TS on a CC3 domain

[Hightower]

We've just set up TS and got all the settings how we want except I need to be able to do two things.

 

First - Map shared network areas to a drive letter (as this isn't picked up as part of profile for some reason) : The home area is mapped to N: though as expected.

 

Second - Hide and prevent access to local drives C:, E: and F:

 

Help please

[meastaugh1]

If you haven't already done so, create a GPO and link it to the OU containing the terminal server. Use loopback policy processing to configure user settings:

Microsoft Corporation

 

You can add a vbscript (or similar) logon script to map drives: Mapping Network Drives - EduGeek.net Wiki

 

To hide drives, configure the settings in the aforementioned GPO with loopback policy processing: Using Group Policy Objects to hide specified drives

 

I've used this printer logon script to handle terminal services sessions.

[Hightower]

Would this not apply the GPO to all servers in that OU?

[meastaugh1]

If you are sticking your TS computer accounts in with the DC accounts, then yes they will all get the loopback policy, assuming default permissions.

 

I'd advise you to create a new OU with inheritance blocked. You can then link the policies you want/need to this new OU.

I believe it's default for CC3 to have an OU structure of Domain Controllers>Establishments>ABC>Servers - No Inheritance. I created an OU called Terminal Servers within the Servers - No Inheritance OU.

[Hightower]

Legend! Sorted it

[Hightower]

Ok then, so I was all hunkey dorey with my new TS until I thought "well what if I tweak this"

 

So a test user tries to load up 'Word' for instance (or any other app) and this warning appears

 

Open File - Security Warning

 

The publisher could not be verified - are you sure you want to run this software?

 

Now the user can click 'Run' or 'Cancel' - If 'Run' is clicked the app loads fine. It's just a bit tedious to click everytime - anyway to stop it?

[meastaugh1]

I think I have had this while I was experimenting with different policy settings.

 

Presumably you are logging on a with a standard CC3 user? Are you running loopback in merge or replace mode?

[Hightower]

Standard CC3 user - Loopback in Replace I believe (can't deffo remember off the top of my head)

[Hightower]

Which one should I be using? Replace or Merge?

[meastaugh1]

I'd recommend Replace. I did try Merge to minimise having duplicate policies (CC3 GPOs and vanilla GPOs), but this incurred significant performance issues.

[Hightower]

What would be the problem if I created this GPO and it started replicating to the rest of the CC3 network?

[meastaugh1]

Can you elaborate on what you mean? Are you talking about applying your policy across the domain?

[Hightower]

Lets say I had a TS in Computers within an OU called 'TS'. This TS had it's own GPO (as recommended) which was set up in merge mode.

 

Why would it apply that GPO to other machines too? The TS is the only machine in the TS folder

[meastaugh1]

By having it in merge mode, when a CC3 user logs on to terminal server, they will also pick up all the RM user GPOs. I'd recommend Replace mode, it does require a bit more work, but as I mentioned I had problems in Merge mode (specifically on the terminal server).

 

It wouldn't affect other machines if it's only applied to the TS OU. I was a bit confused by this

What would be the problem if I created this GPO and it started replicating to the rest of the CC3 network?

[Hightower]

No problems - thanks for your help

 

I just wanted to make sure before I started tinkering. I've changed one thing (remove search from start) just to check and everything seems to be working fine.

 

Still having problems with the Unknown Publisher - Do you want to run this?

[meastaugh1]

Ok np, the performance problems I experienced only became apparent when a few concurrent users were on, web browsing was particularly slow. Not sure what was causing it, twas a weird one.

 

Sorry not sure about the unknown publisher issue.

[Hightower]

OK - Just found it here

 

Unknown Publisher -security warning - Computing.Net

 

The very last post - added it to TS GPO and it worked

[Hightower]

I've set things up through GPO and works well for me and other tech accounts.

 

Just used a teacher account and some policies are applied where as the generic desktop and drive mappings aren't - is this a common problem?

[meastaugh1]

It is indeed.

 

As you are probably aware, drive and printer mappings are delivered to the user by a number of RM components installed on a CC3 workstation. Since these are not present on the terminal server, the mapping does not occur.

 

The lack of wallpaper is probably because the wallpaper file isn't installed on the terminal server. I think these are usually in system32\wallpaper?.bmp. These are usually delivered to the workstation via the Wallpaper and Logon Bitmaps package.