2

We are running a RemoteApp server on 2012 R2 and want to let our users select a border color and font size. Other than that, we don't want them messing around in the control panel.

At first we set "Prohibit access to Control Panel and PC settings" to enable, which did lock down the server... but prevented anybody from personalizing it. If they tried to right-click on the desktop and click Personalize, it would pop up a box that the setting was disabled by an administrator.

So I am now using the following Group Policy settings:

  • Show only specified Control Panel items - enabled (@themecpl.dll,-1 and Microsoft.Display)
  • Hide the Programs Control Panel (enabled)
  • Remove Properties from the Computer icon context menu (enabled)

When I test these three settings in a virtual machine, I am able to open the personalization menu and choose a border color.

However, when I try it in our actual RemoteApp environment, this is what I see:

enter image description here

The color picker is mysteriously absent. Changing the font size DOES work, as intended. What's odd is that we're using a loopback policy - and if I am added to the Administrators group (who doesn't get the policy), not only do I have complete unrestricted access to the control panel but the color picker actually shows up.

I am confused why the settings worked in a virtual machine but not in our actual environment. Does anyone have any ideas?

4
  • What happens if you use the canonical name for the control panel instead of @themecpl.dll,-1?
    – Greg Askew
    Aug 11, 2015 at 14:11
  • I suspect that you need Desktop Experience in order to support this. Aug 11, 2015 at 17:42
  • We have it already. Otherwise that menu never would have come up at all when I was excluded from the loopback policies. Aug 11, 2015 at 20:48
  • Alright, so I tried using the canonical name of Microsoft.Display and that didn't seem to help. Aug 13, 2015 at 15:26

0

You must log in to answer this question.

Browse other questions tagged .