Prevent Desktop Saves

[Hamins]

Hi,

We have a network of around 75 workstations & 1 Windows 2003 Ent. server as a DC. We have not setup roaming profiles for the users. We would like to prevent users from saving any kind of file/data onto the desktop. The user should be able to save files only on the shares on the server.

I have already restricted access to the local drives using GPOs. Now, I would like to know how to prevent users from saving data on their desktops. I know that one method is by using FOLDER RE-DIRECTION. However, I'm not to keen on using this method, since I feel it would increase the load on the server, as all the users will accessing their respective desktops from the sever.

Is there any other effective way to preventing users from saving files on the desktop (from any application, or even the desktop context menu) ??

Edited August 27, 2008 by Hamins

[mara-]

Maybe you could open Group Policy (gpedit.exe) and navigate to User Configuration->Administrative Templates->Desktop->Active Desktop. You have various options there for changes that can be done on Desktop.

Cheers

[Hamins]

Hi Mara, thanks for the response.

I tried that. It prevents changes to the stuff like the desktop wallpaper, active content etc. However, it does not prevent the user from save files onto the desktop (either from the Save/Save as option of an applications, or from the desktop context menu : Right-Click - New)

[Hamins]

Does anyone have any further suggestions ?

[Idontwantspam]

You could write a script to deny them write access to %userprofile%\desktop.

Something like

@echo off
cacls "%userprofile%\desktop" /E /C /P "%username%":R
exit

Add that to everyone's startup scripts, and voila, they can't write to the desktop.

* I don't know if I got the syntax 100% correct for cacls. You might want to check that I did it right.

[Hamins]

Hi Idontwantspam,

Thanks for the response/suggestion.

Is calcs a default Windows XP command ? If not, where can I get it from ? Once I download it, it'll have to be distributed to all the local XP clients, right ?

[cluberti]

Cacls.exe is a default XP binary.

[Hamins]

Hi Idontwantspam/Cluberti,

Thanks for the help guyz... I tried the script by Idontwant...., and it seems to be working on the test Windows XP machine...