Hello, I have a single Windows 2000 server on a mixed workstation network. The workstations are Windows ME and Windows XP professional edition. Occasionally we hook up Windows 98 clients too.
My Windows clients have users that log on to the Win2K domain. The domain has about 10 users configured. (one general client user and the rest staff/administrator accounts).
Currently our setup is not ideal. Users can log into the workstations and they have administrator privileges. They can download and install software, change the desktop, save their files on the hard drive, etc. Also, many times clients press ESC when asked to log in and then complain that they can't print or access the Internet.
I know it is possible (and I have tested it) to set up policies such that:
1. Users MUST log in to the network (i.e. they can't press ESC in Windows 98/ME)
2. Users cannot change desktop settings i.e. wallpaper and icons
3. Users cannot access the C:\ drive (but CAN access the floppy and CD drive)
4. Any changes the users make to the desktop will not be saved on exit
5. Users cannot install or remove software
6. Users will be shown a custom Start Menu
7. Control panel is hidden
I have done this to a test Windows ME client using the POLEDIT feature from Windows 98. It works fantastically and does precisely what I want. However, this will be time consuming to do to every client machine, especially considering I want the access rights and profile configured for the user name and not necessarily the machine itself. Also I want to be able to apply the policies no matter the operating system that the client logs into.
I know it must be possible to somehow do this on the domain server and have the policies and profile applied when the user logs in. I have done some Googling but am pretty new to Windows 2000 server and the idea of domains. I've looked around in the Administration options of the server but can't seem to find a program similar to POLEDIT.
What I am looking for is the steps to accomplishing what I did on the Windows ME machine, only on the server and have it applied to the user name(s) - I would prefer different access levels for differnet user names. It should be able to be applied on Windows 98, Windows ME and Windows XP clients. If you can give the steps for Windows 2000 server AND Windows 2003 server, that would be even better (we will soon be upgrading).
Thanks!
