Restrict Users to Store Data in Local Drive, Desktop, Document, Downloads Etc

What would be the proper way to restrict users from Storing Data in Local Drive, Desktop, Document, Downloads Etc.

I want to deploy this policy on Hostname basis and not for specific user because that will restrict the same user to access Storage on his other systems where he logins.

What could be the possible solution? Please suggest!

Windows Server 2019

A Microsoft server operating system that supports enterprise-level management updated to data storage.

3,695 questions Sign in to follow

A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.

5,290 questions Sign in to follow Windows Server Security

Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications. Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.

1,806 questions Sign in to follow 0 comments No comments Report a concern I have the same question I have the same question 0 votes Add comment

5 answers

Sort by: Most helpful Most helpful Newest Oldest

udara peiris 686 Reputation points 2020-10-16T23:40:52.87+00:00

Create a Group policy object and configure following setting on that to block disk C: User Configuration \ Administrative Templates \ Windows Components \ Windows Explorer. Then on the right side under Setting, double click on Prevent access to drives from My Computer. Then, Select Enable then under Options from the drop down menu you can restrict a certain disk. 32960-2drive.png
33035-drive.pngThen you can link that GPO into the OU where your PCs are located. To restrict desktop, You can do like following,

  1. Create a Group Policy Object, go to Computer Configuration > Policy > Windows Settings > Security Settings > File System
  2. Right click and add %userprofile%\Desktop ( or another different folders that you want to restrict)
  3. Then Specify the permissions
    33051-1461573.png