Re: 2003 Terminal Server Profiles How too..
- From: "Vera Noest [MVP]" <vera.noest@xxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Tue, 24 Oct 2006 13:01:34 -0700
Note: deleted microsoft.public.windowsnt.terminalserver.setup from
the list of ngs, since it's going extinct.
That depends on settings in your AD. You can force an update with
the gpupdate command.
But there can also be a problem with the command line, like a space
or a wrong path. Exactly *what* did you enter in the setting?
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___
=?Utf-8?B?QXJuZWw=?= <Arnel@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote on 24
okt 2006 in microsoft.public.windows.terminal_services:
Hi,.
These are the steps I'm testing now.
1. I created a new OU.
2. I moved the Terminal Server Computer object into the OU.
3. I created a GPO for the OU and made the changes to
Computer Configuration - Administrative templates - Windows
Components - Terminal Services
"Start a program on connection"
4. I did the Loopback processing of Group Policy.
5. I added Administrator group to security and denied allow
group policy setting.
6. When I logon as test user not admin it does not start the
program I want automatically and I see the desktop.
If I go to the environment tab and put the program to start and
then logon to Terminal Server it starts the program i want
automatically. How long does it take for the GPO to update?
"Vera Noest [MVP]" wrote:
Sure.
Computer Configuration - Administrative templates - Windows
Components - Terminal Services
"Start a program on connection"
The same setting can also be found under User Configuration.
If both settings are configured, the Computer Configuration
setting overrides.
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___
=?Utf-8?B?QXJuZWw=?= <Arnel@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote on
24 okt 2006 in microsoft.public.windows.terminal_services:
Vera,
Is there a way to setup a single program to start
automatically for users through a GPO? I know I can set it
under the environment tab of the users properties but would
like to just make a GPO that will do it and put the users in
the OU.
Thanks!
"Vera Noest [MVP]" wrote:
OK, your steps 1 - 6 look fine, assuming that you put the
Terminal Server machine account in the separate OU which you
created, and that the test user account was created in a
different OU. Reason for the above is that you will probably
want to lock down user's environment when they logon to the
Terminal Server, but *not* when they logon to their
workstation.
7. Create a lockdown-TS GPO, link it to the OU in which the
TS machine account is located and configure the GPO to use
"loopback processing" with the "Replace" option (see KB
231287) http://support.microsoft.com/?kbid=231287
Then use Folder redirection to redirect the Desktop folder
for all users to a custom desktop folder, let's say
\\server\Custom_Folders\Desktop
Put a shortcut to the proprietary software in this custom
desktop folder, and make the folder Read-Only.
remove all unwanted shortcuts from the All Users\Desktop
folder on the terminal Server.
Do the same for the Start menu (redirect to custom folder,
empty All Users Start Menu
Settings are found in:
User Configuration - Windows Settings - Folder Redirection
Application Data
Desktop
My Documents
Start Menu
Check this article for a list of other policy settings which
are commonly used to lockdown a TS.
Warning: don't implement them all at once. If the result is
not what you want, you can have a hard time finding which
settings must be changed.
278295 - How to lock down a Windows Server 2003 or Windows
2000 Terminal Server session
http://support.microsoft.com/?kbid=278295
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___
=?Utf-8?B?QXJuZWw=?= <Arnel@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote
on 20 okt 2006 in
microsoft.public.windows.terminal_services:
Vera,
Thanks for the reply. This is what I have done so far.
1. I created a seperate OU.
2. I created a test user.
3. I created a shared folder on a second partition of the
server for the TS profiles.
4. Within the test user under Terminal Services Profile
tab I put profile path of
\\servername\tsprofiles\%username% 5. I then logon to the
Terminal Server with the test user account and logoff.
6. After logoff I check the TS profile path
for user and it creates the profile and has desktop, my
documents, favorites, etc. Just like it would if it was on
c:\documents and settings\etc.
7. I tried to create a test GPO
policy to lock down the Terminal Server profile. All I
need is 2 icons on the desktop Outlook, and an icon for a
proprietary software. Also, just the logoff or disconnect
option everything else not visible.
8. Need local printers on person logging in using Remote
Desktop to be the default.
9. Once that is achieved I will need other users to be
able to use or have the same profile as the test one.
What would be the best way to do this? Can you help me? Am
I going about it all wrong? The Terminal Server is already
activated, TS licenses installed, Applications installed
using /install mode then switched back to /execute mode.
Thanks!
"Vera Noest [MVP]" wrote:
There are 2 different profile paths in the AD account
properties, one for the normal workstation logon, and a
TS-specific profile. Have you used these settings?
246132 - User Profile and Home Directory Behavior with
Terminal Services
http://support.microsoft.com/?kbid=246132
You will need to specify your problems in more detail, if
you need more help.
"I tried with no luck" doesn't tell us what you tried,
nor in which way it failed. Please post exact text of any
error messages + EventID and Source of any warnings and
errors in the EventLog.
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
*----------- Please reply in newsgroup -------------*
=?Utf-8?B?QXJuZWw=?= <Arnel@xxxxxxxxxxxxxxxxxxxxxxxxx>
wrote on 19 okt 2006:
Is there a how to or kb article for setting up 1 or
more mandatory profiles in 2003 Terminal Server?
What I am trying to achieve is that I have multiple
users that still will logon to their own computers and
connect to our domain. And I'm in the process of
setting up a Terminal Server so some of those same
users will be need to be able to use the Terminal
Server for only specified apps through remote desktop.
How do I keep their domain logon and Terminal Server
profile seperate? I tried to create a roaming profile
and also tried to use group policy with no luck.
Can anyone point me in the right direction? I've never
done it before.
Thanks!
- Prev by Date: Re: Printing
- Next by Date: Re: Bad translation in portuguese W2K3 R2
- Previous by thread: Disabling RDP in Terminal Services?
- Next by thread: Re: TS CAL Utilization Question
- Index(es):
Relevant Pages
|
Loading
