Creating a custom Start Menu on Win2003 TS

[Sandy Wood]

I'm working through creating a custom Start Menu for my Win2003 TS users. I
copied some shortcuts to a folder on the TS, on D:\custommenu. I'm looking to
create a Group Policy to redirect the Start Menu folders. I've experimented
with the various options in Folder Redirection and can't settle on what's
suitable for my situation. All my TS users will be using local polices, no
roaming. I'd like them to see my custom Start Menu and would like the policy
not to apply to Domain Admins. I thought I could apply the Deny options for
Admins in the Delegation tab of the policy so Admins would see the default
menu. Does this look like it will work?
--
Sandy Wood
Orange County District Attorney

 

[Vera Noest [MVP]]

Re: Creating a custom Start Menu on Win2003 TS

Yes, that's the way to go. "Deny" the right to "Apply this policy"
for admins, so that you will still be able to edit the policy. Link
the GPO to the OU containing the TS server account, and use loopback
processing of the GPO with the "replace" setting.

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?U2FuZHkgV29vZA==?= <sandy.wood@nospam.com> wrote on 04
okt 2008 in microsoft.public.windows.terminal_services:

> I'm working through creating a custom Start Menu for my Win2003
> TS users. I copied some shortcuts to a folder on the TS, on
> D:\custommenu. I'm looking to create a Group Policy to redirect
> the Start Menu folders. I've experimented with the various
> options in Folder Redirection and can't settle on what's
> suitable for my situation. All my TS users will be using local
> polices, no roaming. I'd like them to see my custom Start Menu
> and would like the policy not to apply to Domain Admins. I
> thought I could apply the Deny options for Admins in the
> Delegation tab of the policy so Admins would see the default
> menu. Does this look like it will work?

 

[Jeff Pitsch]

Re: Creating a custom Start Menu on Win2003 TS

These may help you as well:

http://www.dabcc.com/blogs/jeff/pos...-a-Single-Customized-Start-Menu-for-All-Users

http://www.dabcc.com/blogs/jeff/pos...oup-Policy-in-a-Terminal-Services-Environment

Vera Noest [MVP] wrote:
> Yes, that's the way to go. "Deny" the right to "Apply this policy"
> for admins, so that you will still be able to edit the policy. Link
> the GPO to the OU containing the TS server account, and use loopback
> processing of the GPO with the "replace" setting.
>
> _________________________________________________________
> Vera Noest
> MCSE, CCEA, Microsoft MVP - Terminal Server
> TS troubleshooting: http://ts.veranoest.net
> ___ please respond in newsgroup, NOT by private email ___
>
> =?Utf-8?B?U2FuZHkgV29vZA==?= <sandy.wood@nospam.com> wrote on 04
> okt 2008 in microsoft.public.windows.terminal_services:
>
>> I'm working through creating a custom Start Menu for my Win2003
>> TS users. I copied some shortcuts to a folder on the TS, on
>> D:\custommenu. I'm looking to create a Group Policy to redirect
>> the Start Menu folders. I've experimented with the various
>> options in Folder Redirection and can't settle on what's
>> suitable for my situation. All my TS users will be using local
>> polices, no roaming. I'd like them to see my custom Start Menu
>> and would like the policy not to apply to Domain Admins. I
>> thought I could apply the Deny options for Admins in the
>> Delegation tab of the policy so Admins would see the default
>> menu. Does this look like it will work?
>

 

[Sandy Wood]

Re: Creating a custom Start Menu on Win2003 TS

Thanks for the links: they help to clarify things.
--
Sandy Wood
Orange County District Attorney


"Jeff Pitsch" wrote:

> These may help you as well:
>
> http://www.dabcc.com/blogs/jeff/pos...-a-Single-Customized-Start-Menu-for-All-Users
>
> http://www.dabcc.com/blogs/jeff/pos...oup-Policy-in-a-Terminal-Services-Environment
>
> Vera Noest [MVP] wrote:
> > Yes, that's the way to go. "Deny" the right to "Apply this policy"
> > for admins, so that you will still be able to edit the policy. Link
> > the GPO to the OU containing the TS server account, and use loopback
> > processing of the GPO with the "replace" setting.
> >
> > _________________________________________________________
> > Vera Noest
> > MCSE, CCEA, Microsoft MVP - Terminal Server
> > TS troubleshooting: http://ts.veranoest.net
> > ___ please respond in newsgroup, NOT by private email ___
> >
> > =?Utf-8?B?U2FuZHkgV29vZA==?= <sandy.wood@nospam.com> wrote on 04
> > okt 2008 in microsoft.public.windows.terminal_services:
> >
> >> I'm working through creating a custom Start Menu for my Win2003
> >> TS users. I copied some shortcuts to a folder on the TS, on
> >> D:\custommenu. I'm looking to create a Group Policy to redirect
> >> the Start Menu folders. I've experimented with the various
> >> options in Folder Redirection and can't settle on what's
> >> suitable for my situation. All my TS users will be using local
> >> polices, no roaming. I'd like them to see my custom Start Menu
> >> and would like the policy not to apply to Domain Admins. I
> >> thought I could apply the Deny options for Admins in the
> >> Delegation tab of the policy so Admins would see the default
> >> menu. Does this look like it will work?
> >
>

 

[Sandy Wood]

Re: Creating a custom Start Menu on Win2003 TS

Thanks for the note. I do have loopback processing set also but I'm a bit
unclear on which Folder Redirection / Start Menu settings would be proper in
my case.

I'd like to have a custom start menu for all users (except Admins, via the
Deny on the apply policy).

I thought I'd choose "Basic - Redirect everyone's folder to the same
location" and "Redirect to to the following location". As for the Root Path
setting, do I need to create a share for this or can I use something like
D:\newmenu? Finally, should I leave the Settings tab at default?
--
Sandy Wood
Orange County District Attorney


"Vera Noest [MVP]" wrote:

> Yes, that's the way to go. "Deny" the right to "Apply this policy"
> for admins, so that you will still be able to edit the policy. Link
> the GPO to the OU containing the TS server account, and use loopback
> processing of the GPO with the "replace" setting.
>
> _________________________________________________________
> Vera Noest
> MCSE, CCEA, Microsoft MVP - Terminal Server
> TS troubleshooting: http://ts.veranoest.net
> ___ please respond in newsgroup, NOT by private email ___
>
> =?Utf-8?B?U2FuZHkgV29vZA==?= <sandy.wood@nospam.com> wrote on 04
> okt 2008 in microsoft.public.windows.terminal_services:
>
> > I'm working through creating a custom Start Menu for my Win2003
> > TS users. I copied some shortcuts to a folder on the TS, on
> > D:\custommenu. I'm looking to create a Group Policy to redirect
> > the Start Menu folders. I've experimented with the various
> > options in Folder Redirection and can't settle on what's
> > suitable for my situation. All my TS users will be using local
> > polices, no roaming. I'd like them to see my custom Start Menu
> > and would like the policy not to apply to Domain Admins. I
> > thought I could apply the Deny options for Admins in the
> > Delegation tab of the policy so Admins would see the default
> > menu. Does this look like it will work?
>
>

 

[Sandy Wood]

Re: Creating a custom Start Menu on Win2003 TS

One other question I forgot to throw in the mix. I've always created two GPOs
for my Terminal Servers, one for the Computer one for Users and then applied
them both to my TS OU in AD. I also disabled the Comptuer Configuration in
the User GPO and disabled the User Configuration in the Computer GPO. I did
this because I've always done it, now I'm wondering if it's even necessary.
Finally, I've enabled loopback processing on the Computer-only GPO but not
the User-only GPO. Do both GPOs need to have loopback processing enabled to
work correctly?
--
Sandy Wood
Orange County District Attorney


"Vera Noest [MVP]" wrote:

> Yes, that's the way to go. "Deny" the right to "Apply this policy"
> for admins, so that you will still be able to edit the policy. Link
> the GPO to the OU containing the TS server account, and use loopback
> processing of the GPO with the "replace" setting.
>
> _________________________________________________________
> Vera Noest
> MCSE, CCEA, Microsoft MVP - Terminal Server
> TS troubleshooting: http://ts.veranoest.net
> ___ please respond in newsgroup, NOT by private email ___
>
> =?Utf-8?B?U2FuZHkgV29vZA==?= <sandy.wood@nospam.com> wrote on 04
> okt 2008 in microsoft.public.windows.terminal_services:
>
> > I'm working through creating a custom Start Menu for my Win2003
> > TS users. I copied some shortcuts to a folder on the TS, on
> > D:\custommenu. I'm looking to create a Group Policy to redirect
> > the Start Menu folders. I've experimented with the various
> > options in Folder Redirection and can't settle on what's
> > suitable for my situation. All my TS users will be using local
> > polices, no roaming. I'd like them to see my custom Start Menu
> > and would like the policy not to apply to Domain Admins. I
> > thought I could apply the Deny options for Admins in the
> > Delegation tab of the policy so Admins would see the default
> > menu. Does this look like it will work?
>
>

 

[Jeff Pitsch]

Re: Creating a custom Start Menu on Win2003 TS

Only the computer GPO needs the loopback processing.

Jeff Pitsch
Microsoft MVP - Terminal Services

Sandy Wood wrote:
> One other question I forgot to throw in the mix. I've always created two GPOs
> for my Terminal Servers, one for the Computer one for Users and then applied
> them both to my TS OU in AD. I also disabled the Comptuer Configuration in
> the User GPO and disabled the User Configuration in the Computer GPO. I did
> this because I've always done it, now I'm wondering if it's even necessary.
> Finally, I've enabled loopback processing on the Computer-only GPO but not
> the User-only GPO. Do both GPOs need to have loopback processing enabled to
> work correctly?

 

[Sandy Wood]

Re: Creating a custom Start Menu on Win2003 TS

OK, thanks. I have read that some users create a Computer GPO, a User GPO and
then a separate Loopback GPO and then target them at the Terminal Server OU.
Wouldn't that serve the same purpose?
--
Sandy Wood
Orange County District Attorney


"Jeff Pitsch" wrote:

> Only the computer GPO needs the loopback processing.
>
> Jeff Pitsch
> Microsoft MVP - Terminal Services
>
> Sandy Wood wrote:
> > One other question I forgot to throw in the mix. I've always created two GPOs
> > for my Terminal Servers, one for the Computer one for Users and then applied
> > them both to my TS OU in AD. I also disabled the Comptuer Configuration in
> > the User GPO and disabled the User Configuration in the Computer GPO. I did
> > this because I've always done it, now I'm wondering if it's even necessary.
> > Finally, I've enabled loopback processing on the Computer-only GPO but not
> > the User-only GPO. Do both GPOs need to have loopback processing enabled to
> > work correctly?
>

 

[Vera Noest [MVP]]

Re: Creating a custom Start Menu on Win2003 TS

=?Utf-8?B?U2FuZHkgV29vZA==?= <sandy.wood@nospam.com> wrote on 06
okt 2008 in microsoft.public.windows.terminal_services:

> OK, thanks. I have read that some users create a Computer GPO, a
> User GPO and then a separate Loopback GPO and then target them
> at the Terminal Server OU. Wouldn't that serve the same purpose?

Yes.
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

 

[Vera Noest [MVP]]

Re: Creating a custom Start Menu on Win2003 TS

Yes, basic redirection to D:\my_custom_menu or something like that
would be fine, provided you want all users to see the same start
menu. Make it read-only!

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?U2FuZHkgV29vZA==?= <sandy.wood@nospam.com> wrote on 06
okt 2008 in microsoft.public.windows.terminal_services:

> Thanks for the note. I do have loopback processing set also but
> I'm a bit unclear on which Folder Redirection / Start Menu
> settings would be proper in my case.
>
> I'd like to have a custom start menu for all users (except
> Admins, via the Deny on the apply policy).
>
> I thought I'd choose "Basic - Redirect everyone's folder to the
> same location" and "Redirect to to the following location". As
> for the Root Path setting, do I need to create a share for this
> or can I use something like D:\newmenu? Finally, should I leave
> the Settings tab at default?

 

[Sandy Wood]

Re: Creating a custom Start Menu on Win2003 TS

Thanks Vera. By the way, I've spent the better part of the morning living in
your great TS web site. It's really loaded with great info.

In reading one of the Microsoft KB articles, Loopback processing of Group
Policy, I was struck by a comment it has regarding using Replace Mode. It
says:

"In this mode, the user's list of GPOs is not gathered. Only the list of
GPOs based on the computer object is used."

This sounds like it's saying, if I have a GPO with any user settings, they
will not be gathered, or used. I don't think this is correct as I've played
around with some Office 2007 user settings and they do get applied. Can you
shed some light on this for me?
--
Sandy Wood
Orange County District Attorney


"Vera Noest [MVP]" wrote:

> =?Utf-8?B?U2FuZHkgV29vZA==?= <sandy.wood@nospam.com> wrote on 06
> okt 2008 in microsoft.public.windows.terminal_services:
>
> > OK, thanks. I have read that some users create a Computer GPO, a
> > User GPO and then a separate Loopback GPO and then target them
> > at the Terminal Server OU. Wouldn't that serve the same purpose?
>
> Yes.
> _________________________________________________________
> Vera Noest
> MCSE, CCEA, Microsoft MVP - Terminal Server
> TS troubleshooting: http://ts.veranoest.net
> ___ please respond in newsgroup, NOT by private email ___
>

 

[Jeff Pitsch]

Re: Creating a custom Start Menu on Win2003 TS

Replace ignores all GPO's on the user accounts OU. It only does the
GPO's associated to the OU of where the computer is located.

Merge apply's the user accounts OU first, then applies the GPO's
associated with the computer object OU (in other words, the computer
object OU wins).

Jeff Pitsch
Microsoft MVP - Terminal Services

Sandy Wood wrote:
> Thanks Vera. By the way, I've spent the better part of the morning living in
> your great TS web site. It's really loaded with great info.
>
> In reading one of the Microsoft KB articles, Loopback processing of Group
> Policy, I was struck by a comment it has regarding using Replace Mode. It
> says:
>
> "In this mode, the user's list of GPOs is not gathered. Only the list of
> GPOs based on the computer object is used."
>
> This sounds like it's saying, if I have a GPO with any user settings, they
> will not be gathered, or used. I don't think this is correct as I've played
> around with some Office 2007 user settings and they do get applied. Can you
> shed some light on this for me?

 

[Sandy Wood]

Re: Creating a custom Start Menu on Win2003 TS

Ahh...I understand. That makes sense now that you explain it. I guess I'll
stick with Replace mode since I've got a dedicated OU for my TS and don't
want any other User policies applied.

Thanks!
--
Sandy Wood
Orange County District Attorney


"Jeff Pitsch" wrote:

> Replace ignores all GPO's on the user accounts OU. It only does the
> GPO's associated to the OU of where the computer is located.
>
> Merge apply's the user accounts OU first, then applies the GPO's
> associated with the computer object OU (in other words, the computer
> object OU wins).
>
> Jeff Pitsch
> Microsoft MVP - Terminal Services
>
> Sandy Wood wrote:
> > Thanks Vera. By the way, I've spent the better part of the morning living in
> > your great TS web site. It's really loaded with great info.
> >
> > In reading one of the Microsoft KB articles, Loopback processing of Group
> > Policy, I was struck by a comment it has regarding using Replace Mode. It
> > says:
> >
> > "In this mode, the user's list of GPOs is not gathered. Only the list of
> > GPOs based on the computer object is used."
> >
> > This sounds like it's saying, if I have a GPO with any user settings, they
> > will not be gathered, or used. I don't think this is correct as I've played
> > around with some Office 2007 user settings and they do get applied. Can you
> > shed some light on this for me?
>

 

[Vera Noest [MVP]]

Re: Creating a custom Start Menu on Win2003 TS

Yes, that's often the most sensible thing to do. "Merge" is also more
difficult to troubleshoot, since settings from one GPO are overridden
by another.
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?U2FuZHkgV29vZA==?= <sandy.wood@nospam.com> wrote on 06
okt 2008 in microsoft.public.windows.terminal_services:

> Ahh...I understand. That makes sense now that you explain it. I
> guess I'll stick with Replace mode since I've got a dedicated OU
> for my TS and don't want any other User policies applied.
>
> Thanks!