| Build a start menu with ABE |
|
|
| Written by Hans Straat, Thursday, 08 June 2006 | |
|
ABE stands for Access Based Enumeration and is a free add on for windows server 2003. We already covered the start menu with xcopy and promised to make several howto's available to buildup start menu's with different tools. ABE is one of the tools that can be used. ABE looks if a user has permissions to access a folder on a share and then let's the user see the folder. If no permissions are available, the user doesn't see the folder. In explorer the user would see the folder but would get the access is denied message cause there are no permissions to read the folder. After you installed ABE on the windows server you get a extra option in the properties of a folder after you made a share on the server. You can either enable ABE on a single folder or on all available shares on the server.
ABE works with read or no read permissions. If a user has the read attribute the user can see the folder. If the read attribute is missing the user won't see the folder. So this would work perfect for a startmenu. We created a share on a server called start menu. We have set the permissions per group on the folder. Only Administrators and System have full control on all folders. The application group has only read, list and read/execute permissions.
The group app.sysprosoft.admtemplateEditor has read & execute, list folder contents and read permissions. This way the user will see the folder. If you simply Deny the read permissions the folder will be hidden bij ABE.
Next step would be creating a GPO (Group Policy Object) and enable start-menu redirection. You can find this in "User Configuration\Windows Settings\Folder Redirection\Start Menu" right click on the start menu folder and you can configure the redirection.
Now you have to enable the policy on the OU the users reside. This way the users will get the redirected startmenu. If you as administrator do not want a redirected startmenu simply deny read permissions to the administrative group to this GPO. Basicly your done now. The redirected start menu will only show the user the folders and menuitems the user has read permissions on. The rest is simply not visable. Download ABE here Note: Although it loads fast there are some points you have to consider. If your network is slow this redirection will make the logon time longer, also if the network is broken or the share is broken the startmenu is not available. Test it before you implement it in your production environment. |
| < Prev | Next > |
|---|
|