Lock down in a workgroup environment

[Guest Scott]

Hi all,

I am setting up Win2003 with terminal server with no AD. How do I restrict

the RDP clients from accessing the items on the server that they shouldn't

without restricting all users (including Administrator), which is what

happens when using the GPO editor?

I know that if I install AD I can configure a new OU & link it to a policy

but I want to install it without AD as recommended.

I have used the limited options in the GPO snap in (Computer configuration,

Windows Components, Terminal Services) but I would like to stop them

accessing the C drive on the server, task manager etc. I have also excluded

access to the control panel from the "Task Bar & Start menu properties".

Have I missed something or are these the only options without giving them a

desktop?

Scott

[Guest Lanwench [MVP - Exchange]]

Re: Lock down in a workgroup environment

 

Scott <Scott@discussions.microsoft.com> wrote:

> Hi all,

> I am setting up Win2003 with terminal server with no AD. How do I

> restrict the RDP clients from accessing the items on the server that

> they shouldn't without restricting all users (including

> Administrator), which is what happens when using the GPO editor?

> I know that if I install AD I can configure a new OU & link it to a

> policy but I want to install it without AD as recommended.

 

I'm not sure what that means. If you *have* AD already on your network, it

would absolutely be recommended practice to join this server to the

domain.....and then use group policy.

 

That said, if you don't currently use AD at all on your network, check out

the thread entitled "Lockdown desktop without Group Policy" begun by Pearl

on 9/7/07.

 

> I have used the limited options in the GPO snap in (Computer

> configuration, Windows Components, Terminal Services) but I would

> like to stop them accessing the C drive on the server, task manager

> etc. I have also excluded access to the control panel from the "Task

> Bar & Start menu properties". Have I missed something or are these

> the only options without giving them a desktop?

> Scott