Locking down local destops question

February 29, 2008

In a test environment, we have setup an SBS2000 DC with a Windows 2003

TS and XP Pro clients. We have successfully applied a GPO to the OU

that contains the TS for the Testusers and the TS desktop is locked

down-- with the exception of a few items we cannot remove using a

Windows2000 GP editor. We followed the standard procedure of moving

the TS into is own OU, adding the Testusers group to the Security,

removing 'Authenticated Users' from Security, adding thte TS machine

to the Security. We also enabled "loopback processing" with the

'Replace' option.

On the XP Pro clients, the Testusers have no reason to use any local

resources as they only use what we give them on the TS. So, since

loopback policy is enabled with the "Replace" option it has freed up

the local desktop environment. We would also like to lock these down

so that the users cannot get into Windows Explorer, Internet (we

blocked with proxy setting), My Computer, and if they stick in a flash

drive it does not read it, etc. They do not print anything locally.

How is the best way to approach locking down the local desktops? There

will be (10) computers involved.

1. For instance, do we not use the 'Replace' option on loopback

processing?

2. And/or do we put the (10) XP desktops into their own OU and create

a GP just for them?

Thanks

February 29, 2008

Re: Locking down local destops question

I would definitively use your method 2, i.e. place the computer

accounts for the XP clients in a separate OU and create a separate

GPO linked to this OU to lock them down.

Sooner or later, you will probably want to have one or more

settings which are different on the TS and the XP clients, and by

creating different GPOs from the beginning, you have this

flexibility.

_________________________________________________________

Vera Noest

MCSE, CCEA, Microsoft MVP - Terminal Server

TS troubleshooting: http://ts.veranoest.net

___ please respond in newsgroup, NOT by private email ___

compsosinc@gmail.com wrote on 29 feb 2008 in

microsoft.public.windows.terminal_services:

> In a test environment, we have setup an SBS2000 DC with a

> Windows 2003 TS and XP Pro clients. We have successfully applied

> a GPO to the OU that contains the TS for the Testusers and the

> TS desktop is locked down-- with the exception of a few items we

> cannot remove using a Windows2000 GP editor. We followed the

> standard procedure of moving the TS into is own OU, adding the

> Testusers group to the Security, removing 'Authenticated Users'

> from Security, adding thte TS machine to the Security. We also

> enabled "loopback processing" with the 'Replace' option.

>

> On the XP Pro clients, the Testusers have no reason to use any

> local resources as they only use what we give them on the TS.

> So, since loopback policy is enabled with the "Replace" option

> it has freed up the local desktop environment. We would also

> like to lock these down so that the users cannot get into

> Windows Explorer, Internet (we blocked with proxy setting), My

> Computer, and if they stick in a flash drive it does not read

> it, etc. They do not print anything locally.

>

> How is the best way to approach locking down the local desktops?

> There will be (10) computers involved.

>

> 1. For instance, do we not use the 'Replace' option on loopback

> processing?

>

> 2. And/or do we put the (10) XP desktops into their own OU and

> create a GP just for them?

>

> Thanks

February 29, 2008

Re: Locking down local destops question

On Feb 29, 2:52 pm, "Vera Noest [MVP]" <vera.no...@remove-

this.hem.utfors.se> wrote:

> I would definitively use your method 2, i.e. place the computer

> accounts for the XP clients in a separate OU and create a separate

> GPO linked to this OU to lock them down.

>

> Sooner or later, you will probably want to have one or more

> settings which are different on the TS and the XP clients, and by

> creating different GPOs from the beginning, you have this

> flexibility.

>

> _________________________________________________________

> Vera Noest

> MCSE, CCEA, Microsoft MVP - Terminal Server

> TS troubleshooting: http://ts.veranoest.net

> ___ please respond in newsgroup, NOT by private email ___

>

> compsos...@gmail.com wrote on 29 feb 2008 in

> microsoft.public.windows.terminal_services:

>

> > In a test environment, we have setup an SBS2000 DC with a

> > Windows 2003 TS and XP Pro clients. We have successfully applied

> > a GPO to the OU that contains the TS for the Testusers and the

> > TS desktop is locked down-- with the exception of a few items we

> > cannot remove using a Windows2000 GP editor. We followed the

> > standard procedure of moving the TS into is own OU, adding the

> > Testusers group to the Security, removing 'Authenticated Users'

> > from Security, adding thte TS machine to the Security. We also

> > enabled "loopback processing" with the 'Replace' option.

>

> > On the XP Pro clients, the Testusers have no reason to use any

> > local resources as they only use what we give them on the TS.

> > So, since loopback policy is enabled with the "Replace" option

> > it has freed up the local desktop environment. We would also

> > like to lock these down so that the users cannot get into

> > Windows Explorer, Internet (we blocked with proxy setting), My

> > Computer, and if they stick in a flash drive it does not read

> > it, etc. They do not print anything locally.

>

> > How is the best way to approach locking down the local desktops?

> > There will be (10) computers involved.

>

> > 1. For instance, do we not use the 'Replace' option on loopback

> > processing?

>

> > 2. And/or do we put the (10) XP desktops into their own OU and

> > create a GP just for them?

>

> > Thanks- Hide quoted text -

>

> - Show quoted text -

Thank you so much. Will get to work on this and may post additional

questions later.

March 3, 2008