Prevent documents on Desktop

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

I have a domain containing profiles for users. They are constantly saving
documents to their desktops, resulting in silly sized profiles. I want to
force them to save them on their network drive (Home Folder). Is there a way
to prevent word/access/powerpoints being saved to the desktop. Using group
policy.
Server is Windows 2000 Server SP4. Clients are Win 2k SP4.

I don't want mandatory profiles, as they are allowed to customize the
desktops to their hearts desire, just not save documents on it

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

TheDragon wrote:
> I have a domain containing profiles for users. They are constantly
> saving documents to their desktops, resulting in silly sized
> profiles. I want to force them to save them on their network drive
> (Home Folder). Is there a way to prevent word/access/powerpoints
> being saved to the desktop. Using group policy.
> Server is Windows 2000 Server SP4. Clients are Win 2k SP4.
>
> I don't want mandatory profiles, as they are allowed to customize the
> desktops to their hearts desire, just not save documents on it

You could use a policy to redirect the desktop to the server - not sure how
granularly you can customize permissions to specify *what* they can store on
the desktop. Did you try m.p.windows.group_policy?

Are you redirecting My Documents to a subfolder of the user's home
directory? If not, do....

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Not that I know of. If you want to allow them to customize their desktop
then they will be able to save files to their desktop folder also which you
could otherwise change permissions on to be read/list/execute. You might
want to look into assigning disk quotas to the users on their computer which
will limit the amount of files they can store based on file ownership. That
can be managed via Group Policy. You would also want to train them to clear
their temporary internet files on a regular basis if you implement disk
quotas. Another possibility is a Group Policy logoff script that copies
those files, based on extension, to their home folder and then deletes then
from the desktop folder. I am not great at scripting, so if you are
interested in such you may want to post in a scripting newsgroup and test
thoroughly before implementing. Redirecting folders including desktop may
be another option. --- Steve

http://support.microsoft.com/kb/183322/EN-US/ --- disk quotas.
http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/Windows/XP/all/reskit/en-us/prde_ffs_cmob.asp
http://tinyurl.com/4katn -- redirect folders including user's desktop.

"TheDragon" <plandregan@gmail.com> wrote in message
news:3192dvF373jmcU1@individual.net...
>I have a domain containing profiles for users. They are constantly saving
>documents to their desktops, resulting in silly sized profiles. I want to
>force them to save them on their network drive (Home Folder). Is there a
>way to prevent word/access/powerpoints being saved to the desktop. Using
>group policy.
> Server is Windows 2000 Server SP4. Clients are Win 2k SP4.
>
> I don't want mandatory profiles, as they are allowed to customize the
> desktops to their hearts desire, just not save documents on it
>

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Yes we are redirecting the Mydocuments to their server share. So they have a
U: drive which is exactly the same as My Documents. However people insist on
ignoring these folders and creating a folder on their desktop to store stuff
in.

>

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

circa Fri, 3 Dec 2004 18:35:36 -0000, in
microsoft.public.win2000.security, TheDragon (plandregan@gmail.com)
said,
>
> Yes we are redirecting the Mydocuments to their server share. So they have a
> U: drive which is exactly the same as My Documents. However people insist on
> ignoring these folders and creating a folder on their desktop to store stuff
> in.
>
> >
>
>
>
You can also use folder redirection for users' desktops; you may want
to consider doing so rather than trying to break your users of their
[bad] habits. <G> Alternately, you can redirect the desktops and make
them read-only, but this opens up a host of user support issues that
you may not want to tackle.

Laura
--
Experience is the name every one gives to their mistakes.
-Oscar Wilde

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Steve really said the key thing here.
If you want to let them customize the desktop, but just
not store files there, then you have conflicting objectives.
Both require a grant of write for the desktop, and grants
are not sensitive to what is being written.
You can have one or the other - no changes to the desktop
or any changes to the desktop. Otherwise you need to get
inventive (like the script that deletes after copying, etc.).

--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"TheDragon" <plandregan@gmail.com> wrote in message
news:3192dvF373jmcU1@individual.net...
> I have a domain containing profiles for users. They are constantly saving
> documents to their desktops, resulting in silly sized profiles. I want to
> force them to save them on their network drive (Home Folder). Is there a
way
> to prevent word/access/powerpoints being saved to the desktop. Using group
> policy.
> Server is Windows 2000 Server SP4. Clients are Win 2k SP4.
>
> I don't want mandatory profiles, as they are allowed to customize the
> desktops to their hearts desire, just not save documents on it
>
>

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Yes I may have to redirect the desktop to a folder inside their U drive.
Then set a GP key to delete local cached copies of profiles, this should do
the job.

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

I will also look at making the desktop read only, this wont affect the
roaming profile running correctly will it?

I take to make the desktop readonly I just use NTFS permissions on the
server copy of the profiles\%username%\desktop folder?

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

circa Sat, 4 Dec 2004 11:54:45 -0000, in
microsoft.public.win2000.security, TheDragon (plandregan@gmail.com)
said,
> I will also look at making the desktop read only, this wont affect the
> roaming profile running correctly will it?
>
> I take to make the desktop readonly I just use NTFS permissions on the
> server copy of the profiles\%username%\desktop folder?
>
>
>
Correct. However, you're likely to get a whole lot of support calls
from your users wanting to know why they can't save things on their
desktops, so some user education is probably in order.

Laura
--
Experience is the name every one gives to their mistakes.
-Oscar Wilde

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Tried the education persuasion route, to no avail. Some profiles are in the
hundreds of megs, all because of documents and other items that shouldn't be
on the desktop.

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

?? An automated task on the server that finds anything
greater than X kb and moves it to their home storage ??

A few bouts of "where did that go?" might educate them
in their initial storage location choices.

--
Roger Abell

"TheDragon" <plandregan@gmail.com> wrote in message
news:31h4o6F39oe74U1@individual.net...
> Tried the education persuasion route, to no avail. Some profiles are in
the
> hundreds of megs, all because of documents and other items that shouldn't
be
> on the desktop.
>
>

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Thought of that store in a safe place, delete from desktop, wait for the
tears then give back with a stern warning.

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

We're using a combination of redirected files and setting the default file
location in the application (Office). It doesn't prevent users from purposely
saving to the desktop, but as all of thier office applications default opens
and saves in thier user folder on the server, they're more likely to keep
their files there, and do.

I'm not sure about using a batch file on log off. It would seem to me that
doing so would cause issues with document history. I'd have to test it to be
sure, though.

"TheDragon" wrote:

> I have a domain containing profiles for users. They are constantly saving
> documents to their desktops, resulting in silly sized profiles. I want to
> force them to save them on their network drive (Home Folder). Is there a way
> to prevent word/access/powerpoints being saved to the desktop. Using group
> policy.
> Server is Windows 2000 Server SP4. Clients are Win 2k SP4.
>
> I don't want mandatory profiles, as they are allowed to customize the
> desktops to their hearts desire, just not save documents on it
>
>
>