How can I lock access to Start menu/taskbar etc in Terminal server

[niallo32]

I have a Windows 2000 SP 4 Terminal Server.

I have created a user so that people can login and click on an Access query to give certain information.

I wish to lock access to everything else in the TS session -no access to the Start Menu, Run command, etc.

All I want them to be able to do is click on the query which is on the desktop.

Is there a way of doing this?

Thanks

 

[niallo32]

I also need to hide My Computer, My Network places, Internet Explorer too

Thanks

 

[niallo32]

Bump

 

[rzs0502]

You could setup a Published Application on the Server.
That way they only see the program when they login

"If you always do what you've always done, you will always be where you've always been."

 

[DotNetNewbie]

Cant you create a Group Policy specifically for that user which removes all the elements you dont need on the Start Bar?

D.

 

[niallo32]

Would I do this in Local Security policy in that Windows 2000 Terminal Server session?

 

[DotNetNewbie]

We have a citrix environment and depending on what OU a user is in will determine what appears on the Start Bar.

But besides this there are also GP's associated with the servers aswell.

I must admit I didnt implement this solution and to be honest im not sure if it is the best solution.

You will need to use a combonation of GP's for the user and local server policies.

I recommend creating a test user and building up the two policies until you get the desired effect. I can supply you with some details on our policies if that helps.

D.

 

[niallo32]

If you could supply me with the policies, that would be great.

Thanks

 

[ncotton]

Create a new Security Group in AD called TerminalServerLoginGroup. Add the specified user to it.
Create a new GPO, Edit > User Settings > Active Desktop > there are many settings in there that remove access or remove the display of such settings, pick and chose. Then apply this GPO to the OU that has the TerminalServerLoginGroup in it. On the right hand side, with the GPO linked and highlioghted, look at the Filters in the bottom right hand pane of the GPMC. Remove the Anyone / All Users / Everyone, or whatever accounts are in there, and click add (think its the ol' Yellow Star). Chose your OU\TerminalServerLoginGroup.

This GPO will now only be applied to that specific user (or any users in the group, rather than everyone in that OU.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[ncotton]

Create a new Security Group in AD called TerminalServerLoginGroup. Add the specified user to it.
Create a new GPO, Edit > User Settings > Active Desktop > there are many settings in there that remove access or remove the display of such settings, pick and chose. Then apply this GPO to the OU that has the TerminalServerLoginGroup in it. On the right hand side, with the GPO linked and highlioghted, look at the Filters in the bottom right hand pane of the GPMC. Remove the Anyone / All Users / Everyone, or whatever accounts are in there, and click add (think its the ol' Yellow Star). Chose your OU\TerminalServerLoginGroup.

This GPO will now only be applied to that specific user (or any users in the group, rather than everyone in that OU.

Hope this helps

Neil J Cotton
njc Information Systems
Systems Consultant

 

[niallo32]

That worked perfect,thanks.

 

[ncotton]

No problem....I hate this high speed internet, already completing the post on the page before i cancel it to make a slight change. Double posts look silly.

No problem my friend. Don't thank me. Pay me. You know what to do.

Neil J Cotton
njc Information Systems
Systems Consultant