Write access to desktop

[James]

w2k3 domain
xp pro workstations

How can I globally deny write access to the desktop, I don't want users to
create files on the desktop

 

[Steven L Umbach]

You should be able to do that with a Group Policy logon script and using the
cacls or xcacls command with the %username% variable to their profile folder
desktop folder under documents and settings. You want to give them only read
or read/execute permisisons to their desktop folder. They still would be the
owner and determined users may be able to figure that out and change
permissions back. There are also tools such as fileacl that can change
ownership on a folder. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;198642 --- Group
Policy startup scripts.