XenApp 6.5 Hide Local Drives

There are several methods to hide local hard drives in XenApp or Terminal Services for your end users, but I feel only one is superior, group policy loopback processing combined with the new Group Policy preferences item-level targeting available in Server 2008. Instead of modifying all of your users individual GPO's or configuring registry hacks or writing a bunch of bandaid scripts, you need only modify one GPO which is applied to your Citrix servers. Therefore this cuts down on administration and increases simplicity (KISS). Since I haven't seen many articles explaining this method, here is my first post of March 2013.

Essentially what Group Policy loopback processing does is allow you to completely override or merge user or computer level policies on computers where it is enabled. For clarity I should point out now that this will not prevent users from reading/writing to the drive, as this is a procedure to HIDE the drive letter from the explorer.exe shell. This will help eliminate end user confusion as many people mistake C:\ in an ICA/RDP session to be their local C:\ on their desktop or laptop. In this post, I will hide the drive C:\ for all XenApp users who are not members of Domain Admins.

Create a GPO and link it to the OU where your XenApp/TS server is located. Edit and navigate to Computer Configuration > Policies > Administrative Templates > System > Group Policy and enable 'User Group Policy loopback processing mode' with the mode set to Merge. Setting it to merge instead of replace will ensure that all of your existing user policies will remain applied.

In the same GPO, navigate to User Configuration > Preferences > Windows Settings > Drive Maps. Right click in the white area New > Mapped Drive. Select the drive you wish to hide and set Hide this drive.

Go to the Common tab and select Item-level targeting. New Item > Security Group. Item Options > Is Not. Select your Domain Admins group or a group you wish this policy to not apply, such as your technical support team.

If you have any questions, leave a comment below and be sure to share this on your favorite social media platform to help support my ad-free website.

Thank you,
-TR

Share
Disqus Comments Loading...

Recent Posts

VMWare vSphere 6.7 ESXTOP Output Garbled

If your VMWare vSphere 6.x environment command output of esxtop looks like a bunch of garbled gibberish (it's actually CSV… Read More

February 28, 2019 7:39 pm 19:39

How To Run RoboCopy Backup in Parallel

From time to time Windows Admins will surprise you with band-aid and bubble gum scripts, that's entirely expected I think.… Read More

February 28, 2019 12:20 pm 12:20

Windows 10 GodMode - The Ultimate Administrator Shortcut

Have you ever wondered what life might be like if the Windows 10 OS somehow had a single folder that… Read More

February 28, 2019 7:58 am 07:58

Samsung Galaxy S9 G960/G965 Stock ROM Firmware Download

There could be any number of reasons for needing to flash manufacturer stock OEM firmware on a Samsung Galaxy S9… Read More

January 24, 2019 7:42 am 07:42

Output IP Address with ipconfig Findstr Ethernet Adapter

How many times have you entered  ipconfig /all at the command line to return a single IP address, then have to strain… Read More

January 20, 2019 12:39 am 00:39

AWS SES Assistance in Enterprise Market - A Must Read

Designing e-mail solutions on a large scale can be a complex and costly challenge for a business: you need to… Read More

December 25, 2018 4:01 pm 16:01