Re: single start menu, desktop for everyone but administrator

Sorry, I missed that info in your first post.
Yes, that complicates matters.
KB 816100 has a link to this article:

293655 (http://support.microsoft.com/kb/293655/) How to apply local
policies to all users except administrators on Windows 2000 in a
workgroup setting
http://support.microsoft.com/?kbid=293655

but the solution given there is not very practical.
I would try this: use a local policy (with gpedit) to lock down
your server and redirect the desktop to a customized desktop
folder. These settings will apply to everyone.
Create a folder in the customized desktop folder, let's call it
AdminTools, and copy your current start menu and desktop shortcuts
to this folder. Use NTFS permissions to make the folder accessible
for Administrators only.
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?VGVycnk=?= <Terry@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote on 18
okt 2006 in microsoft.public.windows.terminal_services:

Thank you for your reply. Your advice on #3 seems to only apply
to domain groups policies. This is a standalone machine, no
domain involved.

"Vera Noest [MVP]" wrote:

#1 : Use the GPO to redirect users to a custom desktop folder,
in which you put your shortcuts. Make this folder read-only.

#3 : Use security filtering of the GPO.
816100 - How To Prevent Domain Group Policies from Applying to
Administrator Accounts and Selected Users in Windows Server
2003 http://support.microsoft.com/?kbid=816100

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?VGVycnk=?= <Terry@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote on
18 okt 2006 in microsoft.public.windows.terminal_services:

I have a terminal server that I want to do a few things with.
It is not part of AD. There are about 10 users that will
need access to this server. I only want them to be able to
have a couple of icons on the desktop and for them to be able
to use only those applications. So here are my goals:

1) All users have same exact desktop
2) All users have 1 thing in start menu (log off)
3) Administrator settings, desktop, start menu stay unchanged

I have #2 kinda working but it removes everything for the
admins too. I am trying to achieve #2 through the group
policy editor but like I said, its changing EVERYONE's
settings. I am not having any success in #1. Please help.
.

Relevant Pages

  • Re: Send As from Public Folder address fails to external recipients
    ... Try granting their non-administrative account rights to the folder and see ... back-end server was already holding a Public Folder that is mail enabled. ... Administrators were able to send emails as from this public folder's email ...
    (microsoft.public.exchange.admin)
  • Re: 2000 server security
    ... Double check that you are logged onto the server as an administrator. ... can run the command net local administrators to see the group membership ... included in the user right for "take ownership of files or other objects". ... You probably do not have permissions to the folder and need to first take ...
    (microsoft.public.win2000.security)
  • Re: Create profile problem (again)
    ... and in one of the TS servers I need to create the \WINDOWS folder ... One aplication that I installed in the TS server need to use de ... appears the \WINDOWS folder in the user profile. ... local administrators in TS server) profile and the aplication only ...
    (microsoft.public.windows.terminal_services)
  • Re: single start menu, desktop for everyone but administrator
    ... folder" part? ... These settings will apply to everyone. ... for Administrators only. ... MCSE, CCEA, Microsoft MVP - Terminal Server ...
    (microsoft.public.windows.terminal_services)
  • RE: Access Denied when running RSoP
    ... The launch and activation security descriptor for the COM Server application ... It contains Access Control Entries with permissions that are ... which is a part of the McAfee Common ... > Administrators - Full Control - This namespace and subnamespaces ...
    (microsoft.public.windows.server.sbs)