Best way to lock down manage computer from right clicking on computer desktop icon?

[reggiep]

We have been setting up our new Server 2008 R2 for some time and have nearly finished all our security checks and GPO creation. however one thing which is out of my grasp is being able to stop students right clicking on the Computer icon on the Win 7 desktop and then manage to manage the computer.

 

What would be the best way to lock this down without disabling the right click.

 

thanks

[cpjitservices]

Deny access to the control panel etc

[tigerstar]

Add a software restriction policy for those users to prevent them running mmc.exe. This will lock out all ways of getting into the management console, regardless of approach.

[reggiep]

I would if I could, I already have a thread open explaining that no matter what I do I cannot get software restrictions to apply! I think I may well have to take another look at it.

[cromertech]

Group policy --> User/admin templates/windows components/explorer/ Hide the manage item on the context menu

 

May only do it for explorer itself not the start menu though

[6Foot2]

Our students do not see the Computer icon in their redirected Start Menus or Desktops.

 

If you hid the icon would that solve your problem here?

[SYNACK]

You don't need to use a restriction policy, there is a whole option for it in GPO.

 

User > Admin Templates > Win Components > MS Managment Console > Restrict users to the explicitly defined snapins

[SYNACK]

User > Admin Templates > Win Components > Win Explorer > Hides the manage item on the Windows Explorer context menu