Terminal Server 2008 Remove Server Manager

NoodlesWIU used Ask the Experts™
How would I remove items via group policy like Server Manager, and Admin tools from a Windows 2008 R2 Server thats going to be utilized for Remote Desktop connections (formely terminal services) for everyone except admins
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
I think if you have proper user rights set up, then even if a user opens it, then they might not be able to change anything.
Also if you set proper permissions of those tools, then user may not even be able to open it.
Systems engineer
Top Expert 2008
Do the cleanup with the Preferences functionality in GPO

In a GPO with computer configuration settings:
Computer Configuration\Preferences\Windows Settings\Shortcuts
Add a delete rule for "C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Server Manager"

Enable loopback processing to make it possibly to link GPO with user configuration settings to the OU containing the TS/RD computer object.
Computer Configuration\Policies\Administrative Templates\System\Group Policy\User Group Policy loopback processing mode

Create another GPO with user configuration settings and configure its security filtering to only affect the non-admins and link the GPO to the TS-OU.
User Configuration\Preferences\Windows Settings\Registry

Add two Update/replace rules to remove the admin tools.
*    Start_AdminToolsRoot REG_DWORD 0
*    StartMenuAdminTools REG_DWORD 0

If you want Server Manager to be added to admins through Default user profile when they log on the first time, move the delete rule into the user configuration GPO for non-admins and target the deleting from current user's quick launch instead of default profile.


The icons of server manager and power shell are not in "C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch" in windows 7 and windows server 2008 r2; and the registry keys "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" i have "0" by default.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial