Lockdown Terminal Services Server 2008 in 2003 domain.

[Kent]

We already have our users/workstations locked down well. No CMD prompt, no
registry editing, no windows explorer, local drives hidden etc... It works
really well. We can't get this to translate into our 2008 ts sessions.
Everything is open.

Any ideas? I thought loopback was the answer but can't seem to get that
working. Is there a 2008 template that needs to be loaded into the 2003 DC?

Thanks in advance.
Kent

 

[Lanwench [MVP - Exchange]]

Re: Lockdown Terminal Services Server 2008 in 2003 domain.

Kent <Kent@discussions.microsoft.com> wrote:
> We already have our users/workstations locked down well. No CMD
> prompt, no registry editing, no windows explorer, local drives hidden
> etc... It works really well. We can't get this to translate into
> our 2008 ts sessions. Everything is open.
>
> Any ideas? I thought loopback was the answer but can't seem to get
> that working. Is there a 2008 template that needs to be loaded into
> the 2003 DC?
>
> Thanks in advance.
> Kent

There are new templates, but I don't know that you have to use them (someone
else may correct me). Posting in microsoft.public.windows.group_policy may
help. How did you set up loopback processing, and where/how is that policy
being linked/applied? I presume this is a separate policy, not the same one
you're using for your desktops.

 

[Jeff Pitsch]

Re: Lockdown Terminal Services Server 2008 in 2003 domain.

Create new GPO's from a Win2k8 or Vista box. I'm not sure if the ADM's
are available for download separately but configuring them from the
appropriate boxes will do what's needed. No need to load anything on
the Win2k3 servers at all.

Jeff Pitsch
Microsoft MVP - Terminal Services

Kent wrote:
> We already have our users/workstations locked down well. No CMD prompt, no
> registry editing, no windows explorer, local drives hidden etc... It works
> really well. We can't get this to translate into our 2008 ts sessions.
> Everything is open.
>
> Any ideas? I thought loopback was the answer but can't seem to get that
> working. Is there a 2008 template that needs to be loaded into the 2003 DC?
>
> Thanks in advance.
> Kent