Hello, i have a few questions....


On our terminal servers, users have the opportunity to customize their
desktop by right-clicking on the taskbar and select properties.
We don't want to take away this option for our users, but I discovered
the other day that by allowing this, we also allow them to do
things they should NOT at all be able to do.

When right clicking the taskbar -> properties -> selecting start menu
-> customize -> clicking the advanced tab

I can turn on "show administrative tools both in all programs and the
start menu"

BINGO! users now have access to administrative tools... Including
Terminal Services Manager.

Allthough they don't have the privilegies to log off users, stop
services or do anything harmful, they should not be granted such
access.
Users can spy on eachother and they can easily spy on our system
settings (NOT GOOD)

How can you simple disable access AT ALL to the administrative tools,
whithout taking away their option to customize desktop/start menu etc?

Any helpful answers / suggestions are warmly welcome!

Sincerely,

Lars

Configure the GPO:
User Configuration\Administrative Templates\Windows Components\Microsoft
Management Console\Restrict users to the explicitly permitted list of snap-ins

It won't stop them from getting the Administrative Tools icons up but this
will prevent the users from loading any administrative tools, unless you
choose to specifically allow them to use one.

Brian Delaney


"(E-Mail Removed)" wrote:

> Hello, i have a few questions....
>
>
> On our terminal servers, users have the opportunity to customize their
> desktop by right-clicking on the taskbar and select properties.
> We don't want to take away this option for our users, but I discovered
> the other day that by allowing this, we also allow them to do
> things they should NOT at all be able to do.
>
> When right clicking the taskbar -> properties -> selecting start menu
> -> customize -> clicking the advanced tab
>
> I can turn on "show administrative tools both in all programs and the
> start menu"
>
> BINGO! users now have access to administrative tools... Including
> Terminal Services Manager.
>
> Allthough they don't have the privilegies to log off users, stop
> services or do anything harmful, they should not be granted such
> access.
> Users can spy on eachother and they can easily spy on our system
> settings (NOT GOOD)
>
> How can you simple disable access AT ALL to the administrative tools,
> whithout taking away their option to customize desktop/start menu etc?
>
> Any helpful answers / suggestions are warmly welcome!
>
> Sincerely,
>
> Lars
>
>