(a copy of this e-mail has also been sent to NTBugTraq)
This is a summary of answers I got on this. Summing it all up, it seems that the "Hide Drivers" policy simply does not protect you, no matter what you do, whether you are running Office 97/98/2K, or anything else.
Markus Buchhorn [[EMAIL PROTECTED]] pointed that this seems to be a problem also with Office 2000:
> It's a problem in (all of) Office2k as well - Office2k-SR1 mentions a fix:
> http://support.microsoft.com/support/kb/articles/q245/0/21.ASP
> "Q249949 OFF2000: Policy to Hide Drives Ignored in Office Programs "
> http://support.microsoft.com/support/kb/articles/Q249/9/49.ASP
-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
Scott Talkovic [[EMAIL PROTECTED]] went on a longer discussion:
> Users can usually get to the drives using other methods too...for instance,
> within applications such as FTP, or, if available, by clicking on Start/Run
> and typing in the drive letter. I also wouldn't be surprised if someone
> could also call a batch file that would bring up the "hidden" drives or
> perhaps, if they can get to a shortcut's properties, use the browse button
> on the properties sheet (under Change Icon) to browse the drive. They might
> also be able to use Find to find files on a hidden drive if they manually
> type in the drive letter to search. If it finds something, then they could
> probably use the "Open Containing Folder" option in the Find tool to get
> access to the drive. I would verify these possibilities for you, but I don't
> have enough time right now. I do know for a fact that we can use FTP to
> browse the hidden drives on these workstations. I've done that before. As
> you can see, it's probably impossible to totally "hide" drives from users...
> Because of this, we always use NTFS and/or share permissions to protect
> files on the drives. We also only map those drives that are needed at the
> workstations.
I set up a "Hide Drivers" policy where ALL drivers, except one network drive, would be blocked. I then tested Windows Explorer and indeed only the network driver was visible. But when I started a MsDOS session (cmd.exe), I was put in my system's default path for DOS (C:\WinNT\Profiles\<user>\DeskTop), which should have been blocked (but look at the KB Q249949 above). Hum anyway.
I then launched Find Files, and I was able to see all my drivers if I explicitly selected then. Hum.
Jos Fotinos [[EMAIL PROTECTED]] also pointed out that:
> (...)
> But opening documents inside word
> entering c:\ as an adress inside the explorer deliviers simular results.
Thmas Seck [[EMAIL PROTECTED]] also offered another way,
> there is a much easier way to circumvent this policy.
>
> Use Filemanager (winfile.exe).
16-bit app, leftover from Win3... cool.
>
> Only Explorer and Explorer-based file dialogs care about these registry keys.
And finally Sean Alderman [[EMAIL PROTECTED]] said:
> I use similar restrictions on Windows 9X policies. You may also notice that
> any 16bit File Open API will allow you to see all local and mapped drives.
> (...)
> I would suggest checking the other File Open dialogs in apps like Office and
> maybe some 32bit non MS apps. The 16bit dialog does not allow you to
> perform edit ops like the 32bit dialog does. I have not noticed any issues
> with this in my Office 97 installations.
> (...)
This seems to be quite broken.
As far as I can understand, only the casual user will ever be blocked here. I also wonder if there is any chance of the "Hide Drivers" policy ever working. It is probable that the best (and, perhaps, the only) way of blocking access to different drivers is by using NTFS and acls.
Maybe the Office 2000 SR1 will succeed in block it at the Office (application) level, but this is only a minor point here. If I cannot open a document with Office (on a restricted system), I can still ftp it over somewhere else and open it (on a non-blocked system).
One might also say this is what happens when security is implemented at the application (user) level, instead of at the kernel level...
Regards,
..Calado..
