Prevent documents on Desktop

[TheDragon]

I have a domain containing profiles for users. They are constantly saving
documents to their desktops, resulting in silly sized profiles. I want to
force them to save them on their network drive (Home Folder). Is there a way
to prevent word/access/powerpoints being saved to the desktop. Using group
policy.
Server is Windows 2000 Server SP4. Clients are Win 2k SP4.

I don't want mandatory profiles, as they are allowed to customize the
desktops to their hearts desire, just not save documents on it

 

[Lanwench [MVP - Exchange]]

I have a domain containing profiles for users. They are constantly
saving documents to their desktops, resulting in silly sized
profiles. I want to force them to save them on their network drive
(Home Folder). Is there a way to prevent word/access/powerpoints
being saved to the desktop. Using group policy.
Server is Windows 2000 Server SP4. Clients are Win 2k SP4.

I don't want mandatory profiles, as they are allowed to customize the
desktops to their hearts desire, just not save documents on it

You could use a policy to redirect the desktop to the server - not sure how
granularly you can customize permissions to specify *what* they can store on
the desktop. Did you try m.p.windows.group_policy?

Are you redirecting My Documents to a subfolder of the user's home
directory? If not, do....

 

[Steven L Umbach]

Not that I know of. If you want to allow them to customize their desktop
then they will be able to save files to their desktop folder also which you
could otherwise change permissions on to be read/list/execute. You might
want to look into assigning disk quotas to the users on their computer which
will limit the amount of files they can store based on file ownership. That
can be managed via Group Policy. You would also want to train them to clear
their temporary internet files on a regular basis if you implement disk
quotas. Another possibility is a Group Policy logoff script that copies
those files, based on extension, to their home folder and then deletes then
from the desktop folder. I am not great at scripting, so if you are
interested in such you may want to post in a scripting newsgroup and test
thoroughly before implementing. Redirecting folders including desktop may
be another option. --- Steve

http://support.microsoft.com/kb/183322/EN-US/ --- disk quotas.
http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prde_ffs_cmob.asp
http://tinyurl.com/4katn -- redirect folders including user's desktop.

 

[TheDragon]

Yes we are redirecting the Mydocuments to their server share. So they have a
U: drive which is exactly the same as My Documents. However people insist on
ignoring these folders and creating a folder on their desktop to store stuff
in.

 

[Laura A. Robinson]

circa Fri, 3 Dec 2004 18:35:36 -0000, in
microsoft.public.win2000.security, TheDragon ([email protected])
said,

Yes we are redirecting the Mydocuments to their server share. So they have a
U: drive which is exactly the same as My Documents. However people insist on
ignoring these folders and creating a folder on their desktop to store stuff
in.

You can also use folder redirection for users' desktops; you may want
to consider doing so rather than trying to break your users of their
[bad] habits. <G> Alternately, you can redirect the desktops and make
them read-only, but this opens up a host of user support issues that
you may not want to tackle.

Laura

 

[Roger Abell]

Steve really said the key thing here.
If you want to let them customize the desktop, but just
not store files there, then you have conflicting objectives.
Both require a grant of write for the desktop, and grants
are not sensitive to what is being written.
You can have one or the other - no changes to the desktop
or any changes to the desktop. Otherwise you need to get
inventive (like the script that deletes after copying, etc.).

 

[TheDragon]

Yes I may have to redirect the desktop to a folder inside their U drive.
Then set a GP key to delete local cached copies of profiles, this should do
the job.

 

[TheDragon]

I will also look at making the desktop read only, this wont affect the
roaming profile running correctly will it?

I take to make the desktop readonly I just use NTFS permissions on the
server copy of the profiles\%username%\desktop folder?

 

[Laura A. Robinson]

circa Sat, 4 Dec 2004 11:54:45 -0000, in
microsoft.public.win2000.security, TheDragon ([email protected])
said,

I will also look at making the desktop read only, this wont affect the
roaming profile running correctly will it?

I take to make the desktop readonly I just use NTFS permissions on the
server copy of the profiles\%username%\desktop folder?

Correct. However, you're likely to get a whole lot of support calls
from your users wanting to know why they can't save things on their
desktops, so some user education is probably in order.

Laura

 

[TheDragon]

Tried the education persuasion route, to no avail. Some profiles are in the
hundreds of megs, all because of documents and other items that shouldn't be
on the desktop.

 

[Roger Abell]

?? An automated task on the server that finds anything
greater than X kb and moves it to their home storage ??

A few bouts of "where did that go?" might educate them
in their initial storage location choices.

 

[TheDragon]

Thought of that store in a safe place, delete from desktop, wait for the
tears then give back with a stern warning.

 

[Guest]

We're using a combination of redirected files and setting the default file
location in the application (Office). It doesn't prevent users from purposely
saving to the desktop, but as all of thier office applications default opens
and saves in thier user folder on the server, they're more likely to keep
their files there, and do.

I'm not sure about using a batch file on log off. It would seem to me that
doing so would cause issues with document history. I'd have to test it to be
sure, though.