Home page set in GPO; users still seeing “Enhanced Security Configuration is not enabled” warning

Net.exe is the program used to map drives, mess with users, and do other network related tasks. It's usually run in logon scripts to map drives. Check your login scripts on the server that are run through startup, logon registry key, user logon script in AD, and local and domain group policies. You'll likely find something in there that's running amock at logon.

If that yields nothing, use autoruns to see what else is running at logon that may be causing issues. It would probably be benficial to disable everything not Microsoft in the logon tab and only reenable necessary processes 1by1 until you find the issue.

This seems like a pretty silly business requirement. But you're not here looking for opinions. So on to suggestions.

The main problem is that you're essentially trying to give conditional access to the same set of windows domain users. There's really no good way to do what you want. A user either has permissions to a file share or they don't. Like you said, creative use of firewall rules will prevent traffic from the Terminal Server to the File Server. And since you don't want users using files stored in their roaming profile, why not just turn off roaming profiles for this server as well.

The other option that seems like more of a compromise is to use group policy to disable all of the RDP features on the Terminal Server that would normally allow easy data extraction (drive redirection, clipboard redirection, printer redirection, etc.). This still gives people useful access to their network documents, but basically limits the data export capabilities to screen captures on the client side. As long as the data you're trying to protect isn't easily parse-able from a screenshot, you're golden.

Oh, and don't forget to deny Internet access from the Terminal Server as well. There are plenty of places in the cloud to copy data to that users can access without admin rights.