**GPO - How to block creation of folder and files in root directory in Windows 10
up vote
0
down vote
favorite
I would like to use a GPO setting to block users to create folders and files in the root directory in Windows 10.
Searching on internet I found the setting
Computer configuration -> Policies -> Windows settings-> Security
Settings-> File System
where I created an entry for %SystemDrive% where Authenticated users have "Deny" to "Create Files/Write data" and "Create folders/append data", applied to "This folder only".
After saving and linking the GPO, I rebooted the workstation to get the new policies but the settings does not block anything.
Any idea what could be wrong? any other suggestion to achieve the same result?
thanks a lot.
windows-10 filesystems group-policy
asked Dec 5 at 16:28
YaKs
11
add a comment |
up vote
0
down vote
favorite
I would like to use a GPO setting to block users to create folders and files in the root directory in Windows 10.
Searching on internet I found the setting
Computer configuration -> Policies -> Windows settings-> Security
Settings-> File System
where I created an entry for %SystemDrive% where Authenticated users have "Deny" to "Create Files/Write data" and "Create folders/append data", applied to "This folder only".
After saving and linking the GPO, I rebooted the workstation to get the new policies but the settings does not block anything.
Any idea what could be wrong? any other suggestion to achieve the same result?
thanks a lot.
windows-10 filesystems group-policy
asked Dec 5 at 16:28
YaKs
11
This is a comment because it does not answer your question: You do not need to use GPO to block creations of folders. All you need to do is change the security settings. Keep in mind that an administrator can ALWAYS undo your changes or get around it. Also, if you want to deny rights on the root, be aware that this will propagate down all folders, so you then have to change the permissions on each sub folder and disable inheritance.
– LPChip
Dec 5 at 16:57
I forgot to mention that I am in a corporate environment and this GPO will be applied to 10,000 workstations. I need to use a GPO. And the rights should not be propagated as I specifically mentioned "This folder only".
– YaKs
Dec 7 at 9:40
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I would like to use a GPO setting to block users to create folders and files in the root directory in Windows 10.
Searching on internet I found the setting
Computer configuration -> Policies -> Windows settings-> Security
Settings-> File System
where I created an entry for %SystemDrive% where Authenticated users have "Deny" to "Create Files/Write data" and "Create folders/append data", applied to "This folder only".
After saving and linking the GPO, I rebooted the workstation to get the new policies but the settings does not block anything.
Any idea what could be wrong? any other suggestion to achieve the same result?
thanks a lot.
windows-10 filesystems group-policy
asked Dec 5 at 16:28
YaKs
11
I would like to use a GPO setting to block users to create folders and files in the root directory in Windows 10.
Searching on internet I found the setting
Computer configuration -> Policies -> Windows settings-> Security
Settings-> File System
where I created an entry for %SystemDrive% where Authenticated users have "Deny" to "Create Files/Write data" and "Create folders/append data", applied to "This folder only".
After saving and linking the GPO, I rebooted the workstation to get the new policies but the settings does not block anything.
Any idea what could be wrong? any other suggestion to achieve the same result?
thanks a lot.
windows-10 filesystems group-policy
windows-10 filesystems group-policy
asked Dec 5 at 16:28
YaKs
11
asked Dec 5 at 16:28
YaKs
11
asked Dec 5 at 16:28
YaKs
11
asked Dec 5 at 16:28
YaKs
11
asked Dec 5 at 16:28
YaKs
11
11
This is a comment because it does not answer your question: You do not need to use GPO to block creations of folders. All you need to do is change the security settings. Keep in mind that an administrator can ALWAYS undo your changes or get around it. Also, if you want to deny rights on the root, be aware that this will propagate down all folders, so you then have to change the permissions on each sub folder and disable inheritance.
– LPChip
Dec 5 at 16:57
I forgot to mention that I am in a corporate environment and this GPO will be applied to 10,000 workstations. I need to use a GPO. And the rights should not be propagated as I specifically mentioned "This folder only".
– YaKs
Dec 7 at 9:40
add a comment |
This is a comment because it does not answer your question: You do not need to use GPO to block creations of folders. All you need to do is change the security settings. Keep in mind that an administrator can ALWAYS undo your changes or get around it. Also, if you want to deny rights on the root, be aware that this will propagate down all folders, so you then have to change the permissions on each sub folder and disable inheritance.
– LPChip
Dec 5 at 16:57
I forgot to mention that I am in a corporate environment and this GPO will be applied to 10,000 workstations. I need to use a GPO. And the rights should not be propagated as I specifically mentioned "This folder only".
– YaKs
Dec 7 at 9:40
This is a comment because it does not answer your question: You do not need to use GPO to block creations of folders. All you need to do is change the security settings. Keep in mind that an administrator can ALWAYS undo your changes or get around it. Also, if you want to deny rights on the root, be aware that this will propagate down all folders, so you then have to change the permissions on each sub folder and disable inheritance.
– LPChip
Dec 5 at 16:57
This is a comment because it does not answer your question: You do not need to use GPO to block creations of folders. All you need to do is change the security settings. Keep in mind that an administrator can ALWAYS undo your changes or get around it. Also, if you want to deny rights on the root, be aware that this will propagate down all folders, so you then have to change the permissions on each sub folder and disable inheritance.
– LPChip
Dec 5 at 16:57
I forgot to mention that I am in a corporate environment and this GPO will be applied to 10,000 workstations. I need to use a GPO. And the rights should not be propagated as I specifically mentioned "This folder only".
– YaKs
Dec 7 at 9:40
I forgot to mention that I am in a corporate environment and this GPO will be applied to 10,000 workstations. I need to use a GPO. And the rights should not be propagated as I specifically mentioned "This folder only".
– YaKs
Dec 7 at 9:40
add a comment |
1 Answer
1
active
oldest
votes
up vote
0
down vote
We can try to troubleshoot as below:
- If the Windows 10 is in the domain environment? If it is in the domain, we can run gpresult report in windows 10 to see if the policy is applied. If it is applied, but it can not block creation folders and files, go to step 2.
- Block other folders in the root directory to see if we can applied the group policy successfully. If we can, maybe we can not set the permission of system root directory.
- If the Windows 10 is not in the domain environment, please keep in mind that this process is only available to a domain with a server running the Group Policy Management feature... standalone systems and workgroups still need to manually assign these permissions! So we can try to set the permission manually.
Reference:
Assign File & Folder Permissions Via Group Policy
https://www.linkedin.com/pulse/assign-file-folder-permissions-via-group-policy-farid-soltani
Creating File System security GPOs
https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-A8D101D3-729F-4299-A591-4AC55A5DD12E.html
Group Policy – GPResult Examples
https://blog.thesysadmins.co.uk/group-policy-gpresult-examples.html
answered Dec 6 at 2:12
Daisy Zhou
575114
I see the GPO applied to the computer using gprsult, but the GPO simply does not seem to do any effect. I also tried to create a local policy with the local group policy editor and the option does not exist. My last test was to try to manually modify the permissions of users in C: and I got an error due to some files being in used, like hiberfil.sys.
– YaKs
Dec 7 at 10:03
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1381058%2fgpo-how-to-block-creation-of-folder-and-files-in-root-directory-in-windows-1%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
We can try to troubleshoot as below:
- If the Windows 10 is in the domain environment? If it is in the domain, we can run gpresult report in windows 10 to see if the policy is applied. If it is applied, but it can not block creation folders and files, go to step 2.
- Block other folders in the root directory to see if we can applied the group policy successfully. If we can, maybe we can not set the permission of system root directory.
- If the Windows 10 is not in the domain environment, please keep in mind that this process is only available to a domain with a server running the Group Policy Management feature... standalone systems and workgroups still need to manually assign these permissions! So we can try to set the permission manually.
Reference:
Assign File & Folder Permissions Via Group Policy
https://www.linkedin.com/pulse/assign-file-folder-permissions-via-group-policy-farid-soltani
Creating File System security GPOs
https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-A8D101D3-729F-4299-A591-4AC55A5DD12E.html
Group Policy – GPResult Examples
https://blog.thesysadmins.co.uk/group-policy-gpresult-examples.html
answered Dec 6 at 2:12
Daisy Zhou
575114
I see the GPO applied to the computer using gprsult, but the GPO simply does not seem to do any effect. I also tried to create a local policy with the local group policy editor and the option does not exist. My last test was to try to manually modify the permissions of users in C: and I got an error due to some files being in used, like hiberfil.sys.
– YaKs
Dec 7 at 10:03
add a comment |
up vote
0
down vote
We can try to troubleshoot as below:
- If the Windows 10 is in the domain environment? If it is in the domain, we can run gpresult report in windows 10 to see if the policy is applied. If it is applied, but it can not block creation folders and files, go to step 2.
- Block other folders in the root directory to see if we can applied the group policy successfully. If we can, maybe we can not set the permission of system root directory.
- If the Windows 10 is not in the domain environment, please keep in mind that this process is only available to a domain with a server running the Group Policy Management feature... standalone systems and workgroups still need to manually assign these permissions! So we can try to set the permission manually.
Reference:
Assign File & Folder Permissions Via Group Policy
https://www.linkedin.com/pulse/assign-file-folder-permissions-via-group-policy-farid-soltani
Creating File System security GPOs
https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-A8D101D3-729F-4299-A591-4AC55A5DD12E.html
Group Policy – GPResult Examples
https://blog.thesysadmins.co.uk/group-policy-gpresult-examples.html
answered Dec 6 at 2:12
Daisy Zhou
575114
I see the GPO applied to the computer using gprsult, but the GPO simply does not seem to do any effect. I also tried to create a local policy with the local group policy editor and the option does not exist. My last test was to try to manually modify the permissions of users in C: and I got an error due to some files being in used, like hiberfil.sys.
– YaKs
Dec 7 at 10:03
add a comment |
up vote
0
down vote
up vote
0
down vote
We can try to troubleshoot as below:
- If the Windows 10 is in the domain environment? If it is in the domain, we can run gpresult report in windows 10 to see if the policy is applied. If it is applied, but it can not block creation folders and files, go to step 2.
- Block other folders in the root directory to see if we can applied the group policy successfully. If we can, maybe we can not set the permission of system root directory.
- If the Windows 10 is not in the domain environment, please keep in mind that this process is only available to a domain with a server running the Group Policy Management feature... standalone systems and workgroups still need to manually assign these permissions! So we can try to set the permission manually.
Reference:
Assign File & Folder Permissions Via Group Policy
https://www.linkedin.com/pulse/assign-file-folder-permissions-via-group-policy-farid-soltani
Creating File System security GPOs
https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-A8D101D3-729F-4299-A591-4AC55A5DD12E.html
Group Policy – GPResult Examples
https://blog.thesysadmins.co.uk/group-policy-gpresult-examples.html
answered Dec 6 at 2:12
Daisy Zhou
575114
We can try to troubleshoot as below:
- If the Windows 10 is in the domain environment? If it is in the domain, we can run gpresult report in windows 10 to see if the policy is applied. If it is applied, but it can not block creation folders and files, go to step 2.
- Block other folders in the root directory to see if we can applied the group policy successfully. If we can, maybe we can not set the permission of system root directory.
- If the Windows 10 is not in the domain environment, please keep in mind that this process is only available to a domain with a server running the Group Policy Management feature... standalone systems and workgroups still need to manually assign these permissions! So we can try to set the permission manually.
Reference:
Assign File & Folder Permissions Via Group Policy
https://www.linkedin.com/pulse/assign-file-folder-permissions-via-group-policy-farid-soltani
Creating File System security GPOs
https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-A8D101D3-729F-4299-A591-4AC55A5DD12E.html
Group Policy – GPResult Examples
https://blog.thesysadmins.co.uk/group-policy-gpresult-examples.html
answered Dec 6 at 2:12
Daisy Zhou
575114
answered Dec 6 at 2:12
Daisy Zhou
575114
answered Dec 6 at 2:12
Daisy Zhou
575114
answered Dec 6 at 2:12
Daisy Zhou
575114
575114
I see the GPO applied to the computer using gprsult, but the GPO simply does not seem to do any effect. I also tried to create a local policy with the local group policy editor and the option does not exist. My last test was to try to manually modify the permissions of users in C: and I got an error due to some files being in used, like hiberfil.sys.
– YaKs
Dec 7 at 10:03
add a comment |
I see the GPO applied to the computer using gprsult, but the GPO simply does not seem to do any effect. I also tried to create a local policy with the local group policy editor and the option does not exist. My last test was to try to manually modify the permissions of users in C: and I got an error due to some files being in used, like hiberfil.sys.
– YaKs
Dec 7 at 10:03
I see the GPO applied to the computer using gprsult, but the GPO simply does not seem to do any effect. I also tried to create a local policy with the local group policy editor and the option does not exist. My last test was to try to manually modify the permissions of users in C: and I got an error due to some files being in used, like hiberfil.sys.
– YaKs
Dec 7 at 10:03
I see the GPO applied to the computer using gprsult, but the GPO simply does not seem to do any effect. I also tried to create a local policy with the local group policy editor and the option does not exist. My last test was to try to manually modify the permissions of users in C: and I got an error due to some files being in used, like hiberfil.sys.
– YaKs
Dec 7 at 10:03
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1381058%2fgpo-how-to-block-creation-of-folder-and-files-in-root-directory-in-windows-1%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
This is a comment because it does not answer your question: You do not need to use GPO to block creations of folders. All you need to do is change the security settings. Keep in mind that an administrator can ALWAYS undo your changes or get around it. Also, if you want to deny rights on the root, be aware that this will propagate down all folders, so you then have to change the permissions on each sub folder and disable inheritance.
– LPChip
Dec 5 at 16:57
I forgot to mention that I am in a corporate environment and this GPO will be applied to 10,000 workstations. I need to use a GPO. And the rights should not be propagated as I specifically mentioned "This folder only".
– YaKs
Dec 7 at 9:40