terminal-serverwindowswindows-server-2003
We've got arround 25users connecting to our terminal server (remote desktop) – no active directory is used.
How can i hide the taskbar from the bottom of the page, not to auto-hide it. i want the users not to be able to use it (except the administrators of course).
Mike
two ways i can see
http://www.brianmadden.com/forums/t/19270.aspx
Open the GPO in gpedit.msc and go to:
User Config\Administrative Templates\Windows Components\Microsoft Management Console\ and restrict access to author mode and any MMC snap ins you don't want them to get to.
Be sure that the computer side is in loopback mode if you don't already have a policy on your TS OU that does this:
Computer Config\Administrative Templates\System\Group Policy\User Group Policy Loopback Processing Mode = enabled.
Once the policy is created, it is a good idea to deny apply rights to the administrative staff that supports the server.
OR
the way i do it is to redirect the start menu for all my terminal servers to another location e.g. \SERVER1\USERS\STARTMENU
http://technet.microsoft.com/en-us/library/cc785925(WS.10).aspx
Redirecting the Start Menu folder
Folder Redirection of the Start Menu folder is available in Windows XP, Windows XP 64-Bit Edition, or Windows Server 2003 operating systems. Start Menu redirection is treated differently from other redirected folders in that the contents of the user’s Start Menu are not copied to the redirected location. It is assumed that a redirected Start Menu has been previously created by an administrator and that all users share the same Start Menu. As a best practice for Windows XP–based computers, do not use Folder Redirection to redirect the Start Menu folder; instead, use Group Policy to control what appears on the Start Menu.
Best Answer
Follow the instructions that Microsoft has here: http://support.microsoft.com/kb/278295.
I have my TS locked down using their suggestions and haven't had any problems. IMO, the 2 biggest security holes you'll have will be email attachments and if you allow web browsing.
If you do not want them using iexplore.exe, then you can deny access to the executable or have any internet traffic directed to a fake proxy server that doesn't work.