GPO / Registry Help

garyh · 25 Jan 2007 at 21:11

Hi

I'm just wondering if anybody knows how to disable the ability to delete / rename / add items to the desktop in an Active Directory environment either using Group Policy or a registry hack... I've looked everywhere but I can't seem to find the right settings to enable this correctly.. the desktops are not running Active Desktop btw.

Many thanks in advance.

rob5ta · 25 Jan 2007 at 21:18

I created a desktop GPO at work last year, and i did manage to do this, however my mind has gone blank at the moment. I will have a look at the GPO tomorrow and post the solution. It is fairly simple from what i can remember. I think it was something along the lines of pointing the user desktop environment within the GPO to a read only directory. This prevented any desktop modification by the user.....

oddjob62 · 25 Jan 2007 at 21:32

rob5ta said:
I created a desktop GPO at work last year, and i did manage to do this, however my mind has gone blank at the moment. I will have a look at the GPO tomorrow and post the solution. It is fairly simple from what i can remember. I think it was something along the lines of pointing the user desktop environment within the GPO to a read only directory. This prevented any desktop modification by the user.....

Yeah you can do folder redirection to redirect the desktop to a server share.

User Configuration -> Windows Settings -> Folder Redirection

rob5ta · 25 Jan 2007 at 22:01

oddjob62 said:
Yeah you can do folder redirection to redirect the desktop to a server share.

User Configuration -> Windows Settings -> Folder Redirection

Yeah cheers oddjob, thats the one!!

garyh, just do as oddjob pointed out - create a read only directory on a server share and redirect the desktop location. Voila, they should get an access denied message when they try to save/modify anything on their desktop. Simple as that