Mandatory profile/Desktop Redirection

Archived from groups: microsoft.public.win2000.setup (More info?)

I need to restrict creating new files or folders on the desktop, not only
changing desktop setting but also created files, in addition to that I need
to automate user and profile creation, i've created a default network
profile that applies to all new users who logon to the network or a user
that doest already have a profile on a specific machine, the default profile
contains very important shortcuts that needs to be on each users desktop.

So I've setup Desktop Redirection with the 'move desktop content to new
location' unchecked, removed the write permission for the CREATOR OWNER
group on the subfolder and files, so they still have write access on the
root share \\server\desktop and no write access on the subfolder, next I've
setup Roaming/Mandatory profiles for all users.

Ok that being said... can you see a problem here, well a big one, since I
uncheck the move desktop content they don't get any of the shortcuts from
the default profile, if I check it, the desktop redirection fails because
they have no write access to the new location, if I give them write access,
then this whole setup was a total waist of time because they will be able to
create stuff on the desktop, my only option is to manually remove write
access from each user after then desktop is created in the new location,
maybe on a small network, but im talking hundreds or even over thousand of
users with rotating employees, it needs to be automated, one username is
also not an option because then use Outlook with Exchange.

Thanks