Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We've got arround 25users connecting to our terminal server (remote desktop) - no active directory is used. How can i hide the taskbar from the bottom of the page, not to auto-hide it. i want the users not to be able to use it (except the administrators of course).

Mike

share|improve this question

2 Answers 2

up vote 0 down vote accepted

Follow the instructions that Microsoft has here: http://support.microsoft.com/kb/278295.

I have my TS locked down using their suggestions and haven't had any problems. IMO, the 2 biggest security holes you'll have will be email attachments and if you allow web browsing.

If you do not want them using iexplore.exe, then you can deny access to the executable or have any internet traffic directed to a fake proxy server that doesn't work.

share|improve this answer
    
The poster mentioned they don't have an Active Directory, so the article you referenced, which talks about using Group Policy in AD, won't work click-for-click. They can use the local group policy, as I recommended in my answer, but they'll have to "hack" the permissions on the policy if they don't want it to apply to "Administrators". –  Evan Anderson Jul 20 '10 at 13:31

Without an Active Directory Domain to apply Group Policy from creating policy settings on the Terminal Server computer that apply only to "normal users" but not to "Administrators" is going to be a hack. (You'll have to deny "Administrators" rights to read the "%SystemRoot%\System32\GroupPolicy" folder-- the location where "local group policy" is stored.)

You can probably accomplish what you're looking for by using a different shell (the "Custom user interface" policy, located in the "System" node under "Administrative Templates" under "User Configuration"), but what shell you decide to use is going to be your next problem. There were a proliferation of replacements for "Program Manager", the Windows 3.1 shell, but after Explorer came along in Windows 95 the alternative shell "market" dried up significantly. Do some digging and see what you can come up with.

Personally, I have some disagreement with what you're trying to do. Unless this is a kiosk environment it's probably not really necessary to highly constrain the user interface. My guess is that your users will get their work done and things will go fine w/o requiring massive changes and "locking down" the user interface on the Terminal Server computer. Assuming your users don't have "Administrator" privileges on the Terminal Server computer and you haven't made any sweeping changes to the default security settings (file system, registry ACLs, etc) then the machine is fairly well "armored" against user attack "out of the box".

share|improve this answer
    
i know it's overkill but i had a user opening up an iexplore.exe and downloading "the wrong files" also another user thought he should delete de contents of a folder used by the local running app he had read/write rights to .so it's kind of a must. –  s.mihai Mar 23 '10 at 13:17
    
I think you'll be displeased with fighting a constant battle with users and throwing good support expense after bad. I'd consider those management problems rather than technical problems and throw them in the lap of the user's manager. Still, there's a mechanism that you can attempt to use to resolve this as a technical problem if you so choose. Good luck. –  Evan Anderson Mar 23 '10 at 13:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.