Re: Prevent User from Saving/Changing Files on Desktop

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 12/30/04 

Date: Wed, 29 Dec 2004 23:17:46 -0700

Not that I am aware of, as the sting is likely stored in a resource
file used in generating the binaries (in all language versions). 

-- 
Roger Abell
Microsoft MVP (Windows  Security)
MCSE (W2k3,W2k,Nt4)  MCDBA
"Jason Ryon" <JasonRyon@discussions.microsoft.com> wrote in message
news:79621D42-F1A3-417F-B19C-489398C3196F@microsoft.com...
> This works very nicely.  Thank you.
>
> One more thing...now if something attempts to write to this, it gives an
> error saying "Cannot save or replace filename: Access is denied.  Make
sure
> that the disk is not full or write protected and that the file is not
> currently in use."
>
> Is there someway to change this error message to say something like "You
> cannot save to this desktop, please save all items to removable media or
to
> your network file space"?
>
> "Roger Abell" wrote:
>
> > You could try using cacls in a login script to replace the
> > user's grant on the desktop folder in their profile.
> > Evidently the profile is always recreated when they log in
> > so you need to make the adjustment in the login script, and,
> > as they normally will have a grant of full control they are
> > able to change the permissions (or rather, it is possible in
> > their login script context)
> >
> > cacls  "%userprofile%\desktop" /t /e /p %username%:r
> >
> > The savy user may notice that, if they have ownership of
> > their profile, they can change the permissions.
> >
> > -- 
> > Roger Abell
> > Microsoft MVP (Windows  Security)
> > MCSE (W2k3,W2k,Nt4)  MCDBA
> > "Jason Ryon" <JasonRyon@discussions.microsoft.com> wrote in message
> > news:E36BF11B-3BDF-4852-B7F9-A07ACAB25A09@microsoft.com...
> > > Does anybody know how to prevent the users on a computer from storing
> > their
> > > files to the desktop (WinXP)?  This will be used for a lab
environment,
> > where
> > > the profiles are automatically deleted from the computer after log
off.  I
> > > want to restrict it so the users can't even save files temporarily to
the
> > > desktop (save to, or drag to, etc.) so they won't feel bad when their
> > files
> > > are deleted.  Any ideas?
> >
> >
> >

Relevant Pages

  • Re: Prevent User from Saving/Changing Files on Desktop
    ... error saying "Cannot save or replace filename: ... > user's grant on the desktop folder in their profile. ... > so you need to make the adjustment in the login script, and, ... they can change the permissions. ...
    (microsoft.public.windows.group_policy)
  • Re: Prevent User from Saving/Changing Files on Desktop
    ... You could try using cacls in a login script to replace the ... user's grant on the desktop folder in their profile. ... they can change the permissions. ...
    (microsoft.public.windows.group_policy)
  • Re: Profile for All Users
    ... You would use a login script or some similar means to deploy the necessary ... .prf file that holds the profile settings and should be invoked when Outlook ... Sue Mosher, Outlook MVP ...
    (microsoft.public.outlook.installation)
  • Re: Adding New Users
    ... Login script is just the usual SBS_LOGIN_SCRIPT.bat ... They don't have local admin rights. ... profile on thenew computer. ... Using Outlook 2007, perhaps? ...
    (microsoft.public.windows.server.sbs)
  • Re: Login Script - Drive Mapping
    ... It is also not a PC authentication issue, as 99% of the login script works. ... We map 5 to 6 drives with this script. ... So on their home machine, I deleted their profile, and had them login....and ...
    (microsoft.public.windows.server.active_directory)