Terminal Server Desktop LockDown - How to..

In Active Directory I have a OU titled New Terminal Server Environment. The TS users are in this OU  and each user is a member of Remote Desktop Users.

New Terminal Server Environment is also shown In Group Policy Management. Beneath that entry I created a linked GPO titled TS_User_Lockdown and enabled some options like don't show Run in the Start Menu.

Tried it and doesn't work.
LVL 5
OOsorioAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

sukamtoCommented:
is your lockdown not working or your TS not working?
0
sukamtoCommented:
have you ticked "Block policy inheritance" on new OU?
0
jjozCommented:
Have you tried to force it with gpupdate /force command ?
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

OOsorioAuthor Commented:
sukamto: The lockdown is not working.
                                  I have not ticked Block Policy inheritance on new OU
jjoz:          I have not tried to force it with goupdate /force
        I went to the command prompt to try the goupdate /force and got a error message:
        goupdate is not a recognized internal or external command.
0
OOsorioAuthor Commented:
jjoz: Reading your instruction i realize it is gpupdate /force. Tried it. The instruction was accepted by the command prompt but the policy is still not working.
0
Shreedhar EtteCommented:
0
OOsorioAuthor Commented:
I have looked at that before but in WinServer 2008 Active Directory, under properties, you don't get the Group Policy Tab as shown in the second graphic.
0
sukamtoCommented:
can post the screenshot of your gpo
0
OOsorioAuthor Commented:
A right click on the OU in the AD and then selecting properties shows this:

OU-Properties.jpg
0
jjozCommented:
ok, in this case OOsorio,

perhaps trying to configure the lockdown through local GPO (Start | Run | "gpedit.msc" )

is the way to go since configuring it from domain controller is too much efforts (assuming only one Terminal server instance that you want to lock down).

cmiiw
0
kennyhenaoCommented:
Read the link. 2008 it is not gpedit.msc, the correct command is gpmc.msc
0
OOsorioAuthor Commented:
The Event Viewer is showing this error:

The processing of Group Policy failed. Windows could not locate the directory object OU=New Terminal Server Environment,DC=domain,DC=com. Group Policy settings will not be enforced until this event is resolved. View the event details for more information on this error.
0
OOsorioAuthor Commented:
What is THE NETWORK SERVICE ACCOUNT?
0
OOsorioAuthor Commented:
I would like to close this because no solution is being provided.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
OOsorioAuthor Commented:
I found this: To resolve this problem, grant sufficient permissions to access the parent OUs to all the user accounts and to all the computers that apply Group Policy settings through the OUs.

I gave read rights to Authenticated Users for that particular OU and it worked.
0
jjozCommented:
Thanks for returning back to this question OOSorio :-)
perhaps next time you can give maximum 500 points to all of your question so that the experts attracted to answer it.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.