Mr Footlong

iTrader: (7)

Hi guys, I have a quick question regarding hiding icons within terminal server sessions. I have restricted rights down, such as no change date/time and add/remove progs lets them in, but refuses to manipulate programs, so half way there. Is there an easy way to do this. I haven't noticed it whilst tweak the domain policies.

Cheers,

Nick

David_Wallis

Rename all files with the ext cpl in login script then rename them back at logout..

ren *.cpl *.cph
ren main.cph main.cpl - to show this one.

ren *.cph *.cpl

David

Mr Footlong

iTrader: (7)

cool enough idea, but that would also hide them on the server's screen too. I searched for all of the cpl modules and selectively reduced the rights to only admin, system and server operator objects. Worked a treat. They can see all of the icons, but most of them do nothing when they try to run them, only the ones that I want run. Is there any way that I can deny access to the cdrom drive on the server to the terminal users? I am sure that there is a way throught the policies, I just can't find it....

Cheers for the help mate

Cheers,

Nick

David_Wallis

use kix and do something like..

If ingroup("Domain Admins") = 0 Or @WKSTA = "Server01"
Shell "CMD /C Ren Drive:\Path\*.cpl *.cph"
EndIf

To hide the cdrom you need to use the opposite of this script that I wrote in vbscript..

' ************************************************** *************
' * Enumerate CD-Rom Drive Letter and Change Visible Drive Mask *
' * David Wallis, PC / Server Support *
' ************************************************** *************
On Error Resume Next
Dim FSys, xDrive, xDrives, intTestAsc

Set WShell = CreateObject("Wscript.Shell")
Set FSys = CreateObject("Scripting.FileSystemObject")
Set xDrives = FSys.Drives
intCurrValue = "" ' Set to avoid problems with an empty reg key and using <> 0

For Each xDrive in xDrives
If xDrive.DriveType = 4 Then
intAsciDriveLetter = (Asc(xDrive.DriveLetter))
intTmpValue = intAsciDriveLetter - 64
intDecValue = 2 ^ intTmpValue
intTmpValue = NOT(intDecValue)
intcurrValue = WShell.RegRead("HKCU\Software\Microsoft\Windows\Cu rrentVersion\Policies\Explorer\NoDrives")
If intCurrValue <> "" Then
intNewValue = intTmpValue AND intCurrValue
RetCode = WShell.RegWrite("HKCU\Software\Microsoft\Windows\C urrentVersion\Policies\Explorer\NoDrives", intNewValue,"REG_SZ")
End If
End If
Next

Set xDrive = Nothing
Set xDrives = Nothing
Set FSys = Nothing
Set WShell = Nothing

Click on edit post to see formating...

This was to unhide cdroms for users, but you could adapt...


You could also just hide the control panel icon???

Edited to add but them bits dont matter... should read more carefully...

David

[Edited by David_Wallis - 6/17/2002 4:11:37 PM]

Mr Footlong

iTrader: (7)

Cheers. I too have just realised that by as well as disabling install rights and making the add/remove icon defunct for termainal users, they won't be able to install any software anyway.
DOH!

Thanks for your time mate

David_Wallis

dont count on it... i would still remove the icon.. in fact I would hide all drives apart from floppy and network drives..

Drop me a mail at david.wallis@ventura-uk.com if you need anything else.

David

Jodster

I setup 10 terminal servers under NT4 for the Big Bank. Used a policy to restrict the users from seeing control panel icons, and the A,C,D and CD-Rom drives on the server (use a Kix script to map their appropriate drives). Also used ZAK elements to apply stringent permissions on all files and folders and then hid everything on the drives. This should be secure enough for our users

David_Wallis

Jodster... Thats secure for a big bank Id love to come login there!!

David