Lock desktop icons via GPO

[TonyMiles]

Hi

I have a new Server 2008 r2 with Windows 7 N and I was hoping somebody would know how I can lock the desktop Icon in place?

 

Thanks

[ZeroHour]

Just redirect the desktop to a UNC path and give everyone read rights only.

One side question why did you go for the N version of w7?

[FN-GM]

What type of profiles do you use?

[TonyMiles]

Thanks for the replys.

Your at the edge of my knowledge here.

ZH, I have tried to redirect my desktop via gpo and restrict to write permissions only and that hasn't worked. The primary school had the os bought by the High School who tried to install it and failed they ae no longer talking to each other. My Server knowledge is not the best although I have managed to refomat the server and create and image and deploy to the 30 workstations. You you please describe the steps I need to take?

 

FN-GM, I'm just using normal profiles not roaming, if thats what you mean.

[JohnCena83]

When you say "lock icon on my desktop items" I assume you mean to prevent themselves from becoming the organization of a reboot? If that's what you mean, then just copy then paste what is below to notepad, then click "File> Save as ..." at the top, save it on your desktop. when storing instead the option "Save as type" from "Text Documents (*. txt)" to "All Files" and the name of anything with a. reg. then close everything and click on the file and select "merger." also want to make sure you add the "Windows Registry Editor Version 5.00". the creation of the registry holds the position of the items on the desktop by closing

 

Windows Registry Editor Version 5.00

 

[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer]

"NoSaveSettings" = hex (3): 00,00,00,00

[TonyMiles]

Sorry for the confusion, as it's a Primary School all I want to do is have program shortcuts on the desktop that the children can't move or delete. I've disabled the right mouse click but just cant find where to lock them into position.

[ricki]

HI

 

Did anyone find a solution how to fix the icons on the desktop in place using a registry or gpo setting. The kids here have just started moving them round the screen.

 

Thanks for all your help.

 

Richard

[cromertech]

If you have a read only desktop folder then your first option could be 'Don't save settings at exit' gpo located in User configuration\Desktop. Other than that I think it can only be done by a mandatory profile. You can set the icons to auto arrange and view by date or name and then whenever they move one it should spring back exactly where it came from. If you set this when you create the mandatory profile the setting will persist over all the users and disabling the right click will mean that it can't be changed.

[ricki]

HI

 

The desktop is redirected to the server and read only . The students cannot write to it but are dragging the files round the screen.

 

We have tried the regsitry key for 'Don't save settings at exit but that did not stop them. According to microsoft autoarrange is the default but if the students move icon they stop where they have been put for that student. Then when they come to click on them that cannot find them. So what I need to do is stop them moving the icon.

 

How are you applying autoarrange.

 

Richard

[Brpilot99]

I use a little program called desklock .... its free and can be run on logon to lock the desktop .... you can do a search and you will find it OK ...

Cheers

Brian

[cromertech]

I use a little program called desklock .... its free and can be run on logon to lock the desktop .... you can do a search and you will find it OK ...

Cheers

Brian

 

Looks good and as though it will do what you want find it here as some links are commercial product with same name

[bondbill2k2]

I had no server/network knowlage either earlier this year and keep taking on new tasks so I like to write things pretty basic

We just use a redirection by group policy so teachers, students, admin etc all have different desktop shares, share permissions is set to everyone, security permissions are set using your AD groups so all admin staff are in a AD group called Admin, make sure they ret to Read only and the are denied all other permisisons beside list/display and read.

[ricki]

I had no server/network knowlage either earlier this year and keep taking on new tasks so I like to write things pretty basic

We just use a redirection by group policy so teachers, students, admin etc all have different desktop shares, share permissions is set to everyone, security permissions are set using your AD groups so all admin staff are in a AD group called Admin, make sure they ret to Read only and the are denied all other permisisons beside list/display and read.

 

This is already done.

 

Richard

[ricki]

I use a little program called desklock .... its free and can be run on logon to lock the desktop .... you can do a search and you will find it OK ...

Cheers

Brian

 

Thanks is there command line options so that it only locks the desktop and not the right click.

 

Richard

[ricki]

Hi

 

I have copied the desklock onto the a server and started it with a gpo logon script and linked it to a student. The group policy applies but does not load. How are you deploying this package. Do you copy it to the machine and run it locally

 

Richard

[Brpilot99]

"Do you copy it to the machine and run it locally"

 

No ... I run it from the default domain policy under "run these programs on logon". (user configuration). Everybody gets the policy in the school ... This is for 2003 so assume its much the same for 2008. Ive put the exe into a folder on the server and pointed the policy to it. Also make sure all users (everybody) has read rights to the folder ... Dont forget to use a unc path or the logging on PC wont find the exe ...

 

Cheers

Brian

[dhomer]

Hi,

 

Yes the "Don't save settings on exit" GPO won't work - the description states it doesn't prevent changes to shortcuts.

"If you enable this setting, users can change the desktop, but some changes, such as the position of open windows or the size and position of the taskbar, are not saved when users log off. However, shortcuts placed on the desktop are always saved."

 

I'll see if I can find the registry setting you need to clear (probably on log off) or you can use mandatory profiles...

 

This is why we created XIA links to get around some of these Group Policy headaches!

XIA Links - Desktop Application Launcher

 

 

Thanks,

 

Dave

[dhomer]

Hi,

 

OK so I've taken a look at this... Explorer stores the icon positions in the following format.

 

It seems that is stores icon positions in a different key dependant on the screen resolution (hence why projector connections normally screw up my icon locations I guess).

 

Windows Registry Editor Version 5.00

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags\1\Desktop]

"ItemPos1024x768x96(1)"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0f,\

00,00,00,a2,01,00,00,14,00,1f,78,40,f0,5f,64,81,50,1b,10,9f,08,00,aa,00,2f"

 

You would need to either block the client from changing this key, or to replace the settings after it changes them, or before explorer starts up.

 

Hmmm this is quite tricky

 

 

 

Thanks,

 

 

Dave

CENTREL Solutions

CENTREL Solutions - Network Automation, User Provisioning, Audit and Network Documentation