users desktops and folder redirection question on ws2012 r2 & w7pro domain

I suddenly find myself as the admin for a small WS2012R2 domain of 10 win 7 pro workstations and 15 users with roaming and folder redirection.   I am self taught on this and my knowledge of ws2012 is very limited.

The workstations have different programs installed, and I am wanting to restrict some users to only have certain programs on their individual desktops, regardless of which machine they are logged in at.

I have full access to the users accounts both locally on the workstations and on the server, so I can change the desktop folder contents.

Currently, any given user at the moment has duplicated icons for some programs and inactive ones for missing programs on a particular workstation.

In real terms the users will only be moving between 4 workstations for the bulk of their work, which will have the same core set of installed programs on each. The admins however should be able to access a further set of core programs plus some individual workstation specific ones.

Could someone explain what is possible in this scenario, bearing in mind I am extremely uncomfortable with doing this, and need the info in simple terms!


Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

David Johnson, CD, MVPOwnerCommented:
this is a scenario in which you want to use application virtualization (app-V)
Robin CMSenior Security and Infrastructure EngineerCommented:
You can use Group Policy Preferences to create shortcuts based on group membership. So you'd create a group for each application and set the GPPref to create a shortcut where the user is a member of this group. You can also set the GPPref to only create the shortcut where a certain file is present (e.g. the target .exe).
The admins would be in an additional group which would create the shortcuts for their additional apps.
You could also investigate applying this via "loopback" policy, which means that you are applying "User" policies based on the computer the user is logged on to. a Group Policy Object is split into two sections: User and Computer. Normally, "user" policies apply to users on any computer, and "computer" policies apply to computers irrespective of the user. With loopback, you add user policy settings into a computer policy object.
Loopback is enabled via Computer Configuration, Policies, Administrative Templates, System, Group Policy, Configure user Group Policy Loopback Processing mode. Probably choose "Merge"...
You could further experiment with AppLocker, which can block things from executing even if people browse for the .exe.
I am available for hire to assist with this stuff :-)

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
chrisatworkAuthor Commented:
David  we have hyper-v on the server but that is a can I'd rather not open at my stage of expertise.
Robin thanks for the info, I will have to go and read up on your comments, sadly although I would like to take you up on your offer of hire the voluntary charity I am involved with has an annual budget of around £2k with running costs virtually the same, so there is no spare cash!

I've marked your answer as a solution but I may have to come back with a more focussed enquiry when I know what I want!

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2012

From novice to tech pro — start learning today.