{"id":37524,"date":"2021-12-02T10:15:26","date_gmt":"2021-12-02T17:15:26","guid":{"rendered":"https:\/\/moderneuc.com\/?p=37524"},"modified":"2026-02-18T13:02:18","modified_gmt":"2026-02-18T20:02:18","slug":"restrict-saving-files-to-local-drives","status":"publish","type":"post","link":"https:\/\/jorgep.com\/blog\/restrict-saving-files-to-local-drives\/","title":{"rendered":"Restrict Saving Files To Local Drives"},"content":{"rendered":"\n

A good question popped this week in my email. How do I prevent users from saving files to local drives, while still allow them to save to OneDrive folders?<\/p>\n\n\n\n

I think a lot of organizations would like ( or are doing it already) to do this, but the answer may have some complexity to it that really depends on what you want to do. <\/p>\n\n\n\n

First and foremost, I had to explain that OneDrive, and most of the other common cloud-based file storage systems, still store data locally and then sync the data to the cloud. With Windows 10 version 1709 and beyond, OneDrive has the Files on Demand<\/a> option which allows to display cloud only files in File Explorer but if you click on it to use it or view it , it will be downloaded to the local device temporarily. <\/p>\n\n\n\n

Then the second piece of the conversation involves explaining completely locking access to local drives might not be a great idea, as many applications use temporary files locally .<\/p>\n\n\n\n

I then proceed to explain that if the purpose is to protect your data, then a better way is to implement Windows Information Protection<\/a> which allows you to protect the files and automatically assign polices to files ( attached classification to them as corporate files) <\/p>\n\n\n\n

Having said this, below is how you will lock everything, although I would allow a few exceptions ( c:\\temp or c:\\<user>\\UserData ) for those times in which users need this and make it clear these files are not backed up.<\/p>\n\n\n\n

<\/p>\n\n\n\n

OneDrive Settings<\/h3>\n\n\n\n

OneDrive is fully integrated into Windows 10, and therefore you can set OneDrive as the default save location for all data or just specific files.<\/p>\n\n\n\n

You can find information on OneDrive settings on Microsoft OneDrive Documentation<\/a> including how to do this with Microsoft Intune using Administrative templates. ( Manage OneDrive Settings<\/a> and Use OneDrive policies to control sync settings <\/a> )<\/p>\n\n\n\n

<\/p>\n\n\n\n

Group Policy to Block a device <\/h3>\n\n\n\n