GPO - New Server, Trying to Get it Right

Tech-Archive recommends: Fix windows errors by optimizing your registry

Hi!

Installed a new server for a small company (big investment for them!)
converting them from a workgroup to a domain in 2003 SP1. Now that they are
in a domain, they have asked to fix a few issues:

1. All users are local administrators. They all run AutoDesk 2005/2006
which requires they have admin privileges on the workstation. I know there
are ways to give them so called admin rights without really making them
admins.
2. The other reason I would like to remove them as admins is they download
crud to their computers (music players, toolbars, stuff they don't even know
about). I would like to block by user any streaming file, download file,
running executables, saving or copying mp3's, video files and other similar
files, etc.
3. I would also like to restrict them from access to the registry, My Docs
(need to use their "U" drive for backup), the Windows folder, certain
desktop settings (no image file backgrounds, etc.) and other settings that
would normally be disallowed as a Limited user.

I wouldn't try to be so restrictive, but Autodesk is a huge program and they
complain about how slow the program is and when I look at the computer, they
have so much junk going in the background, it is killing needed resources
for their drawing files. Management has begged them to stop sharing folders
and copying music, downloading programs, etc, but they don't listen, so they
have asked me to research ways to block it via group policy. Some of the
files are 100MB or larger and the application itself takes up about 2GB of
drive space.

Any help, links, etc. would be greatly appreciated. I have tried to
research this and only find bits and pieces or info assuming you have
already setup other policies I don't have configured.

Thanks!


.

Relevant Pages

  • RE: Cannot download windows update
    ... not found access denied.Am not sure if i got the Admin ... privilege that your saying but in the user account am logged on as the ... I can browse the internet but not download. ... install and install. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Windows Genuine Advantage (KB892130) Failed in Windows Update
    ... Thanks for the suggestion .....though I logged in as an admin but I ... I then ran the file using an account that had admin rights. ... but when i completed the download I tested teh windows update ...
    (microsoft.public.windowsupdate)
  • Admin account vs personal/limited account in win xp
    ... I was logged onto my account as userX, when I decided to download the latest ... version of Netscape 7.2 (NSSetup-Full). ... I logged in as admin, and I see the same directory structure as if I would ...
    (microsoft.public.windowsxp.setup_deployment)
  • Re: Windows 2003 security issue
    ... is it because of that particular file or website that I ... As it is, I can't download from any site, even ... >> enhanced security try uninstalling it for users and administrators if you ... >>> (with admin rights). ...
    (microsoft.public.windows.server.security)
  • Re: mandatory profiles
    ... do I log on to the local machine as an admin and set up ... the desktop settings or do I log into the domain as an admin and set the ... machine has a local color printer ... machine has a local scanner ...
    (microsoft.public.windows.server.active_directory)