How to disable access to Drives using Disk Management

Ajith — Wed, 30 Sep 2009 03:35:49 +0000

One of the visitors of SI, Joseph, recently asked in a comment to the post “How to disable drive access from registry” how he could disable access to a drive even for programs like Ashampoo which managed to override the registry trick. The method to be used in such situations is explained here. In one of the previous posts we had discussed how to Manage disk drives using Disk drive management console Object of Windows. We can use the Management Console to disable access to select drives also.

This very same method can be used to change the drive letter of any drive also.

1. Run (WIN + R) “diskmgmt.msc” to open te Windows Disk Management Console.

WIN+R diskmgmt.msc open Disk Management Console Object

2. Right Clcik on the desired drive and Select “Change Drive Letter and Paths..“

Change Drive Letter and Paths.." width="473" height="384" />

Select Drive and Right Clcik -> Change Drive Letter and Paths..

3. Remove the drive Letter and Click OK.

Remove the drive letter and click OK on the warning message.

You can use the same process to later access the drive. Just select the unnamed drive from the console and Use the Add drive letter function to later add a drive letter and make it accessible all across the system. This is really easy to do and probably most of your friends would never find out.

last post in the series, the best way to prevent infection by a Virus is to Disable Autorun. So how do you disable Autorun? The easiest way to do this is using Group Policy Editor which is a Microsoft Management Console Object. To Turn Off AutoPlay/ AutoRun follow these steps :
Watch this step by step Flash Tutorial

1. Goto START»RUN gpedit.msc

2. Browse to the folder Computer Configuration»Administrative Template»System.

3. Scroll down and Open Turn Off Autoplay option.

4. Enable it and select All Drives

This will be a system wide change. Instead if you need to turn Off Autorun just for your user account do the same in the folder -

User Configuration»Administrative Template»System

Please read the previous post in the series for some more useful tips on preventing Viruses.You might want to use the Address bar tip give at the end of last post in this series too.

Hidden folders and files in C drive of Windows

Recycler : Recycler is aanother form of Recycle Bin. The Recycler folder contains a Recycle Bin for each user that logs on to the computer, sorted by their security identifier (SID).

System Volume Information : This contains the log files and backups of important System Files that are used for System Restore in Windows. (System Restore allows you to roll back all the settings and System Files to a previous time)

MSOCache : MSOCache is the folder that contains cached Office installation files. The folder is safe to delete.

NTLDR : This is the Windows NT boot loader. This is replaced by winload and Windows Boot Manager in Windows Vista

NTDETECT.COM : This file is used by Windows NT during startup to detect basic hardware required to boot the OS. This is used for Systems having BIOS.

Autoexec.bat : is most often used to set environment variables such as keyboard, soundcard, printer, and temporary file locations. It is also used to initiate low level system utilities.
These are the main folders and files in XP.

pagefile.sys : This is the actual pagefile, as the name indicates, of Windows. This file is used as virtual memory on your system.

hiberfil.sys : As the name indicates this is the file used for Hibernation. While hibernating the system stores all the content of the RAM to this file and shuts down. The next time you start your system the RAM contents are restored from this file.

Windows. Now lets see whether we can directly access these folders. As it turns out Windows by default will not grant you permission to the folder System Volume Information.

Thats because the folder contains important System Restore Point informations. So what do you do when you can’t touch your own property. well it is there that the Windows file sharing comes into play. It may sound a little weird at first but it is true. Lets see how.

Step 1 : Go to Tools>>Folder Options and select View tab.

Here scroll down to the bottom, you can see a check box named Use Simple File Sharing (Recommended), UNCHECK the box, click APPLY and OK. Now you are done with the settings part. So just take the Properties (ALT+ENTER) or RIGHT CLICK>>PROPERTIES) of System volume Information you can see a new tab named Security here. You can see that there will be a user named SYSTEM there and it has full permission (refer picture).

You need to add your User account as a user here and give full permission to your self in order to gain access. Click Add button and type in your user name and click Check Names your user name will be filled along with the computer name automatically.

Click OK. now just click on user name of yours and check Full control. Click Apply, OK and you are done.

You can get access to files that return an “Access Denied” error by using this method. are some Files and Folders which need some more work to open I’ll discuss it in next post. Till then try this and figure out what all were hidden from you.

Windows . It starts with how to see the files and folders that were hidden by Windows for some reason. The series is actually inspired from the one done by Samanathon on Starting your Day with a fresh Computer. He did a good job and I am a regular visitor of Saman’s Blog.

A Super Hidden or a Protected Syetem File is a file that is normally not shown in the Windows Explorer even if you have enabled Show Hidden files (Tools>>Folder Options>>View>>Show Hidden Files and Folders) in Windows Explorer). This is because if some of these files are deleted or changed Windows may encounter a fatal error. Some of such folders are :

C:Windowssystem32dllcache
System Volume Information – this is in all the drives
Recycler – which is also in all the drives

So the first step involved is to make Windows show all the Super Hidden files. This can be done in two ways. One is directly through Windows Explorer Tools>>Folder Options and the other is through registry. So the former being easier and straight forward I’ll discuss it first.

1 . Through Windows Explorer

In Windows Explorer from Tools (Alt+T) menu take “View” tab in “Folder Options”.Make sure that you have selected Show Hidden Files and Folders and that you have unchecked Hide Protected operating system files options. Click Apply and then OK. This will enable you to see system files that had previously been hidden from your view.

2 . Through Registry Editing

This is a little more complex.(It is recommended that you read the following posts before you go into the registry. Try this if you know Registry editing. Make a backup of the registry before you proceed.( The Introduction to Windows Registry , Know how to backup your registry )

Follow these steps..

1 . Run ( WIN+R ) regedit and open registry editor.

Go to the Key HKEY_CURRENT_USERSoftwareMicrosoftWindows
CurrentVersionExplorerAdvanced.

2 . In there you will see a Registry DWORD named ShowSuperHidden Make the value 1 instead of 0.

3 . Now all you need to do is to restart Windows Explorer. to do so you can goto Start>>Shut Down and Click Cancel while holding down SHIFT+CTRL+ALT. Now press ALT+CTRL+DEL this will bring Task Manager. Take File>>New Task and type explorer and press Enter.

Now if you go to any drive you can see the previously Hidden files there. Note that you will still need to enable Show Hidden files option in Folder Option.

Autorun method – please read that article if you prefer to do so)

Open registry editor ( WIN+R » regedit )

Navigate to the key
HKLMSoftwareMicrosoftWindowsCurrentVersionExplorerDriveIcons

Here you can see some sub keys with name as drive letters in you system.

Each one of them will have another sub key DefaultIcon . The Default string value here contains the path to the icon used for that drive. Double Click on this and set the path of the icon you want to use.

This will change the default icon of that drive. Repeat it for other drives also. I don’t know any easier way, but if you know just post a comment and I will publish it here and link back to your blog.

If you want to prevent access to a drive, read 2nd tip in “Points to note” given after this post or read how to Prevent access to select drives using Registry.

“One of the key differences between Windows and Linux is the tree structure used in Linux for filesystem. In Linux everything is a hierarchical leaf or branch of the Root “” directory. It was only recently that Linux started loading (mounting) drives other than the system drive automatically. (If you want to know more, here is an article which will explain the Linux file hierarchy). To implement the Linux style tree structure in windows is pretty easy and is explained here.”

Open Disk Management object by typing “diskmgmt.msc” in START » RUN box or in Command Prompt. Here you can see all the Primary (Blue) and Logical (Green) partitions available on your system.

You will be able to see the Linux partitions too. Select a drive and Right Click on it. Here you can see an option “Change drive Letter and Paths“. Under this option you can remove a drives letter change it or mount a volume into a folder.

Screen shot of my H and G drives mounted in a folder “C:Drives”

Some points to note here are …

1. You cannot remove the drive letter association of your system drive.
2. If you do not assign a drive letter or mount the drive to a folder on another drive it will not be accessible by any means in Windows.
3. You can’t add more than one drive letter to a drive.
4. To mount a volume the folder must be on a different partition.

Consider reading The post on Microsoft Management Console if you want to know more.

Windows Registry. But for many dealing with Registry is not an easy task. Also for simple administrative tasks involving MMC using the Registry will be an overkill for many. (You can find the posts on Registry here) The following i a brief into to MMC from the MMC help available in Windows XP.

The extension of console objects are always msc representing Microsoft Console. They can be found under “%systemroot% system32 ” folder. A backup copy of each could be found under “%systemroot%system32 dllcache ” folder

Introduction to MMC

Microsoft Management Console (MMC) can be used to create, save, and open administrative tools (called MMC consoles) that manage the hardware, software, and network components of your Windows system. MMC does not perform administrative functions, but hosts tools that do. The primary type of tool you can add to a console is called a snap-in. There are two general ways that you can use MMC: in user mode, working with existing MMC consoles to administer a system, or in author mode, creating new consoles or modifying existing MMC consoles.

The following administrative tools appear under Windows XP

Component Services

Used by system administrators to deploy and administer COM+ programs from a graphical user interface, or to automate administrative tasks using a scripting or programming language. Software developers can use Component Services to visually configure routine component and program behavior, such as security and participation in transactions, and to integrate components into COM+ programs. For more information, see Using Component Services.

Computer Management

Used to manage local or remote computers from a single, consolidated desktop utility. Computer Management combines several Windows XP administrative tools into a single console tree, providing easy access to a specific computer’s administrative properties. For more information, see Using Computer Management.

Data Sources (ODBC)

Open Database Connectivity (ODBC) is a programming interface that enables programs to access data in database management systems that use Structured Query Language (SQL) as a data access standard. For more information, see Using Data Sources (ODBC).

Event Viewer

Used to view and manage logs of system, program, and security events on your computer. Event Viewer gathers information about hardware and software problems, and monitors security events. For more information, see Using Event Viewer.

Local Security policy

Used to configure security settings for the local computer. These settings include the Password policy, Account Lockout policy, Audit policy, IP Security policy, user rights assignments, recovery agents for encrypted data, and other security options. Local Security Policy is only available on computers that are not domain controllers. If the computer is a member of a domain, these settings may be overridden by policies received from the domain.

Performance

Used to collect and view real-time data about memory, disk, processor, network, and other activity in a graph, histogram, or report form. For more information, see Using Performance.

Services

Used to manage the services on your computer, set recovery actions to take place if a service fails, and create custom names and descriptions for services so that you can easily identify them. For more information, see Using Services.

# To open MMC, click Start, and then click Run (WIN+R). In the Open box, type “mmc“.

# The consoles available in Windows XP are listed below. To access any just type their name (include the .msc) in Windows Run box (WIN+R)

certmgr.msc
ciadv.msc
compmgmt.msc
devmgmt.msc
dfrg.msc
diskmgmt.msc
eventvwr.msc
fsmgmt.msc
gpedit.msc
lusrmgr.msc
ntmsmgr.msc
ntmsoprq.msc
perfmon.msc
rsop.msc
secpol.msc
services.msc
wmimgmt.msc

The follow up posts in this series will deal with managing you computer with the MMC.

Sysinternals which is now a part of Microsoft. Among the many tools they offer a post have been made about TCP Viewer earlier.

Process Explorer is just every system administrators dream come true. Among the many functions provided the mainly noticeable ones are listed here.

Processes could be suspended and resumed. Just like the way you pause and resume music player you can suspend and then resume processes. This will be a great benefit if a program like a video encoder doesn’t have pause function.

You can Restart, Search online about any process. There is also a Properties view for processes which will show detailed stats of the process its handles, IO activity, Virtual an physical memory usage, TCP IP history, Environment Variables etc.

Process Explorer is able to replace task manager. You could do it right from the menus it self. This is done by a simple Registry Edit. I’ll post about it later.

This is the one of the basic tools everybody should have. Another one I would suggest would be a Free Data Recovery software.

Download Process Explorer NT here or visit the software page at Sysinternals.

Registry. Create a REG_DWORD value named NoViewOnDrive under
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersion
PoliciesExplorer and enter its value as follows. You must select decimal first and then add the following values to disable respective drives.

A – 1, B – 2, C – 4, D – 8, E – 16, F – 32, G – 64, H – 128, I – 256, J – 512, K – 1024, L – 2048, M – 4096, N – 8192, O – 16384, P – 32768, Q – 65536, R – 131072, S – 262144, T – 524288, U – 1048576, V – 2097152, W – 4194304, X – 8388608, Y – 16777216, Z – 33554432, ALL – 67108863

If you need to disable access to more than one drive you may add the values corresponding to all those drives and set the value. That is if you need to disable D and F drives add 8 (D)+32 (F) = 40 to the key.

To add the restriction to all users on the Compter just make the same key under
HKEY_LOCAL_MACHINE instead of HKEY_CURRENT_USER. If somebody tries to access a drive on which restriction is imposed this error will be shown “The operation has bee cancelled due to restrictions in effect on this computer“.

Please backup your registry before editing it so that you can disable any changes made. If you want to prevent copying of your data to a USB drive here is how you can do it.

Simple Informations » Windows

How to disable access to Drives using Disk Management

1 . Through Windows Explorer

Some points to note here are …

Introduction to MMC

The following administrative tools appear under Windows XP