**GPO - How to block creation of folder and files in root directory in Windows 10











up vote
0
down vote

favorite












I would like to use a GPO setting to block users to create folders and files in the root directory in Windows 10.
Searching on internet I found the setting




Computer configuration -> Policies -> Windows settings-> Security
Settings-> File System




where I created an entry for %SystemDrive% where Authenticated users have "Deny" to "Create Files/Write data" and "Create folders/append data", applied to "This folder only".



After saving and linking the GPO, I rebooted the workstation to get the new policies but the settings does not block anything.



Any idea what could be wrong? any other suggestion to achieve the same result?



thanks a lot.






windows-10 filesystems group-policy







share|improve this question






















  • This is a comment because it does not answer your question: You do not need to use GPO to block creations of folders. All you need to do is change the security settings. Keep in mind that an administrator can ALWAYS undo your changes or get around it. Also, if you want to deny rights on the root, be aware that this will propagate down all folders, so you then have to change the permissions on each sub folder and disable inheritance.
    – LPChip
    Dec 5 at 16:57










  • I forgot to mention that I am in a corporate environment and this GPO will be applied to 10,000 workstations. I need to use a GPO. And the rights should not be propagated as I specifically mentioned "This folder only".
    – YaKs
    Dec 7 at 9:40















up vote
0
down vote

favorite












I would like to use a GPO setting to block users to create folders and files in the root directory in Windows 10.
Searching on internet I found the setting




Computer configuration -> Policies -> Windows settings-> Security
Settings-> File System




where I created an entry for %SystemDrive% where Authenticated users have "Deny" to "Create Files/Write data" and "Create folders/append data", applied to "This folder only".



After saving and linking the GPO, I rebooted the workstation to get the new policies but the settings does not block anything.



Any idea what could be wrong? any other suggestion to achieve the same result?



thanks a lot.






windows-10 filesystems group-policy







share|improve this question






















  • This is a comment because it does not answer your question: You do not need to use GPO to block creations of folders. All you need to do is change the security settings. Keep in mind that an administrator can ALWAYS undo your changes or get around it. Also, if you want to deny rights on the root, be aware that this will propagate down all folders, so you then have to change the permissions on each sub folder and disable inheritance.
    – LPChip
    Dec 5 at 16:57










  • I forgot to mention that I am in a corporate environment and this GPO will be applied to 10,000 workstations. I need to use a GPO. And the rights should not be propagated as I specifically mentioned "This folder only".
    – YaKs
    Dec 7 at 9:40













up vote
0
down vote

favorite









up vote
0
down vote

favorite











I would like to use a GPO setting to block users to create folders and files in the root directory in Windows 10.
Searching on internet I found the setting




Computer configuration -> Policies -> Windows settings-> Security
Settings-> File System




where I created an entry for %SystemDrive% where Authenticated users have "Deny" to "Create Files/Write data" and "Create folders/append data", applied to "This folder only".



After saving and linking the GPO, I rebooted the workstation to get the new policies but the settings does not block anything.



Any idea what could be wrong? any other suggestion to achieve the same result?



thanks a lot.






windows-10 filesystems group-policy







share|improve this question













I would like to use a GPO setting to block users to create folders and files in the root directory in Windows 10.
Searching on internet I found the setting




Computer configuration -> Policies -> Windows settings-> Security
Settings-> File System




where I created an entry for %SystemDrive% where Authenticated users have "Deny" to "Create Files/Write data" and "Create folders/append data", applied to "This folder only".



After saving and linking the GPO, I rebooted the workstation to get the new policies but the settings does not block anything.



Any idea what could be wrong? any other suggestion to achieve the same result?



thanks a lot.






windows-10 filesystems group-policy




windows-10 filesystems group-policy






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked Dec 5 at 16:28









YaKs

11




11












  • This is a comment because it does not answer your question: You do not need to use GPO to block creations of folders. All you need to do is change the security settings. Keep in mind that an administrator can ALWAYS undo your changes or get around it. Also, if you want to deny rights on the root, be aware that this will propagate down all folders, so you then have to change the permissions on each sub folder and disable inheritance.
    – LPChip
    Dec 5 at 16:57










  • I forgot to mention that I am in a corporate environment and this GPO will be applied to 10,000 workstations. I need to use a GPO. And the rights should not be propagated as I specifically mentioned "This folder only".
    – YaKs
    Dec 7 at 9:40


















  • This is a comment because it does not answer your question: You do not need to use GPO to block creations of folders. All you need to do is change the security settings. Keep in mind that an administrator can ALWAYS undo your changes or get around it. Also, if you want to deny rights on the root, be aware that this will propagate down all folders, so you then have to change the permissions on each sub folder and disable inheritance.
    – LPChip
    Dec 5 at 16:57










  • I forgot to mention that I am in a corporate environment and this GPO will be applied to 10,000 workstations. I need to use a GPO. And the rights should not be propagated as I specifically mentioned "This folder only".
    – YaKs
    Dec 7 at 9:40
















This is a comment because it does not answer your question: You do not need to use GPO to block creations of folders. All you need to do is change the security settings. Keep in mind that an administrator can ALWAYS undo your changes or get around it. Also, if you want to deny rights on the root, be aware that this will propagate down all folders, so you then have to change the permissions on each sub folder and disable inheritance.
– LPChip
Dec 5 at 16:57




This is a comment because it does not answer your question: You do not need to use GPO to block creations of folders. All you need to do is change the security settings. Keep in mind that an administrator can ALWAYS undo your changes or get around it. Also, if you want to deny rights on the root, be aware that this will propagate down all folders, so you then have to change the permissions on each sub folder and disable inheritance.
– LPChip
Dec 5 at 16:57












I forgot to mention that I am in a corporate environment and this GPO will be applied to 10,000 workstations. I need to use a GPO. And the rights should not be propagated as I specifically mentioned "This folder only".
– YaKs
Dec 7 at 9:40




I forgot to mention that I am in a corporate environment and this GPO will be applied to 10,000 workstations. I need to use a GPO. And the rights should not be propagated as I specifically mentioned "This folder only".
– YaKs
Dec 7 at 9:40










1 Answer
1






active

oldest

votes

















up vote
0
down vote













We can try to troubleshoot as below:




  1. If the Windows 10 is in the domain environment? If it is in the domain, we can run gpresult report in windows 10 to see if the policy is applied. If it is applied, but it can not block creation folders and files, go to step 2.

  2. Block other folders in the root directory to see if we can applied the group policy successfully. If we can, maybe we can not set the permission of system root directory.

  3. If the Windows 10 is not in the domain environment, please keep in mind that this process is only available to a domain with a server running the Group Policy Management feature... standalone systems and workgroups still need to manually assign these permissions! So we can try to set the permission manually.


Reference:



Assign File & Folder Permissions Via Group Policy



https://www.linkedin.com/pulse/assign-file-folder-permissions-via-group-policy-farid-soltani



Creating File System security GPOs



https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-A8D101D3-729F-4299-A591-4AC55A5DD12E.html



Group Policy – GPResult Examples



https://blog.thesysadmins.co.uk/group-policy-gpresult-examples.html






share|improve this answer





















  • I see the GPO applied to the computer using gprsult, but the GPO simply does not seem to do any effect. I also tried to create a local policy with the local group policy editor and the option does not exist. My last test was to try to manually modify the permissions of users in C: and I got an error due to some files being in used, like hiberfil.sys.
    – YaKs
    Dec 7 at 10:03













Your Answer








StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1381058%2fgpo-how-to-block-creation-of-folder-and-files-in-root-directory-in-windows-1%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























1 Answer
1






active

oldest

votes








1 Answer
1






active

oldest

votes









active

oldest

votes






active

oldest

votes








up vote
0
down vote













We can try to troubleshoot as below:




  1. If the Windows 10 is in the domain environment? If it is in the domain, we can run gpresult report in windows 10 to see if the policy is applied. If it is applied, but it can not block creation folders and files, go to step 2.

  2. Block other folders in the root directory to see if we can applied the group policy successfully. If we can, maybe we can not set the permission of system root directory.

  3. If the Windows 10 is not in the domain environment, please keep in mind that this process is only available to a domain with a server running the Group Policy Management feature... standalone systems and workgroups still need to manually assign these permissions! So we can try to set the permission manually.


Reference:



Assign File & Folder Permissions Via Group Policy



https://www.linkedin.com/pulse/assign-file-folder-permissions-via-group-policy-farid-soltani



Creating File System security GPOs



https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-A8D101D3-729F-4299-A591-4AC55A5DD12E.html



Group Policy – GPResult Examples



https://blog.thesysadmins.co.uk/group-policy-gpresult-examples.html






share|improve this answer





















  • I see the GPO applied to the computer using gprsult, but the GPO simply does not seem to do any effect. I also tried to create a local policy with the local group policy editor and the option does not exist. My last test was to try to manually modify the permissions of users in C: and I got an error due to some files being in used, like hiberfil.sys.
    – YaKs
    Dec 7 at 10:03

















up vote
0
down vote













We can try to troubleshoot as below:




  1. If the Windows 10 is in the domain environment? If it is in the domain, we can run gpresult report in windows 10 to see if the policy is applied. If it is applied, but it can not block creation folders and files, go to step 2.

  2. Block other folders in the root directory to see if we can applied the group policy successfully. If we can, maybe we can not set the permission of system root directory.

  3. If the Windows 10 is not in the domain environment, please keep in mind that this process is only available to a domain with a server running the Group Policy Management feature... standalone systems and workgroups still need to manually assign these permissions! So we can try to set the permission manually.


Reference:



Assign File & Folder Permissions Via Group Policy



https://www.linkedin.com/pulse/assign-file-folder-permissions-via-group-policy-farid-soltani



Creating File System security GPOs



https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-A8D101D3-729F-4299-A591-4AC55A5DD12E.html



Group Policy – GPResult Examples



https://blog.thesysadmins.co.uk/group-policy-gpresult-examples.html






share|improve this answer





















  • I see the GPO applied to the computer using gprsult, but the GPO simply does not seem to do any effect. I also tried to create a local policy with the local group policy editor and the option does not exist. My last test was to try to manually modify the permissions of users in C: and I got an error due to some files being in used, like hiberfil.sys.
    – YaKs
    Dec 7 at 10:03















up vote
0
down vote










up vote
0
down vote









We can try to troubleshoot as below:




  1. If the Windows 10 is in the domain environment? If it is in the domain, we can run gpresult report in windows 10 to see if the policy is applied. If it is applied, but it can not block creation folders and files, go to step 2.

  2. Block other folders in the root directory to see if we can applied the group policy successfully. If we can, maybe we can not set the permission of system root directory.

  3. If the Windows 10 is not in the domain environment, please keep in mind that this process is only available to a domain with a server running the Group Policy Management feature... standalone systems and workgroups still need to manually assign these permissions! So we can try to set the permission manually.


Reference:



Assign File & Folder Permissions Via Group Policy



https://www.linkedin.com/pulse/assign-file-folder-permissions-via-group-policy-farid-soltani



Creating File System security GPOs



https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-A8D101D3-729F-4299-A591-4AC55A5DD12E.html



Group Policy – GPResult Examples



https://blog.thesysadmins.co.uk/group-policy-gpresult-examples.html






share|improve this answer












We can try to troubleshoot as below:




  1. If the Windows 10 is in the domain environment? If it is in the domain, we can run gpresult report in windows 10 to see if the policy is applied. If it is applied, but it can not block creation folders and files, go to step 2.

  2. Block other folders in the root directory to see if we can applied the group policy successfully. If we can, maybe we can not set the permission of system root directory.

  3. If the Windows 10 is not in the domain environment, please keep in mind that this process is only available to a domain with a server running the Group Policy Management feature... standalone systems and workgroups still need to manually assign these permissions! So we can try to set the permission manually.


Reference:



Assign File & Folder Permissions Via Group Policy



https://www.linkedin.com/pulse/assign-file-folder-permissions-via-group-policy-farid-soltani



Creating File System security GPOs



https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-A8D101D3-729F-4299-A591-4AC55A5DD12E.html



Group Policy – GPResult Examples



https://blog.thesysadmins.co.uk/group-policy-gpresult-examples.html







share|improve this answer












share|improve this answer



share|improve this answer










answered Dec 6 at 2:12









Daisy Zhou

575114




575114












  • I see the GPO applied to the computer using gprsult, but the GPO simply does not seem to do any effect. I also tried to create a local policy with the local group policy editor and the option does not exist. My last test was to try to manually modify the permissions of users in C: and I got an error due to some files being in used, like hiberfil.sys.
    – YaKs
    Dec 7 at 10:03




















  • I see the GPO applied to the computer using gprsult, but the GPO simply does not seem to do any effect. I also tried to create a local policy with the local group policy editor and the option does not exist. My last test was to try to manually modify the permissions of users in C: and I got an error due to some files being in used, like hiberfil.sys.
    – YaKs
    Dec 7 at 10:03


















I see the GPO applied to the computer using gprsult, but the GPO simply does not seem to do any effect. I also tried to create a local policy with the local group policy editor and the option does not exist. My last test was to try to manually modify the permissions of users in C: and I got an error due to some files being in used, like hiberfil.sys.
– YaKs
Dec 7 at 10:03






I see the GPO applied to the computer using gprsult, but the GPO simply does not seem to do any effect. I also tried to create a local policy with the local group policy editor and the option does not exist. My last test was to try to manually modify the permissions of users in C: and I got an error due to some files being in used, like hiberfil.sys.
– YaKs
Dec 7 at 10:03




















draft saved

draft discarded




















































Thanks for contributing an answer to Super User!


  • Please be sure to answer the question. Provide details and share your research!

But avoid …



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.





Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


Please pay close attention to the following guidance:


  • Please be sure to answer the question. Provide details and share your research!

But avoid …



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1381058%2fgpo-how-to-block-creation-of-folder-and-files-in-root-directory-in-windows-1%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







-

Popular posts from this blog

Probability when a professor distributes a quiz and homework assignment to a class of n students.

Image
0 0 $begingroup$ Need help with this problem. Suppose our lazy professor collects a quiz and a homework assignment from a class of n students one day, then distributes both the quizzes and the homework assignments back to the class in a random fashion for grading. Each student receives one quiz and one homework assignment to grade. (a) What is the probability that every student receives someone else's quiz to grade, and someone else's homework to grade? (b) What is the probability that no student receives both their own quiz and their own homework assignment to grade? In this case, some students may receive their own quiz, and others may receive their own homework assignment. (c) Compute the limiting probability as n approaches infinity in each case. ...
Read more

Aardman Animations

Image
Aardman Animations, Ltd. Aardman Animations Tipo privada Atividade Animação em stop-motion , Animação em CGI Fundação 1972 Fundador(es) Peter Lord David Sproxton Sede Bristol, Inglaterra  Reino Unido Proprietário(s) Dreamworks Pessoas-chave Peter Lord David Sproxton Nick Park Divisões Aardman Features Aardman Digital Aardman Commercials Aardman Broadcast Aardman International Aardman Rights Aardman Effects Aardman 3-D Systems Aardman Nathan Love AardBoiled Website oficial aardman.com ...
Read more

Are they similar matrix

Image
0 $begingroup$ Do $begin{bmatrix} 0&i&0\0&0&1\0&0&0 end{bmatrix} $ and $begin{bmatrix} 0&0&0\-i&0&0\0&1&0 end{bmatrix} $ are similar.Is this True/false Clearly both are nilpotent and one is conjucate transpose of other but how to know if they are similar.i'm stuck. Please help me linear-algebra vector-spaces eigenvalues-eigenvectors generalizedeigenvector share | cite | improve this question edited Dec 10 '18 at 6:38 Vasanth Kris asked Dec 10 '18 at 6:19 ...
Read more