Disallowing user right to edit various settings

Question

I'm going to be installing windows 2008 server R2 and running desktop applications (MS Office, Autocad) for novice users (3).

I want to disallow following things

• ability to change outlook, firefox etc settings
• ability to change network settings, time setting, printer etc
• ability to change any setting that maybe done from control panel
• ability to install new software
• ability to edit registry
• Anything else?

How can I do this?

I've a vague understanding that I need to learn to edit group policy but i'm not sure if it can cover all above points.

Incase group policy can help with all of the above - please suggest a simple/good book to learn about it.

TIA

Answer 1

I'm not sure if this is the answer you're looking for, but here goes: Pretty much anything Windows related (i.e. network settings, time settings, printer, registry, software installation) you can lock down. Most of the Microsoft software will also have group policy templates (like Office) that will allow you to lock down or pre-define most settings.

Things like Firefox and 3rd party software you will not be able to do anything about.

As far as editing group policy, it's actually pretty straight forward; just fire up the group policy management console and start digging through the [tons of] settings. Most settings will have descriptions that tell you exactly what they do and often what the individual options are.

For things like office, you will need an "Administrative Template" and you can just google around for stuff like that and find it pretty easy. Sorry, I don't know of any books to recommend.

EDIT: I would also point out that jscott's comment is a good suggestion too.

Answer 2

Wow, this could be a pretty daunting task and there's certainly a lot of ground to cover. I don't have the time or energy to go through everything but here are some basic suggestions to get you started:

1. Make sure to add the Microsoft Office ADM or ADMX templates for your version of Office to your GPO.

2. Move all of the Terminal Servers into their own OU.

3. Move all of the Terminal Server users into their own OU or use loopback policy processing.

4. Create specific GPO's for the Terminal Server and for the TS users and link them to the OU's described above.

5. Use security filtering on the TS GPO and the TS user GPO's to make sure that the GPO's only apply to the TS and the TS users (this is somewhat redundant if you move the TS and the TS users to their own OU's).

6. Edit the TS and TS user GPO's to reflect the settings you want. The list of items to review and edit are too long to post here so my suggestion is to go through the settings one by one and configure the ones that you think are relevant.

7. Make use of Software Restriction Policies to "whitelist" the applications that users are allowed to run.

Answer 3

The answers above are correct, I just wanted to add that some non-Microsoft applications do have GPOs that you can use. In particular, Frontmotion makes available builds of Firefox that are able to use a Frontmotion-Provided GPO ( http://www.frontmotion.com/Firefox/ ). It works quite well in my experience.