18
14
I need to hide the D:
drive for specified users on Windows 7. How can I do that?
18
14
I need to hide the D:
drive for specified users on Windows 7. How can I do that?
30
There is a group policy setting to disable access to certain drives, and another to hide access. You need Windows 7 Professional, Ultimate or Enterprise to do this. For other versions, scroll down to my alternate solution.
If you only want to apply the policy to certain users, not every user, you need to configure it individually. You cannot do this by just opening gpedit.msc
; you need to add the group policy editor from the MMC:
mmc.exe
with administrative privilegesFile
> Add or Remove Snapin
Add >
Browse
, click the Users
tab, and select a user or user group. Individual users are shown, as well as two generic groups; "Administrators" and "Non-Administrators".OK
, then click Finish
in the wizard.OK
in the "Add Snapin" dialog.User Configuration > Administrative Templates > Windows Components > Windows Explorer
. Hide these specified drives in My Computer
if you want to just hide the drives but still allow direct access (e.g. from run prompt, etc.) to the drives. Find Prevent access to drives from My Computer
to hide the drive and prevent access to it.Enabled
radio button and choose the drive(s) you want to restrict. As of Windows 7, the only options are:
A and B drives only
C drive only
D drive only
A, B and C drives only
A, B, C and D drives only
Restrict all drives
Do not restrict drives
The next time the user(s) log in, they will not be able to see/access the drive This should work as you specifically asked for disabling the D: drive.
If you want to disable a drive other than A, B, C, or D, or if you have a version of Windows 7 which doesn't support the group policy editor, you will need to make the changes manually in the registry.
The first step is to load the registry hive of the user you are removing the drives from. The user must be logged out for this to work; in fact, it's better to do a fresh restart before doing this process.
HKEY_USERS
Load Hive
from the File
menuC:\users\username
NTUSER.DAT
in the File name
box. This file is a system-hidden file, so it won't show up in the file selection window. You have to type it in. Be sure not to select ntuser.dat.log
by accident.Foo
.HKEY_USERS\Foo\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoDrives
to hide the drives, or NoViewOnDrive
to completely disable access.1
(disabled) or 0
(enabled). Make this binary number, then convert it to hexidecimal. This is the number you put in the box. For example, D is the fourth drive letter from the right, and everything to the left of it is a 0, so the number will be b1000
, which is x08000000
, so you would enter 08000000
as the value. To disable C and D, you would use b1100
, or x0c000000
. If this confused you, post in the comments for help.HKEY_USERS
, select the key you loaded, and then click File
> Unload Hive
. This step is ABSOLUTELY CRITICAL!! If you don't unload the hive, the user will be unable to login properly.@nhinkle, In your step 3, there is no "Group Policy Object Editor" to select.... See http://i.stack.imgur.com/x1ySa.png
– Pacerier – 2014-11-16T00:13:17.7001@Pacerier are you running a Pro, Business, Ultimate, or Enterprise version of Windows? – nhinkle – 2014-11-16T03:15:11.033
@nhinkle, Nope, Windows XP Home Edition SP3. – Pacerier – 2014-11-16T03:45:31.147
@Pacerier "You need Windows 7 Professional, Ultimate or Enterprise to do this. For other versions, scroll down to my alternate solution." – nhinkle – 2014-11-16T13:44:50.180
Sorry to bump an old answer, but how would you hide drive X and Y in this scenario? Regedit only allows a certain amount of characters before it hits a limit. – Dooley_labs – 2018-03-11T03:24:57.367
People have difficulty understanding (the second) step 9. In fact, I believe that it's wrong. I have written an alternative (better) version here.
– Scott – 2018-11-25T04:12:48.1332Ok. Followed this instruction but it hid and disabled access for drive D for ALL USERS, including me. I need to hide and disable access only for specified users. Is there a way to do it? – J.Olufsen – 2011-02-19T14:28:53.437
Are you sure you did the registry key or group policy snapin for the right user? If you follow the instructions exactly as above, it should only do it for the users you specify, not all of them. – nhinkle – 2011-02-19T22:13:42.343
I would be very careful with a change like this. It seems simple on the surface, follow the directions to accomplish your goal. However, I see the potential for some really painful troubleshooting of potential issues that could arise. If you do this, you need to be extremely careful that there is never a need that these users will ever need user level access to the hidden/disabled drives. – Keltari – 2013-04-28T05:18:39.620
3
Right-click on said drive in Computer, choose Properties → Security. Update access as needed: remove "Users", add "Parents", etc.
If your version of Windows doesn't have a Security tab, use icacls
from command line:
icacls F:\ /grant Parents:(oi)(ci)F
icacls F:\ /remove Users
Tried this method by removing the Users group. It enumerators through all files on the HDD to add the security policy. In the end my Administrator account still had the "Access denied message" when it finished even though Administrators group still had Full Access. – ShawnFeatherly – 2016-05-15T09:30:36.020
I still had access to edit the security policy. It worked great after adding my individual account. – ShawnFeatherly – 2016-05-15T09:38:11.697
2
You can hide any drives using Group Policy. This will set restrictions for any users on the machine.
Hope this helps! :)
Does not work for me: E: is not in the list: https://i.stack.imgur.com/8hg4X.jpg
– Basj – 2018-08-31T14:22:24.1771
Taken from this link (a bit too lazy to type it out myself):
My hard drive devided into 2 logical discs: C and D. If I create new user -> it can access drive D. What do I need to do in order to deny and hide my disc D for specified user? – J.Olufsen – 2011-01-26T22:04:33.773
Without drive letters or mount points, a drive is still accessible as its volume name. Even though most programs do not support \\?\Volume{guid}
syntax, all it takes is a DefineDosDevice(1, "x:", "\\??\\Volume{guid}")
to assign a session-local drive letter to it. (Btw, these are two different prefixes. Not a typo.) – user1686 – 2011-01-26T22:26:07.203
1
You're looking for a type of Access Based Enumeration.
Enabling a user to only see drives / folders that they have the permissions for is supported in domains but not in stand alone installations as far as I'm aware.
You used to be able to do this in Windows XP by using Windows SteadyState but this tool has been discontinued.
.. disables access to what? – Blorgbeard is out – 2011-01-26T20:48:28.987
...disabled access to drive D and after reboot it suppose to hide drive D for all users. But I need to hide and disable access only for specified users – J.Olufsen – 2011-01-26T21:32:19.633
Why is disabling access to the drive not good enough? What is the reason for needing to hide it? – Keltari – 2013-04-28T05:13:13.093
Why is disabling access to the drive not good enough? What is the reason for needing to hide it? Necro comment, but I am curious. – Keltari – 2013-04-28T05:31:33.467