Solution to lock down Citrix desktop without Active Directory? 1

[halmp]

I’m fairly new to Citrix and just inherited a few servers with about a hundred users.
Here is my dilemma. We are upgrading to Metaframe XP on Windows 2000 server without Active Directory. Can anyone give me directions or best business practice on locking down the published desktop? Everything I find always requires Active Directory and we are not looking at implementation of AD until second quarter.
Is there a third party software, Group Policy….Please let me know how some of you control this environment.

Thank you for any ideas in advance!

Patrick

 

[mjbianco15]

Here's a link to a 3rd party product offered for Citrix. I had a chance to check out the desktop manager product...may be something you want to demo.

http://www.go-eol.com/products/thinssentials.htm

 

[halmp]

The EOL Desktop manager looks good. Are you currenty using this software? HOw do you like it? $1000 for this software per server can add up pretty quick.
Any other advise out there? Any tools within Windows?

Thanks,
Patrick

 

[bran2235]

Sorry man- AD all the way. I ran MF1.8 on W2000 member server in a NT4 domain and it (hate to say this) sucked!! Had a big problem with policies updating, being implemented, etc. You know, that was one of NT4's biggest problems anyway- I know there are some adm files out there but you just have to look for them. If I remember right, there is a TermainalServer adm file out there... I'll see if I have it...

Good Luck,
Brandon

 

[halmp]

You're right it seems there isn't a whole lot out there.
If you happen to have these adm files please let me know. I'll start surfing for some as well.


Thanks,
Patrick

 

[bran2235]

Halmp-
The adm file I have is for W2k ACTIVE DIRECTORY environment only- SORRY! But, email me because I have a lot of Reg Hacks for NT4TSE and W2k Server specifically for Citrix... They are a 'must have'!!
hpalerts@apexsystemsinc.com

Brandon

 

[mjbianco15]

I saw the Desktop Manager at a Citrix Seminar which included a few other products. Since we're AD and can do these items via policy, we do not have the software installed.

 

[Ogi]

Have you not thought about using Local Group Policy (gpedit.msc) and locking each server down with the same options? This is the same as using poledit on NT4. It's a pain because you have to do it on each Citrix server but, you can lock it down. Plus, if you get additional adm files, you can add them in and apply them!

Cheers,
Carl.

 

[bran2235]

yes, agree w/ Ogi- We were doing that (before we went to AD) in addition to using poledit... He's right becuase you'll have to update each MetaFrme!! make sure you doccument your changes!!

Good Luck~
Brandon

 

[halmp]

I have tried to use group policies and it worked fine but it restricted not only the user but also the admin acount! If there is a way I could apply this to everyone but the admin account this would work great.

Thanks everyone for sharing your ideas!!!

Patrick

 

[bran2235]

You need to specify the GROUPS that get the policy and make sure your Admins are not part of the group(s).

Brandon

 

[Ogi]

Hi,

No, in a word! I get used to it, I can usually work around most things, what is your issue with your policy and I'll see if I can give you any advice!

Cheers,
Carl.