none
how to block folder sharing for all user in domain by using Group Policy

    Question

  • Hi Experts,

    i want to block folder sharing or sharing option from user machine for all domain users by using group policy.

    pls help me out.

    Rgds,

    Balwan Singh

     

    Saturday, December 04, 2010 9:15 AM

Answers

  • Hi,

     Since sharing most folders requires administrator privileges, you can prevent most sharing by configuring your users to run with standard user accounts. Standard users can only share folders within their profile and that can be prevents using the setting: 

    User Configuration, Administrative Templates, Windows Components, Network Sharing, Prevent users from sharing files within their profile.

     

    This setting requires Vista or later on the client.

     

    Thanks,

    Guy

     

    p.s. this will not disable all sharing just a user's ability to share folders. This will leave administrative shares enabled which is a good idea in general. To eliminate sharing completely, you can remove the component from the network card components or disable the 'Server' service.

    • Marked as answer by Bruce-Liu Tuesday, December 28, 2010 8:12 AM
    Saturday, December 04, 2010 10:40 PM
  • Hi Balwan,

    try this

    http://technet.microsoft.com/en-us/library/cc754359(WS.10).aspx 

     

    You can use this procedure to enable or disable a user's ability to share files within his or her profile.

    A member of the Administrators or Network Configuration Operators group can enable or disable network sharing. This Group Policy setting affects only the users or groups to which it is applied, and prevents that user or group from sharing their folders even if folder sharing is enabled at the computer level.

    By default, this setting is not configured. If you enable this setting, users will not be able to share files within their profile.

    Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.
    To enable or disable file sharing for a user or group by using Group Policy

       1.

          Start Group Policy Management Console (GPMC). To do so, click Start, and then in the Start Search box, type gpmc.msc.
       2.

          In the navigation pane, open the following folders: Local Computer Policy, User Configuration, Administrative Templates, Windows Components, and Network Sharing.
       3.

          In the details pane, double-click Prevent users from sharing files within their profile.
       4.

          Do one of the following:
              * To enable the Group Policy setting, and disable the user's ability to share files, click Enabled.
              * To disable the Group Policy setting, and enable the user's ability to share files, click Disabled.
       5.

          Click OK to save your changes.

    Additional considerations

        * If you edit policy settings locally on a computer, you will affect the settings on only that one computer. If you configure the settings in a Group Policy object (GPO) hosted in an Active Directory domain, then the settings apply to all computers that are subject to that GPO. For more information about Group Policy in an Active Directory domain, see Group Policy (http://go.microsoft.com/fwlink/?LinkId=55625).


    also you can check this link it's talking about Enable or Disable Sharing and Discovery
    http://technet.microsoft.com/en-us/library/cc753176.aspx


    MCSE | MCITP - Server 2008 | MCITP - Exchange 2007 | MCTS - Exchange 2010
    • Marked as answer by Bruce-Liu Tuesday, December 28, 2010 8:12 AM
    Monday, December 06, 2010 9:46 AM
  • Hi Balwan,

     

    To disable Sharing, as the above suggestions, you can use the policy "Prevent users from sharing files within their profile".

     

    To disable Security, you can consider using this policy:

     

    [User Configuration\Administrative Templates\Windows Components\Windows Explorer: Remove Security Tab]

     

    If you enable this setting, users opening the Properties dialog box for all file system objects, including folders, files, shortcuts, and drives, will not be able to access the Security tab. As a result, users will be able to neither change the security settings nor view a list of all users that have access to the resource in question.

     

    Hope it helps.

     

    Regards,

    Bruce


    This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Bruce-Liu Tuesday, December 28, 2010 8:12 AM
    Monday, December 06, 2010 10:18 AM
  • Hi Balwan,

     

    The Network Sharing policy applies for Windows Server 2008, Windows Server 2008 R2 and Windows 7.

     

    In Windows XP and Windows Server 2003, there is no native group policy to disable Sharing. You can try to use a script to delete the following key to remove the Sharing tab:

     

    [HKEY_CLASSES_ROOT\CLSID\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6}]

     

    Hope it helps.

     

    Regards,

    Bruce


    This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Bruce-Liu Tuesday, December 28, 2010 8:12 AM
    Tuesday, December 21, 2010 7:20 AM

All replies

  • Hi,

     Since sharing most folders requires administrator privileges, you can prevent most sharing by configuring your users to run with standard user accounts. Standard users can only share folders within their profile and that can be prevents using the setting: 

    User Configuration, Administrative Templates, Windows Components, Network Sharing, Prevent users from sharing files within their profile.

     

    This setting requires Vista or later on the client.

     

    Thanks,

    Guy

     

    p.s. this will not disable all sharing just a user's ability to share folders. This will leave administrative shares enabled which is a good idea in general. To eliminate sharing completely, you can remove the component from the network card components or disable the 'Server' service.

    • Marked as answer by Bruce-Liu Tuesday, December 28, 2010 8:12 AM
    Saturday, December 04, 2010 10:40 PM
  • Hin Guy,

    i want to disable Security/Sharing for all users by using using Group Policy on My Domain Controller.

    Rgds,

    Balwan Singh


    Balwan Singh
    Monday, December 06, 2010 6:28 AM
  • Hi Balwan,

    try this

    http://technet.microsoft.com/en-us/library/cc754359(WS.10).aspx 

     

    You can use this procedure to enable or disable a user's ability to share files within his or her profile.

    A member of the Administrators or Network Configuration Operators group can enable or disable network sharing. This Group Policy setting affects only the users or groups to which it is applied, and prevents that user or group from sharing their folders even if folder sharing is enabled at the computer level.

    By default, this setting is not configured. If you enable this setting, users will not be able to share files within their profile.

    Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.
    To enable or disable file sharing for a user or group by using Group Policy

       1.

          Start Group Policy Management Console (GPMC). To do so, click Start, and then in the Start Search box, type gpmc.msc.
       2.

          In the navigation pane, open the following folders: Local Computer Policy, User Configuration, Administrative Templates, Windows Components, and Network Sharing.
       3.

          In the details pane, double-click Prevent users from sharing files within their profile.
       4.

          Do one of the following:
              * To enable the Group Policy setting, and disable the user's ability to share files, click Enabled.
              * To disable the Group Policy setting, and enable the user's ability to share files, click Disabled.
       5.

          Click OK to save your changes.

    Additional considerations

        * If you edit policy settings locally on a computer, you will affect the settings on only that one computer. If you configure the settings in a Group Policy object (GPO) hosted in an Active Directory domain, then the settings apply to all computers that are subject to that GPO. For more information about Group Policy in an Active Directory domain, see Group Policy (http://go.microsoft.com/fwlink/?LinkId=55625).


    also you can check this link it's talking about Enable or Disable Sharing and Discovery
    http://technet.microsoft.com/en-us/library/cc753176.aspx


    MCSE | MCITP - Server 2008 | MCITP - Exchange 2007 | MCTS - Exchange 2010
    • Marked as answer by Bruce-Liu Tuesday, December 28, 2010 8:12 AM
    Monday, December 06, 2010 9:46 AM
  • Hi Balwan,

     

    To disable Sharing, as the above suggestions, you can use the policy "Prevent users from sharing files within their profile".

     

    To disable Security, you can consider using this policy:

     

    [User Configuration\Administrative Templates\Windows Components\Windows Explorer: Remove Security Tab]

     

    If you enable this setting, users opening the Properties dialog box for all file system objects, including folders, files, shortcuts, and drives, will not be able to access the Security tab. As a result, users will be able to neither change the security settings nor view a list of all users that have access to the resource in question.

     

    Hope it helps.

     

    Regards,

    Bruce


    This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Bruce-Liu Tuesday, December 28, 2010 8:12 AM
    Monday, December 06, 2010 10:18 AM
  • Thx for Reply,.

    i have more 500 users , and can not do this for all machine. it will very lenghty process to block Sharing TAB. and i m running out of time.

    Is there any way out,  i want to apply a policy for the same by using my domain controller.

     

    Rgds,

    balwan SIngh'


    Balwan Singh
    Tuesday, December 07, 2010 1:09 PM
  • Hi Balwan,

     The setting described above to prevent users from sharing files within their profile can be configured in an AD based GPO and deployed using your domain controller.

     

    Thanks,

    Guy

    Tuesday, December 07, 2010 4:27 PM
  • Hi experts,

    I GPO.

    User Configuration, Administrative Templates, Windows Components, Network Sharing option is not showing , how i can Prevent users from sharing files within their profile.

    Rgds,

    Balwan Singh


    Balwan Singh
    Thursday, December 16, 2010 9:41 AM
  • Hi Balwan,

     

    The Network Sharing policy applies for Windows Server 2008, Windows Server 2008 R2 and Windows 7.

     

    In Windows XP and Windows Server 2003, there is no native group policy to disable Sharing. You can try to use a script to delete the following key to remove the Sharing tab:

     

    [HKEY_CLASSES_ROOT\CLSID\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6}]

     

    Hope it helps.

     

    Regards,

    Bruce


    This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Bruce-Liu Tuesday, December 28, 2010 8:12 AM
    Tuesday, December 21, 2010 7:20 AM