How do I restrict access to C drive using Intune

Question

question

LewisHill-7669 asked Sep 7, '20 Anoop-C-Nair-MVP answered Mar 24, '22

How do I restrict access to C drive using Intune

I would like to block access to the C drive for a certain group of users. These users access devices that are enrolled in Intune. The policy must meet the following requirements;

No access to C drive
No ability for user to edit content in C drive
All apps used on device that require C drive access must be unaffected by this restriction
Policy must apply to select group of users
Policy must apply to devices that are both Hybrid Azure AD domain-joined and Azure AD domain-joined

I am familiar with achieving this using Group Policy but would like to use Intune instead. I have been exploring the options in Intune - specifically by creating a device configuration profile, but have so far been unsuccessful.

Any help would be appreciated.

mem-intune-device-configurations

· 2

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Crystal-MSFT · Sep 08, 2020 at 03:11 AM

anonymous user, From your description, I know you want to restrict access to C drive for some users. if there's any misunderstanding, please let us know.

Based as i know, C drive contains the files which is OS related.
C:\WINDOWS folder contains the files that, in turn, contain the code to run the OS.
C:\Users store the information of user profile.
C:\Program Files or C:\Program Files (x86) store the application installed on the device.

To restrict user to access C drive may cause login issue and etc. Could you let us know why we want to restrict user to access C drive?

0 ·

Crystal-MSFT Crystal-MSFT · Sep 11, 2020 at 08:14 AM

anonymous user, How are things going? Could you provide the above information to us? Thanks and I look forward to your reply.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

0 ·

Answer 1 · 2020-09-07T10:41:34.84Z

EswarKoneti-MVP answered Sep 7, '20 EswarKoneti-MVP edited Sep 7, '20

no access to C drive-->you can use custom CSP to restrict the storage (restrictlocalstorage) https://docs.microsoft.com/en-us/windows/client-management/mdm/sharedpc-csp
you can apply this CSP policy to a policy to group of users.
Make sure the user is standard user and not part of administrator group to restrict from installing any apps.

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 2 · 2020-09-08T00:28:51.537Z

Jason-MSFT answered Sep 8, '20

I am familiar with achieving this using Group Policy but would like to use Intune instead

And what exactly would you do using Group Policy?

All apps used on device that require C drive access must be unaffected by this restriction

This is not possible as you don't grant or restrict applications access in Windows. All access is based on the user launching the application.

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 3 · 2020-09-16T12:13:16.34Z

sheahandc answered Sep 16, '20

@EswarKoneti-MVP You are correct.

Please find below thread for the step by step actions to restrict the C drive.

can-intune-block-access-to-c-drive

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 4 · 2022-03-24T20:20:52.623Z

Anoop-C-Nair-MVP answered Mar 24, '22

I have done some work in the lab to implement a policy similar to that you are looking for (I think). I don't know whether Prevent Users to Save Files on Local Drives Desktop using Intune would help you or not. But it's worth a try in the staging environment.

KR
Anoop
https://www.htmdcommunity.org/

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

question