Hiding Drives in RDS Environment

This is a common request we get from clients after deploying RDS. When a user creates an RDP session or launches a RemoteApp, by default, they can see the local drives of the Session Host server. If they can see it, they may even be able to access it. This could mean access to your OS (C:) drive, your local data (D:) drive or even that Server 2012 R2 ISO you accidentally left mounted.

A great option to avoid any confusion to your users is to simply hide drives.

Tech Tip: This isn’t specific to RDS, you may use these Group Policies on your client workstations if desired.

These settings can be found within WindowsExplorer.ADMX and WindowsExplorer.ADML, but if you change these and your ADMX get update all your customizations will be lost. At the very bottom of this you’ll find some CustomDrive ADMX/ADML files based off of the Windows Explorer ADMX/ADML files. I have added two extra options for hiding the E drive only and A,B,C,D and E drives.

To configure your policy navigate to the same location in GPMC, you’ll see this additional option.

If you select an option within this policy that exists in both the custom and native policies they will both show as enabled. This is because they are writing to the same Registry key and value. E.g. Restrict All drives. 

Here’s a very helpful link that’ll calculate your ‘NoDrive’ value for you.

Calculator: https://www.wisdombay.com/hidedrive/

Below is an explanation from Microsoft:

“This policy setting allows you to hide these specified drives in My Computer.

This policy setting allows you to remove the icons representing selected hard drives from My Computer and File Explorer. Also, the drive letters representing the selected drives do not appear in the standard Open dialog box.

If you enable this policy setting, select a drive or combination of drives in the drop-down list.

Note: This policy setting removes the drive icons. Users can still gain access to drive contents by using other methods, such as by typing the path to a directory on the drive in the Map Network Drive dialog box, in the Run dialog box, or in a command window.

Also, this policy setting does not prevent users from using programs to access these drives or their contents. And, it does not prevent users from using the Disk Management snap-in to view and change drive characteristics.

If you disable or do not configure this policy setting, all drives are displayed, or select the “Do not restrict drives” option in the drop-down list.

Also, see the “Prevent access to drives from My Computer” policy setting. 

=== Detailed values: === 

Id: NoDrivesDropdown

ValueName: NoDrives

item: decimal: 3 => Restrict A and B drives only 

item: decimal: 4 => Restrict C drive only 

item: decimal: 8 => Restrict D drive only 

item: decimal: 7 => Restrict A, B and C drives only 

item: decimal: 15 => Restrict A, B, C and D drives only 

item: decimal: 67108863 => Restrict all drives 

item: decimal: 0 => Do not restrict drives”

CustomDrives.ADMX

<?xml version=“1.0” encoding=“utf-8”?>
<!–  (c) 2006 Microsoft Corporation  –>
<policyDefinitions xmlns:xsd=“https://www.w3.org/2001/XMLSchema” xmlns:xsi=“https://www.w3.org/2001/XMLSchema-instance” revision=“1.0” schemaVersion=“1.0” xmlns=“#“>
<policyNamespaces>
<target prefix=“windowsexplorer” namespace=“Microsoft.Policies.WindowsExplorerCustom” />
<using prefix=“windows” namespace=“Microsoft.Policies.Windows” />
</policyNamespaces>
<resources minRequiredRevision=“1.0” />
<policies>
<policy name=“NoDrivesCustom” class=“User” displayName=“$(string.NoDrives)” explainText=“$(string.NoDrives_Help)” presentation=“$(presentation.NoDrivesCustom)” key=“SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer”>
<parentCategory ref=“windows:WindowsExplorer” />
<supportedOn ref=“windows:SUPPORTED_Win2k” />
<elements>
<enum id=“NoDrivesDropdownCustom” valueName=“NoDrives” required=“true”>
<item displayName=“$(string.ABOnly)”>
<value>
<decimal value=“3” />
</value>
</item>
<item displayName=“$(string.COnly)”>
<value>
<decimal value=“4” />
</value>
</item>
<item displayName=“$(string.DOnly)”>
<value>
<decimal value=“8” />
</value>
</item>
<item displayName=“$(string.ABConly)”>
<value>
<decimal value=“7” />
</value>
</item>
<item displayName=“$(string.ABCDOnly)”>
<value>
<decimal value=“15” />
</value>
</item>
<item displayName=“$(string.ALLDrives)”>
<value>
<decimal value=“67108863” />
</value>
</item>
<item displayName=“$(string.RestNoDrives)”>
<value>
<decimal value=“0” />
</value>
</item>
<item displayName=“$(string.EOnly)”>
<value>
<decimal value=“16” />
</value>
</item>
<item displayName=“$(string.ABCDEOnly)”>
<value>
<decimal value=“31” />
</value>
</item>
</enum>
</elements>
</policy>
</policies>
</policyDefinitions>

CustomDrives.ADML (en-us)

<?xml version=“1.0” encoding=“utf-8”?>
<!–  (c) 2006 Microsoft Corporation  –>
<policyDefinitionResources xmlns:xsd=“https://www.w3.org/2001/XMLSchema” xmlns:xsi=“https://www.w3.org/2001/XMLSchema-instance” revision=“1.0” schemaVersion=“1.0” xmlns=“#“>
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id=“ABCDOnly”>Restrict A, B, C and D drives only</string>
<string id=“ABConly”>Restrict A, B and C drives only</string>
<string id=“ABOnly”>Restrict A and B drives only</string>
<string id=“ALLDrives”>Restrict all drives</string>
<string id=“COnly”>Restrict C drive only</string>
<string id=“DOnly”>Restrict D drive only</string>
<string id=“EOnly”>Restrict E drive only</string>
<string id=“ABCDEOnly”>Restrict A, B, C, D and E drive only</string>
<string id=“RestNoDrives”>Do not restrict drives</string>

<string id=“NoDrives”>Hide these specified drives in My Computer (Custom)</string>
<string id=“NoDrives_Help”>This policy setting allows you to hide these specified drives in My Computer.</string>

</stringTable>
<presentationTable>
<presentation id=“NoDrivesCustom”>
<dropdownList refId=“NoDrivesDropdownCustom” noSort=“true” defaultItem=“5”>Pick one of the following combinations</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>

https://docs.microsoft.com/en-US/troubleshoot/windows-client/group-policy/using-group-policy-objects-hide-specified-drives

Brandon Stuart, PEI