Skip to content

Back to the catalog

bencteux.frwriteup

Windows explorer restrictions bypasses - filesystem access

A pentesting-focused writeup explaining how Windows Explorer restrictions NoDrives, NoViewOnDrive, and NoNetConnectDisconnect are configured via registry keys under HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, and demonstrating multiple practical bypasses (explicit path typing, autocomplete, Run box, Microsoft Edge, cmd.exe/PowerShell, loopback network drive mapping). The author notes these are purely visual restrictions enforced by explorer.exe and are trivially circumvented by any non-Explorer GUI or CLI program, making them insufficient as a security control in kiosk or restricted-desktop environments.

TL;DR Practical bypasses for Windows Explorer's NoDrives/NoViewOnDrive/NoNetConnectDisconnect policy restrictions used in kiosk/restricted environments.
Open original ↗
Document

What it is

A concrete breakdown of three specific Windows Explorer restrictions used to hide/lock drives on kiosks and locked-down desktops — NoDrives, NoViewOnDrive, and NoNetConnectDisconnect — and the exact bypasses for each. The summary says "bypass Explorer restrictions"; this page names the three registry keys, what each actually blocks, and how each fails.

How it works

All three are Group Policy settings stored as registry values under HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\:

  • NoDrives — hides drive icons from My Computer/Explorer and from the standard Open dialog. Value is a bitmask of drives (e.g. 0x4 = C:). SS64.com has a calculator for the mapping.
  • NoViewOnDrive — same bitmask table; blocks viewing contents of the drive via My Computer, Explorer, the Run box, Map Network Drive, and the dir command.
  • NoNetConnectDisconnect — 0 or 1; stops mapping/disconnecting network drives via Explorer (added to close the network-mapping bypass of NoViewOnDrive).

The author's key observation: these are visual restrictions on explorer.exe and native GUI components only. Any other program bypasses them.

Preconditions / Affected

A restricted Windows session (kiosk, locked-down workstation, RDP) where these policies are set. No admin rights are required for the bypasses.

What to do

Bypasses, per restriction, as the page states them:

  • NoDrives — type the path directly in the Explorer address bar (C: + ENTER); autocompletion still works there. If Explorer is unavailable, use the Run box or Microsoft Edge.
  • NoViewOnDrive — use Edge to browse the drive; or a CLI (cmd.exe / powershell.exe); or map the local drive as a network drive and open it in Explorer.
  • NoNetConnectDisconnect — reach C: over loopback without a mapping, or create the mapping from the CLI:
net use <drive> <net_path>

Or use Edge.

General rule from the conclusion: any program other than explorer.exe or native Windows GUI programs will bypass these restrictions. For defenders, this means these keys give only a "feeling of protection" — real filesystem lockdown needs CLI/Edge/alternate-shell restrictions layered on top.

Caveats

The page covers only these filesystem-drive restrictions; the author notes more Explorer restrictions exist and plans follow-up posts. It links to Martin Sohn Christensen's Improsec article on command-line restriction evasion — relevant because the CLI bypasses above assume you can still reach a prompt.

Organisations named here

  • NoDrives
  • NoNetConnectDisconnect
  • NoViewOnDrive

Technologies named here

  • Windows explorer
  • explorer.exe
  • Microsoft Edge
  • cmd.exe
  • powershell.exe
  • Windows Run box
  • net use
  • SS64.com calculator
  • Windows
  • PowerShell

Techniques named here

  • NoDrives bypass via explicit path entry
  • NoDrives bypass via autocompletion
  • NoDrives bypass via Run dialog
  • NoDrives bypass via Microsoft Edge
  • NoViewOnDrive bypass via Microsoft Edge
  • NoViewOnDrive bypass via CLI
  • NoViewOnDrive bypass via network drive mapping
  • NoNetConnectDisconnect bypass via loopback access
  • NoNetConnectDisconnect bypass via CLI net use
  • NoNetConnectDisconnect bypass via Microsoft Edge

Related in Offensive Security