Locking down Windows 2003 TS with 2000 GPO

February 25, 2008

We have a Windows SBS2000 based domain with a 2003 Terminal Server as

a member server. We have established a GP on the OU that contains the

TS. Since we are using a 2000 based AD & its available GP options, we

are having difficulty locking down the following for XP TS clients:

1. We cannot remove the 'My Computer' icon from the Start Menu. Note,

this is an option in Windows 2003 GP under User Configuration>Admin

Temp>Desktop --but not in Windows 2000 GP editor.

2. 'Internet Explorer' & 'Outlook Express' are appearing on the Start

Menu -left side of list. These are usually removed by enabling the

'Remove frequent programs list from the Start Menu' under User

Configuration>Admin Templates> Start Menu & Taskbar.

3. Removing the 'All Programs list from the Start Menu' -- same

location in GP as in #2 above. We have just (1) program we would like

to appear here --how do we do that?

4. The RDP menu bar -- at the top of the screen does not autohide so

the user could easily click the close button. We would like to remove

this altogether or lock it so they are force to logoff through the

Start Menu. Is that possible?

5. How do we get rid of the Quick Launch and System tray icons?

We have come acrossed a few threads referring to updating the Windows

2000 GP options to those of Windows 2003. Is this what we need to do?

Here is our environment in case there is another option for

controlling it. We have (10) XP TS clients that require the same TS

desktop and need the capability to run (1) TS application. That TS

Desktop and Start Menu (in case they delete the desktop icon for their

application) needs to contain (1) icon for the TS application --we

have placed that shortcut into the 'All Users' profile on the TS. But

they can delete it...not good.

Thanks

Recommended Posts