W2K12 Terminal Server: Creating locked down user desktops

randal · 20 Jun 2013 at 15:08

Hello,

I've setup a locked down terminal server that uses a batch file in the user's environment settings to launch an app on login.

It's an X display app on an old legacy HPUX platform so has to work this way, script launches an X server unique to the user's session then does some trickery with variables to SSH into the server and ping the session back.

Anyway, bit by the by.

So there are 4 servers, at the moment these sessions just launch on one. As I need to add more users I need to spread the load across all 4.

What I'm thinking of doing is giving the users a desktop with 4 icons for each of the sessions, and a logout button (batch file with a pretty icon). I don't want to give them start menus or any of that stuff, not needed. The batch script logs them off when they close the app anyway.

So what I'm after is a way to limit users in a particular group to just having the above locked down environment and administrators get the normal login for well, admin stuff.

I know you can do a certain amount of stuff with Group Policy but everything I've tried affects ALL users.

Server is standalone, no domain, local user accounts if that helps.

Cheers in advance!

ubern00b · 20 Jun 2013 at 15:40

You will want to target the GPOs to a security group using security filtering.

Apply GPO to OU, set security filtering to apply only to a specific security group. Ensure users are both in the OU and the security group in order fro the GPO to apply.

randal · 20 Jun 2013 at 16:14

Hello chap,

Thanks for the reply, I've had a nose around but can't find the options you mention. You sure this'll apply to a standalone server not part of a domain? i.e just using local group policy editor?

Cheers again

edit - just answered my own question: "Preference items are only available in domain-based GPOs"

Back to the drawing board...

randal · 20 Jun 2013 at 16:41

Cracked it, for anyone wondering you setup a new GPO Editor that only applies to non-administrative users.

As per here: http://www.sevenforums.com/tutorial...es-apply-all-users-except-administrators.html

ubern00b · 20 Jun 2013 at 19:51

If I had read the whole OP Like a good little boy I would have saved you some hassle, so for that I do apologise.

randal · 20 Jun 2013 at 20:13

Hey no worries man, was a good afternoon learning some new skills. Thanks for the assistance, pointed me in the right direction.