User can delete the icons from all desktop folder on Windows 2000

[Guest]

My Windows 2000 Domain has a gorup policy in place which prevents the
everyone group from being able to icons from the \\pcname\c$\Documents and
Settings\All Users\desktop\ folder. The group uses the current setting:

Computer Conifguration\Windows Settings\Security Settings\File System\ with
a file called %AllUsersProfile%Desktop\ which is configured to allow the
everyone group read and execute.

This group policy prevents most users from deleting icons from the all
users\desktop, however some do not work. Some PC's allow the users to delete
the icons from the alluser\desktop folder. However for thos PC's, if I look
at the security for a file on the desktop, the everyone group is only read
and execute, hoever the users are able to delete the icon which isn't correct.

I've also tried to log into another PC with the troubled users which
prevents them from deleting anything which is correct.

Since this problem is happening for a few PC's I'm not sure if it;s a PC
problem, Group policy problem or user problem. Could someone please assist

 

[Dave Britt]

I would recommend that you investigate the folder permissions. It would seem
strange however the ability to delet a file is based on the folder
permissions and not the file. Take a look at the folder permissions on a
working machine and compare to the machine on which users can delet the
icons. Ensure that the folder permissions have only read access to prvent
files from being deleted.

 

[Andreware]

If your clients are using Windows 9x, ME, or NT, Group Policy will not
propagate to those clients, which could cause them to retain their
permissions.

If, on the other hand, you use Windows 2000 or XP for them, I honestly
don't know what to tell you, other than make sure that you didn't
define it in 'Domain Controller' policy (which it doesn't sound like
you did).

Do the clients that can delete have anything in their event logs,
especially from the likes of Userenv or SceCli, saying that Group
Policy failed?