This article describes how to limit access to hard disks on computersrunning Internet Explorer 4.01 Service Pack 1 (SP1) or Internet Explorer 5with Microsoft Windows 95, Windows 95 Service Pack 1, Windows 95 OEMService Release version 1 or 2, Microsoft Windows NT 4.0, or runningWindows 98.
You can limit access to local hard disks without obtaining an updatedInternet Explorer file. Or, you can obtain an updated file that alsoallows you to apply additional restrictions that are listed later inthis article.
How to Limit Local Access Without Additional FilesImportant
This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
How to back up and restore the registry in Windows
To limit access to the local workstation, set the data value of the NoRunDWORD value to 0x1 in the following registry key:
Setting this value disables viewing local files by typing a file addressor URL (for example, "file://c:\") in the Address box, and also disablesthe Run command on the Start menu.
Setting this value also disables the ability to browse to the local filesystem using an embedded HTML link. For example, you cannot browse a fileby clicking the HTML link provided by the <a href="file://c:\">My FileSystem</a> tag when this registry setting is used.
If you want to disable access to a drive altogether, set the data valueof the NoDrives DWORD value as indicated:
Drive DWORD value ------------------- A 0x1 B 0x2 C 0x4 D 0x8
Set this DWORD value in the following registry key:
: Internet Explorer checks both HKEY_LOCAL_MACHINE (HKLM) and HKEY_CURRENT_USER (HKCU) for restrictions. The browser first checks HKLM. If it finds the restriction there, it does not check HKCU for the restriction. Typically, you use HKCU for restrictions. The keys and values may already exist in HKCU for this purpose too. However, if you want to use HKLM, you can. You may need to create the appropriate keys and values to make this work. For example, on most computers, the following key exists:
However, the following key does not exist:
Only the following key exists:
You need to add the Explorer key and then the approprate values to have the browser read them from this location rather than HKCU.NOTE
: All values are in hexadecimal.
This logic uses a bitwise left shift to decide which drive to use. Forexample, if you want to disable viewing drive C, set the DWORD value tobinary 0100. The code takes the return value from the function, subtracts"A" from the value, and shifts the binary value left by that number ofbits.
For example, drive C - drive A = 2. 0001 shifted to the left twice is0100. Binary 0100 has the hexadecimal equivalent of 0x4. This is how youcalculate the drive to disable.
As another example, if you want to disable drive N, use the followingmethod to calculate the hexadecimal value to place in the registry:
- Determine the numerical placement value for the letter N. If A=1, B=2, C=3, and so on, then N=14.
- Subtract the numerical placement value for A from N (14-1=13).
- Left shift binary 0001 by 13. This becomes a binary number with 13 zeros following a 1 (0010 0000 0000 0000).
- Convert to hexadecimal: 0x2000.
To disable multiple drives, take each of the individual hexadecimal drivevalues and add them together for a composite hexadecimal value for theregistry. For example, to disable drives C, D, and N, add 0x4 + 0x8 +0x2000 to equal 0x200C.NOTE
: Microsoft has changed the behavior of the registry keys discussed inthis article for the various versions of Internet Explorer 4.01. Thesechanges are as follows:
- A new key, NoFileUrl, is used to disable the ability to browse the local file system using "//file:" links on a Web page.
- Internet Explorer 4.0: Setting the NoRun value to 1 disables the Run command on the Start menu, and prevents you from being able to gain access to any local files using the Address box.
- Internet Explorer 4.01: Setting the NoRun value to 1 provides the same results as with Internet Explorer 4.0, along with browsing the local file system using "file://" links on a Web page.
- Internet Explorer 4.01 Service Pack 1: Setting the NoRun value to 1 disables the Run command on Start menu, and prevents you from being able to gain access to any local files using the Address box.
- With Internet Explorer 4.01, you must use the new registry setting NoFileUrl, and set it to a DWORD value of 1 to disable the ability to browse the local file system using "file://" links on a Web page.
Therefore, to reproduce the Internet Explorer 4.01 (non-SP1) behavior, boththe NoRun and NoFileUrl keys need to be set. With the release of InternetExplorer 4.01 SP1, you must include the new registry value NoFileUrl todisable the ability to browse the local file system using "file://" linkson a Web page.
How to Limit Local Access with Additional Update File
Obtain an updated Shdocvw.dll file by installing Internet Explorer 4.01Service Pack 2. You can obtain Internet Explorer 4.01 Service Pack 2 fromthe following Microsoft Web site:
The following tables list additional restrictions provided by this updatedfile. You must manually edit the registry of each computer using theupdated Shdocvw.dll file and add the corresponding registry value andsetting for each restriction.
Note that these restrictions also apply when you are using Kiosk mode.
Restrictions under HKEY_CURRENT_USER\Software\Policies\Microsoft\InternetExplorer\Restrictions: Each DWORD value must be set to 1 to be enabled. Todisable the restriction, set the value to 0.
Restriction Description ---------------------------------------------------------------------- NoFileOpen Disables Open command on File menu, CTRL+O, and CTRL+L. NoFileNew Disables CTRL+N NoBrowserSaveAs Disables Save and Save As on the File menu. NoBrowserOptions Disables Internet Options on the View menu (disables changing browser settings). NoFavorites No Favorites menu, adding to favorites, or organizing favorites. NoSelectDownloadDir Prevents user from being able to select download folder by not displaying the Save As dialog box when a file is downloaded. NoBrowserContextMenu Disables HTML context menu. NoBrowserClose Disable ALT+F4. NoFindFiles Disables the F3 key. NoTheaterMode Disables the F11 key. NOTE
: When you install Internet Explorer 4.01 Service Pack 2, NoFindFilesand NoTheaterMode are automatically set to a BINARY 01 00 00 00 value inthe registry. This setting properly enables these restrictions and is setas a BINARY value because of .inf file limitations. A DWORD value of 1 alsoenables those restrictions.
The following additional restriction must be added in thefollowing registry location:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\ Toolbars\Restrictions
Restriction Description --------------------------------------------------------------------- NoToolbarOptions Disables adding, removing, or moving toolbars.