Share via

how to prevent access to \127.0.0.1\c$ or \localhost\c$

  • Article

Question

Wednesday, March 1, 2017 7:10 PM

For security purposes, we want to prevent our users from accessing the C drive on their computers and on the terminal servers. These users are *not* local admins on either their workstations or the servers.

We have implemented the following Group Policy settings:

- Remove Run Menu from Start Menu

  • Hide these specified drives in My Computer - Restrict C drive only
    -Prevent access to drives from My Computer  - Restrict C drive only

This does prevent the users from accessing the C drive from Windows Explorer.

However, if they enter \127.0.0.1\c$ or \localhost\c$ they can access the C drive from any of these ways:

Internet Explorer / Edge

Chrome

A link in Microsoft Word

How can I prevent this? I repeat - they are not admins in any form, and yet they can access the C drive via the administrative share. (I am also not the only person reporting this problem).

I would be happy to block access to any UNC paths (as long as I can still map drives for them), or to prevent or misdirect 127.0.0.1/localhost. But nothing I have tried works, and I really need to prevent this.

Any ideas?

Thanks,

David

All replies (3)

Thursday, March 2, 2017 8:14 AM âś…Answered

I have found a solution in this link:

https://social.technet.microsoft.com/Forums/office/en-US/b168408e-a540-4e3a-92cc-3121486ceb78/admin-shares-available-to-nonadministrative-users-over-loopback-address?forum=winserversecurity

The registry fix solves the problem!

Thursday, March 2, 2017 7:20 AM

Hi David,

You could disable the Administrative share.

Here is a similar thread for you:

http://superuser.com/questions/517592/group-policy-block-access-to-localhost-c

Please Note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

Thursday, March 2, 2017 9:00 AM

Hi,

Thanks for sharing your solution and experience here.

Please mark the helpful reply as answer in order that other community members could find the helpful reply quickly.

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].