Security settings for global desktop

[TechSupp]

Got a global desktop set up on network and just found some of the shortcut names have been changed so looking at the security settings of the desktop share. All apart from domain\administrator, administror and system have write denied already set yet I can still edit a shortcut name on a client logged on? The users have local admin status(dont go down that route, long story!) so is that the issue or is there something else I should check? Sure we used to have it sorted before the new server was intalled last year and it was all moved over.

[Bjoern]

You mean you can edit shortcuts on a mandatory roaming profile that is on a share where only the admin-users/system have write access (NTFS + Share-Security?) ?

 

So you really mean you can logon as a local admin on pc1, change a shortcut, logoff,0 move to pc2, logon as the same user and then the shortcut is changed there, too?

 

Maybe you have a problem with profile caching?

[Davit2005]

Have you redirected the Desktop to a Share, if so just make sure the Share is Read Only for everyone.

[TechSupp]

Have you redirected the Desktop to a Share, if so just make sure the Share is Read Only for everyone.

Yes thats it, desktop is redirected to a shared folder so i can quickly add or remove shortcuts for everyone. Made all the shortcuts readonly attrib but when i change a shortcut on a client it just warns me its a read only and says do you really want to change a read only file, say yes, and short cut changed!

[Davit2005]

Yes thats it, desktop is redirected to a shared folder so i can quickly add or remove shortcuts for everyone. Made all the shortcuts readonly attrib but when i change a shortcut on a client it just warns me its a read only and says do you really want to change a read only file, say yes, and short cut changed!

 

Depends on your particular setup but the only thing I can suggest is to try make the share where the desktop is located a read only share. This would mean that you have to make sure you put any shortcuts on the folder on the server but I haven't really found any issue with doing that and have had same setup for last 5 months.

 

If you need to put a shortcut on the desktop when the application isn't on that server all you need do is copy it to a shared folder on the server and move it across as long as you don't edit the shortcut properties once moved you'll be fine.

Edited January 21, 2012 by Davit2005

[TechSupp]

Thanks, will look at that later, will check the folder read only properties rather than the shortcut properties.