Hiding public desktop icons without removing public start menu

[Sokh]

I'm testing with a new teacher GPO and trying to set it so that the icons and folders in C:\users\public\desktop don't show up on the teachers desktop, only the things in their own redirected desktop. I could enable the "remove common folders" policy but then this would empty out their start menu as well.

 

I tried setting deny permissions to the public desktop for the teachers when they log in but that didn't seem to work, possibly because they already have reduced permissions to it which would stop the logon script changing it. The most promising attempt I've had so far was a VBScript that hides all the files and folders in the public desktop but I get a permission error when it runs at logon.

 

I'm a little out of ideas now and sat scratching my head, would appreciate some guidance.

[Mr.Ben]

Hi Sokh

 

I came to the conclusion that you couldn't do this without removing the Start Menu - So I redirected the Start Menu for Staff and Students as well.

 

The redirection is to a folder on the C:\ drive, and I use GPP to insert additional shortcuts when I need them.

[sted]

deny users access to the folder where its stored? c:\users\public\desktop

set a del command to empty that folder at pc startup\shutdown?

[Sokh]

I tried denying access to public with a logon script running "icacls "C:\users\public\desktop" /deny %username%:f" but it didn't seem to work.

 

Just deleting the contents would be the easy option but at the moment, teachers don't use it at all and all have a standard redirected desktop but admin staff do use the normal desktop with no redirection. It probably wouldn't cause issues but I just don't want to leave that possibility because it'll only come back to bite me in the arse somewhere down the line.

[sted]

pupil logon script that attrib +h's them and att logoff attrib -h?

[Sokh]

Afraid I tried that as well, it gets a permission denied when trying to hide the files in the desktop folder. Works if I add the teachers to local admin though which I might just do in the end. Need to test and see how much damage they cause with it first, hopefully GPO prevents anything too dire.

[cromertech]

Have you tried using file system security policies for the machine not user. The public folders only ever have read access for users unless they are administrators (Which I guess your teachers are not) so a log on script will not be able to alter these permissions unless you can find some way of elevating.

If you go to Group Policy/Computer Config/Policies/Windows Settings/Security Settings/File System you can add the public desktop and change the ntfs permissions just as you would with a network share. You can then tailor the permissions to suit and ensure they are propagated to the files in the folder.