none
Removing User/Computer Rights to share a folder

    Question

  • Hi, 

    i want to prevent a group of users in AD - their ability to share  files / folders that are local to their desktops. 

    coming across a few forums i get the GPO - Local Computer PolicyUser ConfigurationAdministrative TemplatesWindows Components, and Network Sharing. and to enable the setting.

    This however doesnt seem to be working and as i tested - i still have the ability to go to folder properties and Share the folder from Advanced Sharing. A possible reason could be that i also have admin rights to the desktop. 

    Is there a GPO -policy setting that will disable Folder sharing for both standard users and admins alike ? 

    Thursday, March 31, 2016 7:34 PM

Answers

All replies

  • Hi,

    If you enable prevent users from sharing files within their profile on local group policy, you will affect the settings on only that one computer. If you configure the settings in a Group Policy object (GPO) hosted in an Active Directory domain, then the settings apply to all computers that are subject to that GPO.

    In additional, I have tested for both local group policy and domain group policy. If you configure local group policy, only those users who log onto the computer cannot share files. But those users that have administrative right can share files.

    In my opinion, there may be no setting to disable administrative user to share files, because administrative users have full control right on domain.

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, April 01, 2016 5:51 AM
    Moderator
  • Thanks Jay, 

    i was first testing the policy locally , if it worked i was planning to apply it to the group of users through GPO.

    i just wanted to know if theres any other setting apart from this that might take precedence over administrative rights so that even admins are blocked for sharing folders - as the users in that group are admins over the computers.

    Friday, April 01, 2016 12:50 PM
  • Hi,

    I am afraid there is no way to achieve your goal.

    But you could disable share Tab by delete registry key HKEY_CLASSES_ROOT\CLSID\{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}.

    For more information, you could refer to the similar thread below.

    https://social.technet.microsoft.com/Forums/windows/en-US/9a87b20f-15a4-4eff-b678-f228166f6d0a/how-to-disable-advanced-file-sharing-in-windows-7?forum=w7itprosecurity

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, April 06, 2016 6:54 AM
    Moderator
  • https://support.microsoft.com/en-us/kb/303153

    Kind regards,

    Tim
    MCITP, MCTS, MCSA
    http://directoryadmin.blogspot.com

    This posting is provided 'AS IS' with no warranties or guarantees and confers no rights.

    "If this thread answered your question, please click on "Mark as Answer"

    Saturday, April 09, 2016 6:11 AM