User Policy for Citrix

[Brian]

I'm trying to use Group policies for our Citrix Server (Metaframe XP on
Win2k Server) to protect users from themselves. I want to remove things like
the ability to shutdown the server, access the control panel, etc.
I'm trying to apply these policies to just this one machine, and only to
certain users. I don't want to restrict the local Admin account or Domain
Admins, just the users. These users also have regular desktop machines that
I don't want to restrict, so I can't just apply the group policy to the user
account's OU. I'm sure there has to be a fairly simple way to do this,
right? I was trying to avoid roaming profiles and the like, and keep it all
in policy settings. Is there a way to do what I'm trying to do?

Thanks,
Brian

 

[Buz [MSFT]]

Use Loopback Policy Processing:

231287 Loopback Processing of Group Policy
http://support.microsoft.com/?id=231287

260370 How to Apply Group Policy Objects to Terminal Services Servers
http://support.microsoft.com/?id=260370

278295 How to Lock Down a Windows 2000 Terminal Server Session
http://support.microsoft.com/?id=278295

198771 How to Lock Down Windows NT and Internet Explorer 4.01 Desktop
http://support.microsoft.com/?id=198771

143164 INF: How to Protect Windows NT Desktops in Public Areas
http://support.microsoft.com/?id=143164

Buz Brodin
MCSE NT4 / Win2K
Microsoft Enterprise Domain Support

Get Secure! - www.microsoft.com/security

This posting is provided "as is" with no warranties and confers no rights.

Please do not send e-mail directly to this alias. This alias is for
newsgroup purposes only.

 

[Brian]

Cool. Loopback will solve half of the equation, but I'm still in the same
boat as if I edited the local policy of the server. How do I make it so
certain users (local admin, domain admins) are exempt from the policy
restrictions? I don't want to lock it down and then not be able to perform
administrative tasks on it.

Thanks,
Brian

 

[Buz [MSFT]]

Edit the security permissions of the Group Policy Object you created. Give
Domain Admins "Deny" for Apply Group policy"

Buz Brodin
MCSE NT4 / Win2K
Microsoft Enterprise Domain Support

Get Secure! - www.microsoft.com/security

This posting is provided "as is" with no warranties and confers no rights.

Please do not send e-mail directly to this alias. This alias is for
newsgroup purposes only.