down a Windows Server 2003 or Windows 2000 Terminal Server session
To prevent the use of the dir command by using Cmd.exe, set the folder's NTFS permissions accordingly (a program-independent solution), or do not allow Cmd.exe to run by using
the "Disable the command prompt" group policy under Administrative Templates, System.
STATUSMicrosoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. MORE INFORMATION
The provided functionality of Windows Explorer is by design. Cmd.exe does not have the ability to check for the "Prevent access to drives from My Computer" group policy setting.
| Modification Type: | Minor | Last Reviewed: | 3/1/2005 |
|---|
| Keywords: | kbdocerr kbenv kbprb KB315191 |
|---|
|