Welcome to the forum.
What is the help doing in the root of the server? Put it in a
folder and then the IT guys can prevent access to anywhere else
with permissions.
In any case they should not be able to access the root of the
server. Their browser will see C as their hard disk.
I'm no expert in this area but I don't believe your users can
do what you believe they can. Have you spoken to your IT people?
Help others by clicking Correct Answer if the question is answered. Found the answer elsewhere? Share it here. "Upvote" is for useful posts.