RE: Group Policy Local drives

Tech-Archive recommends: Speed Up your PC by fixing your registry

Thanks for your response but one thing comes to mind. The terminal server
needs to be locked down to the point that users can't hardly change anything.
If I add the user to a group and when they log into there normal computer,
then this policy will apply to them. Is this correct? The users can have
full access (power user permissions) to there normal desktop just not on the
Terminal Server. In fact, they use the same credentials for both. Will this
conflict with each other?

Thanks again.

"bsweeney1977" wrote:

Sure. You could use diametric policies and security filtering...

1. Create a GPO that configures RDP for your regular computer users. We'll
call it "RDPForWorkstationUsers"

2. Create a security group called "WorkstationUsers".

3. Using the GPMC, configure security filtering for the GPO so that the
policy only applies to users in the "WorkstationUsers" security group.

4. Create a GPO that configures RDP for your regular computer users. We'll
call it "RDPForCDUsers"

5. Create a security group called "CDUsers".

6. Using the GPMC, configure security filtering for the GPO so that the
policy only applies to users in the "WorkstationUsers" security group.

7. Add each user to the appropriate group.

There, you're done. When members of the "WorkstationUsers" group sign in,
they will be affected by the "RDPForWorkstationUsers" policy, and when
members of the "CDUsers" group sign in then they will be affected by the
"RDPForCDUsers" policy.

NOTE 1: Keep in mind that if a user is not a part of either group then
neither policy will apply.

NOTE 2: If a user is part of both groups then its a roll of the dice, since
whichever policy is processed LAST will be the policy used. You can get
around this by picking one of the two policies in the GPMC and setting it to
ENFORCE. This forces the policy to be processed LAST.

Hope this helps.

"Daniel" wrote:

Ok, here is my problem.

We have users who log into a terminal server to do there normal daily
duties. We have two ways of people logging into the terminal server. One
way being the user logs into there normal desktop and then double clicking
the shortcut for remote desktop. The other way is a user booting from a CD
that I have put together. These computers do NOT have hard drives in them
which means "no local drive access".
With the computers that double click on the Remote Desktop icon, I want them
to be able to use their local disk drives. As you check local disk drives
under the options in Remote Desktop settings, this setting does not work
since I have block access using group policy because of my " CD " users.

Is there a way two have users who are using the Remote Desktop shortcut to
use their local disk drives and still be able to prevent users from accessing
the Servers local disk drives?
.

Relevant Pages

  • Re: Applying GP to terminal server sessions
    ... i have a policy i want to apply to that server if i am logged on at the console. ... But if i am logged on to a terminal server session i do not want it to apply. ... If Policy is only intended for a dedicated user group you should create a security group and assign the GPO under the Security Settings. ...
    (microsoft.public.windows.terminal_services)
  • Re: No Clock for TS users
    ... in GPO or do these users need to be added to a Security Group, ... like you are saying this is in our Gpo. ... > MCSE, CCEA, Microsoft MVP - Terminal Server ... >> I don't know if this is a policy issue or a security issue, ...
    (microsoft.public.windows.terminal_services)
  • Re: Problem logging onto TS via RWW
    ... locally" and "Allow log on through Terminal Services" on the local Security ... Policy on the terminal server box as I requested in my previous post. ... Remote Desktop Users Group. ...
    (microsoft.public.windows.server.sbs)
  • Re: GPO testing
    ... Here are the steps I used to create and link the GPO: ... Placed two users in the security group Test Group. ... Right clicked on the new policy called "test" and selected edit. ... Test Group on my XP workstation. ...
    (microsoft.public.windows.group_policy)
  • Re: Creating Additional SMTP emails in Exchange
    ... Instead I added the users to the Security Group Domain B ... first and then apply the policy. ... Primary SMTP as well as the default domain. ... Les Connor [SBS Community Member - SBS MVP] ...
    (microsoft.public.windows.server.sbs)