how do i lock down desktop 1

[schooltechnical]

hi,wondering if anyone can help. I have a WIN23K server and winxp clients. I use domain gpo's to bolt users down, however there is no gpo restriction that stops users saving to the desktop. Any ideas? (for various reasons I DO NOT want to use mandatory profiles even though I know this could be a 'solution'). I just want users to stop saving stuff on the desktop! There doesn't seem a GPO policy to do this. thanking you kindly. Try and have a good day everyone.

 

[Claudek]

I've had a similar case just recently for standard users for a client. What I did was have a standard desktop with the icons etc that the client wanted. We then took away the icons that the system gives to you such as Outlook and Windows Media Player (Don't want double shortcut icons). We then saved the shortcuts to a folder called Desktop on our server which was under the users shared directory. Assigned the appropriate NTFS permissions (basically read and execute) and then redirected all the standard users desktops to that location using Group Policy.

One way i guess of getting this done.

Claudius (What certifications??)

http://www.iteq.com.au

 

[maximusimo]

You could use:

User Configuration --> Administrative Templates --> Desktop and enable "Dont save settings at exit"

Although this may still allow them to save things once and if they are gone when they next log on they may complain (could have been something important they saved)

Or this could be a possibility

You may be able to do it by activating 'Active Desktop' and then you can set all the permissions you want on it. You can do all of this thru

User Configuration -> Administrative Templates -> Desktop -> Active Desktop

 

[Claudek]

maximusimo's plan is a good one too. Unfort my settings were due to company policy not allowing Active Desktops. If you do not have this restriction, the Active Desktop policy will give you a lot of control in doing what you want in regards to the locking of desktops.

Claudius (What certifications??)

http://www.iteq.com.au

 

[schooltechnical]

Thanks for this. The problem I have is I don't have a folder called Desktop under user's shared directory on the server. I have Favourites and Start Menu but no Desktop.
I just want pupils to stop saving on desktop

 

[schooltechnical]

the 'dont save settings at exit' does not stop users from saving to desktop. It says this specifically in relation to this this gpo.

 

[Claudek]

Just sit at a workstation where the desktop has all the shortcuts you believe are correct - select them and then copy and paste them to the server. Create a folder - call it whatever you want (I called mine Desktop) on the server where it can be access via a share (eg, mine could be accessed by going to \\server\users\desktop).
Make the folder read only. Set the ntfs permissions for the appropriate users group to read and execute. Now set up folder redirection for the desktop to the folder with the desktop shortcuts.



Claudius (What certifications??)

http://www.iteq.com.au

 

[maximusimo]

Actually think Claudeks solution is the best and quite easily to implement, might take it on board myself.

 

[schooltechnical]

claudek, this worked brilliantly! thanks so much for your help! I've been stuck on this problem for months! Try and have a good day.
Much appreciated