No announcement yet.

desktop lock gpo

  • Filter
  • Time
  • Show
Clear All
new posts

  • desktop lock gpo

    Hey all,
    I'm trying to find any info on Desktop lock.
    I don't want that the user will have any Place to add or delete anything in the computer except adding files to their my doc's folder (redirected to file server)

    Server 2008 r2
    windows xp + 7

    Please advice .



  • #2
    Re: desktop lock gpo

    As far as I know, you can't prevent users from saving things to their desktops, but you can block them from accessing the C: drive at all thru Group Policy. I don't have a domain PC in front of me to take you directly to the settings in question, but the 2 I'm thinking of are in the same place. One reads 'Hide these computers...', which means suppress seeing those drives in Windows Explorer (but users can still create shortcuts on their desktop to the C: drive), and 'Prevent users from accessing...' or words to that effect, which gives the user no manual access to the C: drive, but allows installed programs to work.

    Since you've redirected the users' My Docs folder, why not redirect their Desktop as well? That way, any desktop changes aren't kept locally.
    MSCA (2003/XP), Security+, CCNA

    ** Remember: credit where credit is due, and reputation points as appropriate **


    • #3
      Re: desktop lock gpo

      And if you redirect the desktop to a file server, you can use policies on the server to dictate what if anything can be saved to that folder.
      Gareth Howells

      BSc (Hons), MBCS, MCP, MCDST, ICCE

      Any advice is given in good faith and without warranty.

      Please give reputation points if somebody has helped you.

      "For by now I could have stretched out my hand and struck you and your people with a plague that would have wiped you off the Earth." (Exodus 9:15) - I could kill you with my thumb.

      "Everything that lives and moves will be food for you." (Genesis 9:3) - For every animal you don't eat, I'm going to eat three.


      • #4
        Re: desktop lock gpo

        Just enable the "do not save desktop files on logoff" option and watch the (l)users scream
        Tom Jones
        MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
        PhD, MSc, FIAP, MIITT
        IT Trainer / Consultant
        Ossian Ltd

        ** Remember to give credit where credit is due and leave reputation points where appropriate **