There are many use cases for hiding system drives, whether it be with View, XenApp, or whatnot. Fortunately, there are already templates in place to accomplish hiding the system drives; it is just a matter of finding them and enabling them. First, you need to create a GPO to restrict access and to actually hide the drives. This will be a User GPO, but it will need to be in the Machine container of the computers in question.

Create a new GPO, browse to User Configuration->Policies->Administrative Templates->Windows Components->Windows Explorer. You will see 2 settings that are pertinent here:

  • Hide these specified drives in My Computer
  • Prevent access to drives from My Computer

Enable both of these, and select which drives you would like it to apply to.

The tricky part here is that the above is a User GPO, but it is applied to a Machine container. To make this GPO activate, User Group Policy loopback processing mode needs to be enabled. This policy directs the system to apply the set of GPOs for the computer to any user who logs on to the computer. This can be found in Computer Configuration->Policies->Administrative Templates->System->Group Policy.

Once done, restart the servers and test. The following is an example showing Microsoft Visio published through Citrix XenApp.

Before:

After:


By default, this will apply to all users. To disable it for certain users, modify the Security settings of the GPO to not apply to the users in question (Microsoft KB 315675).