How to lock user desktop?

[Guest]

Is there a GPO to prevent users from saving anything (links, docs, shortcuts)
to the desktop? All I could find is a way to hide desktop icons, prevent
saving in the taskbar, etc.

I see a way to do this with mandatory profiles, but would like to go the
easier route of a GPO.

Thanks.

 

[Florian Frommherz]

Howdy Steve!

Is there a GPO to prevent users from saving anything (links, docs, shortcuts)
to the desktop? All I could find is a way to hide desktop icons, prevent
saving in the taskbar, etc.

What about using the group policy filesystem-settings in CompConf\Window
s Settings\Security Settings\File System ? You can add a "rule" and deny
your users the "Write" and "Modify" permissions...

cheers,

Florian

 

[Guest]

I've not used this GPO item before - the only option I have is to add file.
What kind of file is it expecting to add so that I can try this?

Thanks.

 

[Florian Frommherz]

Howdy Steve!

I've not used this GPO item before - the only option I have is to add file.
What kind of file is it expecting to add so that I can try this?

It's quite simple. The "file to add" is the "Desktop"-folder as you wish
to set permissions on that. So you need to "add" the Desktop folder and
click "OK". The editor will then open the known "Security" dialog where
you can change NTFS permissions.

If you haven't done this before, you might want to create a test-OU with
test-users and a test-computer and try this GP on them...

cheers,

Florian

 

[Guest]

Would I select the "documents & settings\all users\desktop" folder from my
local machine and then adjust permissions for all authenticated users for
read only & list?

Thanks.

 

[Florian Frommherz]

Howdy Steve!

Would I select the "documents & settings\all users\desktop" folder from my
local machine and then adjust permissions for all authenticated users for
read only & list?

In order to restrict the permission for all _new_ users on the machine,
you will have to choose the "Documents and Settings\Default
User\Desktop" folder. But as I saw right now, this will not affect
existing profiles on the computers. So, you'd need to change the
existing profiles' permissions manually with a tool like subinacl.exe
(http://www.microsoft.com/downloads/...56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en)

Sorry...

cheers,

Florian

 

[Evan]

You may want to consider using a mandatory roaming profile instead of
local profiles

-Evan

 

[MPerrault]

You can try to use a third party application app like scriptlogic's
desktop authority.

http://www.scriptlogic.com/products/desktopauthority/

It solves many problems acocited with roaming profiles.

Michael P. Perrault
MCSE, CCNA, A+, MBA
Senior Systems Engineer,
ScriptLogic Corporation

(e-mail address removed)
www.scriptlogic.com