| Home | Register | Members | Search | Windows Vista Tips | File Database | Links |
![]() |
| Thread Tools | Display Modes |
|
|
|
| |
|
Jenny wu [MSFT]
Guest
Posts: n/a
|
Hi,
Thank you for posting here! I am sorry for the delayed response due to weekend. Please understand that the newsgroups are staffed weekdays by Microsoft Support professionals to answer your systems and applications questions. Your understanding is greatly appreciated! Based on my research, there is no specific group policy available to disable users from changing the desktop. To achieve the goal, I suggest that you configure a group policy to redirect the Desktop of the user group to a network share. We can set the NTFS permission on the network share so that users cannot change their desktop. To do so, please perform the following steps: 1. Create a network share to store the desktop settings, such as \\server\desktops. 2. Open Active Directory Computers and Users snap-in. 3. Locate the appropriate OU or container and click Properties. 4. In the Group Policy tab, create a new group policy, and click Edit to open the Group Policy edit window. 5. Locate the following group policy: [User Configuration\Windows Settings\Folder Redirection\Desktop] 6. Right click Desktop, and then click Properties. 7. Select "Advanced settings: Specify locations for various user groups". 8. Click Add to select the user group that you want to restrict permission, and specify the Desktop share folder as \\server\desktops. 9. Select the Settings property page, and click to clear the "Grant user exclusive rights to my documents". You can also configure other settings according to your requirement. 10. Close all windows. 11. Click Start, and click Run. 12. Type "cmd" in the text box, and click OK. 13. Type the following command to refresh the group policy settings: SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE 14. In Windows Explorer, locate the desktop share folder and configure NTFS permission to prevent users from modifying the folder. 15. Logon as a user in the group to test. When users try to modify contents in the Desktop they will receive an error message saying "Access is denied". For more information about folder redirection, please refer to the following Microsoft Knowledge Base articles: 232692 Folder Redirection Feature in Windows http://support.microsoft.com/?id=232692 288991 Enabling the Administrator to Have Access to Redirected Folders http://support.microsoft.com/?id=288991 Hope this helps! If you have any further concern or question about the issue, please feel free to let me know. You are always welcome! Have a nice day! Best Regards, Jenny Wu Microsoft CSS Online Newsgroup Support Get Secure! - www.microsoft.com/security ================================================== ==== This newsgroup only focuses on SBS technical issues. If you have issues regarding other Microsoft products, you'd better post in the corresponding newsgroups so that they can be resolved in an efficient and timely manner. You can locate the newsgroup here: http://www.microsoft.com/communities...s/default.aspx When opening a new thread via the web interface, we recommend you check the "Notify me of replies" box to receive e-mail notifications when there are any updates in your thread. When responding to posts via your newsreader, please "Reply to Group" so that others may learn and benefit from your issue. Microsoft engineers can only focus on one issue per thread. Although we provide other information for your reference, we recommend you post different incidents in different threads to keep the thread clean. In doing so, it will ensure your issues are resolved in a timely manner. For urgent issues, you may want to contact Microsoft CSS directly. Please check http://support.microsoft.com for regional support phone numbers. Any input or comments in this thread are highly appreciated. ================================================== ==== This posting is provided "AS IS" with no warranties, and confers no rights. -------------------- >Thread-Topic: Standard Desktop Wallpaper for all users >thread-index: AcWfXS/POE05PumNSNCBM3zx8R6DiA== >X-WBNR-Posting-Host: 84.9.38.174 >From: =?Utf-8?B?U2FhamFu?= <> >Subject: Standard Desktop Wallpaper for all users >Date: Fri, 12 Aug 2005 09:45:03 -0700 >Lines: 11 >Message-ID: <AB0983B7-E9BB-48BF-8F4A-> >MIME-Version: 1.0 >Content-Type: text/plain; > charset="Utf-8" >Content-Transfer-Encoding: 7bit >X-Newsreader: Microsoft CDO for Windows 2000 >Content-Class: urn:content-classes:message >Importance: normal >Priority: normal >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0 >Newsgroups: microsoft.public.windows.server.sbs >NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250 >Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA02.phx.gbl!TK2MSF TNGXA03.phx.gbl >Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:143742 >X-Tomcat-NG: microsoft.public.windows.server.sbs > >Hi > >Our server is running Windows Small Business Server Premium 2003 with >Service Pack 1 and all clients are on Windows XP Professional Service Pack 2. >We would like to have our company's desktop wallpaper for all the users and >also prevent them from changing it. I tried enforcing this through Group >Policy in the Default Domain Policy on the server. But this shows no >wallpaper on any of the PCs. When the active desktop wallpaper is selected, >the wallpaper resolution is very bad. Is there a better way of doing this? >What should be the path of the wallpaper? How should be the attributes and >permissions set? Please help.. Many Thanks! > |
|
|
|
|
|||
|
|||
|
Saajan
Guest
Posts: n/a
|
Hi
Thank you for your detailed reply. Well, I saw an option in the group policy to prevent users from changing the desktop wallpaper, but I do not know how effective it is. Also, I have enabled this setting on individual PCs on the network so that the users will not be able to change it. This does not allow the users to change it using the Display Properties, but they can still change it using Set as Background option available for most images. Also, we have a number of users who have no computer assigned to them and all the users have roaming profile. The setting has to be in such a way that any user who logs on to any computer must have the same wallpaper. I guess the best way to achieve this is to associate the wallpaper with the user profiles. Is there a way to do this? Any ideas welcome. Thanks again! ""Jenny wu [MSFT]"" wrote: > Hi, > > Thank you for posting here! > > I am sorry for the delayed response due to weekend. Please understand that > the newsgroups are staffed weekdays by Microsoft Support professionals to > answer your systems and applications questions. Your understanding is > greatly appreciated! > > Based on my research, there is no specific group policy available to > disable users from changing the desktop. To achieve the goal, I suggest > that you configure a group policy to redirect the Desktop of the user group > to a network share. We can set the NTFS permission on the network share so > that users cannot change their desktop. To do so, please perform the > following steps: > > 1. Create a network share to store the desktop settings, such as > \\server\desktops. > 2. Open Active Directory Computers and Users snap-in. > 3. Locate the appropriate OU or container and click Properties. > 4. In the Group Policy tab, create a new group policy, and click Edit to > open the Group Policy edit window. > 5. Locate the following group policy: > > [User Configuration\Windows Settings\Folder Redirection\Desktop] > > 6. Right click Desktop, and then click Properties. > 7. Select "Advanced settings: Specify locations for various user groups". > 8. Click Add to select the user group that you want to restrict permission, > and specify the Desktop share folder as \\server\desktops. > 9. Select the Settings property page, and click to clear the "Grant user > exclusive rights to my documents". You can also configure other settings > according to your requirement. > 10. Close all windows. > 11. Click Start, and click Run. > 12. Type "cmd" in the text box, and click OK. > 13. Type the following command to refresh the group policy settings: > > SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE > > 14. In Windows Explorer, locate the desktop share folder and configure NTFS > permission to prevent users from modifying the folder. > 15. Logon as a user in the group to test. > > When users try to modify contents in the Desktop they will receive an error > message saying "Access is denied". > > For more information about folder redirection, please refer to the > following Microsoft Knowledge Base articles: > > 232692 Folder Redirection Feature in Windows > http://support.microsoft.com/?id=232692 > > 288991 Enabling the Administrator to Have Access to Redirected Folders > http://support.microsoft.com/?id=288991 > > Hope this helps! If you have any further concern or question about the > issue, please feel free to let me know. You are always welcome! > > Have a nice day! > > Best Regards, > > Jenny Wu > Microsoft CSS Online Newsgroup Support > Get Secure! - www.microsoft.com/security > ================================================== ==== > This newsgroup only focuses on SBS technical issues. If you have issues > regarding other Microsoft products, you'd better post in the corresponding > newsgroups so that they can be resolved in an efficient and timely manner. > You can locate the newsgroup here: > http://www.microsoft.com/communities...s/default.aspx > > When opening a new thread via the web interface, we recommend you check the > "Notify me of replies" box to receive e-mail notifications when there are > any updates in your thread. When responding to posts via your newsreader, > please "Reply to Group" so that others may learn and benefit from your > issue. > > Microsoft engineers can only focus on one issue per thread. Although we > provide other information for your reference, we recommend you post > different incidents in different threads to keep the thread clean. In doing > so, it will ensure your issues are resolved in a timely manner. > > For urgent issues, you may want to contact Microsoft CSS directly. Please > check http://support.microsoft.com for regional support phone numbers. > > Any input or comments in this thread are highly appreciated. > ================================================== ==== > This posting is provided "AS IS" with no warranties, and confers no rights. > > -------------------- > >Thread-Topic: Standard Desktop Wallpaper for all users > >thread-index: AcWfXS/POE05PumNSNCBM3zx8R6DiA== > >X-WBNR-Posting-Host: 84.9.38.174 > >From: =?Utf-8?B?U2FhamFu?= <> > >Subject: Standard Desktop Wallpaper for all users > >Date: Fri, 12 Aug 2005 09:45:03 -0700 > >Lines: 11 > >Message-ID: <AB0983B7-E9BB-48BF-8F4A-> > >MIME-Version: 1.0 > >Content-Type: text/plain; > > charset="Utf-8" > >Content-Transfer-Encoding: 7bit > >X-Newsreader: Microsoft CDO for Windows 2000 > >Content-Class: urn:content-classes:message > >Importance: normal > >Priority: normal > >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0 > >Newsgroups: microsoft.public.windows.server.sbs > >NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250 > >Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA02.phx.gbl!TK2MSF TNGXA03.phx.gbl > >Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:143742 > >X-Tomcat-NG: microsoft.public.windows.server.sbs > > > >Hi > > > >Our server is running Windows Small Business Server Premium 2003 with > >Service Pack 1 and all clients are on Windows XP Professional Service Pack > 2. > >We would like to have our company's desktop wallpaper for all the users > and > >also prevent them from changing it. I tried enforcing this through Group > >Policy in the Default Domain Policy on the server. But this shows no > >wallpaper on any of the PCs. When the active desktop wallpaper is > selected, > >the wallpaper resolution is very bad. Is there a better way of doing this? > >What should be the path of the wallpaper? How should be the attributes and > >permissions set? Please help.. Many Thanks! > > > > |
|
|
|
|
|||
|
|||
|
Jenny wu [MSFT]
Guest
Posts: n/a
|
Hi,
Thanks for your update! Suggestion 1: I am sorry for misunderstand you. If you want only prevent users from changing wallpaper, you can do as follows: Method 1: You can enable the group policy 'Active Desktop Wallpaper' and apply it to domain users. The policy can specify the desktop background ("wallpaper") displayed on all users' desktops. This setting lets you specify the wallpaper on users' desktops and prevents users from changing the image or its presentation. The wallpaper you specify can be stored in a bitmap (*.bmp), JPEG (*.jpg), or HTML (*.htm, *.html) file. Location: User Configuration\Desktop\Active Desktop\ *Note: You need to enable the Active Desktop to use this setting. This setting does not apply to Terminal Server sessions. Method 2: You can enable the group policy ' Prevent changing wallpaper' and apply it to domain users. The policy can prevent users from adding or changing the background design of the desktop. Location: User Configuration\Control Panel\Display\ By default, users can use the Desktop tab of Display in Control Panel to add a background design (wallpaper) to their desktop. If you enable this setting, the Desktop tab still appears, but all options on the tab are disabled. If you want to remove the Desktop tab, use the "Hide Desktop tab" setting. Suggestion 2: Technical speaking, the roaming profile is user-based. You need not prevent users from changing their wallpaper. For your convenience, I list the detail steps to setup roaming profile, you can refer to: 1. Create a Shared Folder to Store Roaming User Profiles. In SBS 2003, a shared folder "\\sbsserver\Users" is created by default and used for this purpose. 2. Configure user accounts to use roaming user profiles. To configure a user to use roaming profile: On the SBS server, in Server Management, locate the user, right-click on it and click Properties. On the Profile tab, type a UNC path in "Profile path", for example \\sbsserver\users\%username%. 3. Since all the clients are running Windows XP, log on & log off, the user profile will be upload to \\sbsserver\users\%username% automatically. If the clients are running Windows 2000, log on, in System properties change the profile type to Roaming, then copy the profile to \\server\profile\%username% and log off. Consider the following when implementing roaming profiles: 1. Do not use Offline Folder caching on roaming user profile shared directories. It is important to turn off Offline Folder caching for shared directories where roaming user profiles are stored. If you do not turn off Offline Folder caching for a user''s profile, you might experience synchronization problems when both Offline Folders and roaming user profiles try to synchronize the files in a user''s profile. This does not affect your ability to use Offline Folders with redirected folders such as My Documents. 2. Do not use Encrypted File System (EFS) on files in a roaming user profile. The Encrypted File System (EFS) is not compatible with roaming user profiles. If you encrypt profile folders or files in the user profile using EFS, the user''s profile will not roam. 3. Do not set disk quotas too low for users with roaming user profiles. If a user''s disk quotas are set too low, roaming user profile synchronization might fail. Make sure enough disk space is allocated to allow the system to create a temporary duplicate copy of a user''s profile. The temporary profile is created in the user''s context as part of the synchronization process, so it debits the user''s quota. 4. When creating a roaming profile shared directory, limit access to only those users that need access. - Because a users roaming profile can contain personal information such as confidential documents and EFS certificates, care should be taken to protect access to the shared directory. Restrict access to the shared directory to only those users that need access. You can also create a security group for users that have profiles on a particular shared directory, and limit access to only those users. - Only give users the minimum amount of permissions needed. - When creating the shared directory, hide it by putting a $ after the share name. This hides the shared directory from casual browsers, and it will not be visible in My Network Places. 5. Use at least Windows 2000 servers to host user roaming profile shared directories. Because a users roaming profile contains personal information which is copied to and from a client computer, and the server hosting the roaming profile, it is important to ensure that data is protected as it travels over the network. Potential threats to the privacy and integrity of a user''s data come from intercepting the data as it passes over the network, tampering with the data as it passes over the network, and spoofing the server hosting the user''s data. Features such as Kerberos, IPSec, and Server Message Block (SMB) signing included in Windows 2000 and the Windows Server 2003 family can help to secure a user''s data. 6. Always use the NTFS file system for volumes holding user''s data. Configure servers hosting roaming profiles to use the NTFS File System. Unlike FAT, NTFS supports Discretionary access control lists (DACLs) and system access control lists (SACLs), which control who can perform operations on a file and what events will trigger logging of actions performed on a file. Related information: 324749 How To Create a Roaming User Profile in Windows Server 2003 http://support.microsoft.com/?id=324749 316353 How to configure a user account to use a roaming user profile in Windows Server 2003, Windows 2000 Server, or Windows NT 4.0 http://support.microsoft.com/?id=316353 Hope above information helps! please try my suggestion and let me know the result. Have a nice day! Best Regards, Jenny Wu Microsoft CSS Online Newsgroup Support Get Secure! - www.microsoft.com/security ================================================== ==== This newsgroup only focuses on SBS technical issues. If you have issues regarding other Microsoft products, you'd better post in the corresponding newsgroups so that they can be resolved in an efficient and timely manner. You can locate the newsgroup here: http://www.microsoft.com/communities...s/default.aspx When opening a new thread via the web interface, we recommend you check the "Notify me of replies" box to receive e-mail notifications when there are any updates in your thread. When responding to posts via your newsreader, please "Reply to Group" so that others may learn and benefit from your issue. Microsoft engineers can only focus on one issue per thread. Although we provide other information for your reference, we recommend you post different incidents in different threads to keep the thread clean. In doing so, it will ensure your issues are resolved in a timely manner. For urgent issues, you may want to contact Microsoft CSS directly. Please check http://support.microsoft.com for regional support phone numbers. Any input or comments in this thread are highly appreciated. ================================================== ==== This posting is provided "AS IS" with no warranties, and confers no rights. -------------------- >Thread-Topic: Standard Desktop Wallpaper for all users >thread-index: AcWhdDurrYVPoFY7T2ex/GQNV9c2bQ== >X-WBNR-Posting-Host: 81.179.99.59 >From: =?Utf-8?B?U2FhamFu?= <> >References: <AB0983B7-E9BB-48BF-8F4A-> <> >Subject: RE: Standard Desktop Wallpaper for all users >Date: Mon, 15 Aug 2005 01:35:03 -0700 >Lines: 148 >Message-ID: <67AB41DC-F7EA-498D-A259-> >MIME-Version: 1.0 >Content-Type: text/plain; > charset="Utf-8" >Content-Transfer-Encoding: 7bit >X-Newsreader: Microsoft CDO for Windows 2000 >Content-Class: urn:content-classes:message >Importance: normal >Priority: normal >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0 >Newsgroups: microsoft.public.windows.server.sbs >NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250 >Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFT NGXA03.phx.gbl >Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:144366 >X-Tomcat-NG: microsoft.public.windows.server.sbs > >Hi > >Thank you for your detailed reply. Well, I saw an option in the group policy >to prevent users from changing the desktop wallpaper, but I do not know how >effective it is. Also, I have enabled this setting on individual PCs on the >network so that the users will not be able to change it. This does not allow >the users to change it using the Display Properties, but they can still >change it using Set as Background option available for most images. Also, we >have a number of users who have no computer assigned to them and all the >users have roaming profile. The setting has to be in such a way that any user >who logs on to any computer must have the same wallpaper. I guess the best >way to achieve this is to associate the wallpaper with the user profiles. Is >there a way to do this? Any ideas welcome. Thanks again! > >""Jenny wu [MSFT]"" wrote: > >> Hi, >> >> Thank you for posting here! >> >> I am sorry for the delayed response due to weekend. Please understand that >> the newsgroups are staffed weekdays by Microsoft Support professionals to >> answer your systems and applications questions. Your understanding is >> greatly appreciated! >> >> Based on my research, there is no specific group policy available to >> disable users from changing the desktop. To achieve the goal, I suggest >> that you configure a group policy to redirect the Desktop of the user group >> to a network share. We can set the NTFS permission on the network share so >> that users cannot change their desktop. To do so, please perform the >> following steps: >> >> 1. Create a network share to store the desktop settings, such as >> \\server\desktops. >> 2. Open Active Directory Computers and Users snap-in. >> 3. Locate the appropriate OU or container and click Properties. >> 4. In the Group Policy tab, create a new group policy, and click Edit to >> open the Group Policy edit window. >> 5. Locate the following group policy: >> >> [User Configuration\Windows Settings\Folder Redirection\Desktop] >> >> 6. Right click Desktop, and then click Properties. >> 7. Select "Advanced settings: Specify locations for various user groups". >> 8. Click Add to select the user group that you want to restrict permission, >> and specify the Desktop share folder as \\server\desktops. >> 9. Select the Settings property page, and click to clear the "Grant user >> exclusive rights to my documents". You can also configure other settings >> according to your requirement. >> 10. Close all windows. >> 11. Click Start, and click Run. >> 12. Type "cmd" in the text box, and click OK. >> 13. Type the following command to refresh the group policy settings: >> >> SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE >> >> 14. In Windows Explorer, locate the desktop share folder and configure NTFS >> permission to prevent users from modifying the folder. >> 15. Logon as a user in the group to test. >> >> When users try to modify contents in the Desktop they will receive an error >> message saying "Access is denied". >> >> For more information about folder redirection, please refer to the >> following Microsoft Knowledge Base articles: >> >> 232692 Folder Redirection Feature in Windows >> http://support.microsoft.com/?id=232692 >> >> 288991 Enabling the Administrator to Have Access to Redirected Folders >> http://support.microsoft.com/?id=288991 >> >> Hope this helps! If you have any further concern or question about the >> issue, please feel free to let me know. You are always welcome! >> >> Have a nice day! >> >> Best Regards, >> >> Jenny Wu >> Microsoft CSS Online Newsgroup Support >> Get Secure! - www.microsoft.com/security >> ================================================== ==== >> This newsgroup only focuses on SBS technical issues. If you have issues >> regarding other Microsoft products, you'd better post in the corresponding >> newsgroups so that they can be resolved in an efficient and timely manner. >> You can locate the newsgroup here: >> http://www.microsoft.com/communities...s/default.aspx >> >> When opening a new thread via the web interface, we recommend you check the >> "Notify me of replies" box to receive e-mail notifications when there are >> any updates in your thread. When responding to posts via your newsreader, >> please "Reply to Group" so that others may learn and benefit from your >> issue. >> >> Microsoft engineers can only focus on one issue per thread. Although we >> provide other information for your reference, we recommend you post >> different incidents in different threads to keep the thread clean. In doing >> so, it will ensure your issues are resolved in a timely manner. >> >> For urgent issues, you may want to contact Microsoft CSS directly. Please >> check http://support.microsoft.com for regional support phone numbers. >> >> Any input or comments in this thread are highly appreciated. >> ================================================== ==== >> This posting is provided "AS IS" with no warranties, and confers no rights. >> >> -------------------- >> >Thread-Topic: Standard Desktop Wallpaper for all users >> >thread-index: AcWfXS/POE05PumNSNCBM3zx8R6DiA== >> >X-WBNR-Posting-Host: 84.9.38.174 >> >From: =?Utf-8?B?U2FhamFu?= <> >> >Subject: Standard Desktop Wallpaper for all users >> >Date: Fri, 12 Aug 2005 09:45:03 -0700 >> >Lines: 11 >> >Message-ID: <AB0983B7-E9BB-48BF-8F4A-> >> >MIME-Version: 1.0 >> >Content-Type: text/plain; >> > charset="Utf-8" >> >Content-Transfer-Encoding: 7bit >> >X-Newsreader: Microsoft CDO for Windows 2000 >> >Content-Class: urn:content-classes:message >> >Importance: normal >> >Priority: normal >> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0 >> >Newsgroups: microsoft.public.windows.server.sbs >> >NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250 >> >Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA02.phx.gbl!TK2MSF TNGXA03.phx.gbl >> >Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:143742 >> >X-Tomcat-NG: microsoft.public.windows.server.sbs >> > >> >Hi >> > >> >Our server is running Windows Small Business Server Premium 2003 with >> >Service Pack 1 and all clients are on Windows XP Professional Service Pack >> 2. >> >We would like to have our company's desktop wallpaper for all the users >> and >> >also prevent them from changing it. I tried enforcing this through Group >> >Policy in the Default Domain Policy on the server. But this shows no >> >wallpaper on any of the PCs. When the active desktop wallpaper is >> selected, >> >the wallpaper resolution is very bad. Is there a better way of doing this? >> >What should be the path of the wallpaper? How should be the attributes and >> >permissions set? Please help.. Many Thanks! >> > >> >> > |
|
|
|
|
|||
|
|||
|
Saajan
Guest
Posts: n/a
|
Hi
Thanks for your detailed reply. But I guess you didn't read my previous message properly when you replied for the second one. I had mentioned clearly that I tried enforcing this through Group Policy in the Default Domain Policy on the server. But this shows no wallpaper on any of the PCs. When the active desktop wallpaper is selected, the wallpaper resolution is very bad. Is there a better way of doing this? What should be the path of the wallpaper? How should be the attributes and permissions set? Also, all the users are already using roaming profiles, so the instructions on setting that up carries no value now, but I appreciate your effort and the time taken. Any other suggestions? Thanks a lot! ""Jenny wu [MSFT]"" wrote: > Hi, > > Thanks for your update! > > Suggestion 1: > > I am sorry for misunderstand you. If you want only prevent users from > changing wallpaper, you can do as follows: > > Method 1: > You can enable the group policy 'Active Desktop Wallpaper' and apply it to > domain users. The policy can specify the desktop background ("wallpaper") > displayed on all users' desktops. > > This setting lets you specify the wallpaper on users' desktops and prevents > users from changing the image or its presentation. The wallpaper you > specify can be stored in a bitmap (*.bmp), JPEG (*.jpg), or HTML (*.htm, > *.html) file. > > Location: User Configuration\Desktop\Active Desktop\ > > *Note: You need to enable the Active Desktop to use this setting. This > setting does not apply to Terminal Server sessions. > > Method 2: > You can enable the group policy ' Prevent changing wallpaper' and apply it > to domain users. The policy can prevent users from adding or changing the > background design of the desktop. > > Location: User Configuration\Control Panel\Display\ > > By default, users can use the Desktop tab of Display in Control Panel to > add a background design (wallpaper) to their desktop. > > If you enable this setting, the Desktop tab still appears, but all options > on the tab are disabled. If you want to remove the Desktop tab, use the > "Hide Desktop tab" setting. > > Suggestion 2: > > Technical speaking, the roaming profile is user-based. You need not prevent > users from changing their wallpaper. For your convenience, I list the > detail steps to setup roaming profile, you can refer to: > > 1. Create a Shared Folder to Store Roaming User Profiles. In SBS 2003, a > shared folder "\\sbsserver\Users" is created by default and used for this > purpose. > > 2. Configure user accounts to use roaming user profiles. > > To configure a user to use roaming profile: On the SBS server, in Server > Management, locate the user, right-click on it and click Properties. On the > Profile tab, type a UNC path in "Profile path", for example > \\sbsserver\users\%username%. > > 3. Since all the clients are running Windows XP, log on & log off, the user > profile will be upload to \\sbsserver\users\%username% automatically. > > If the clients are running Windows 2000, log on, in System properties > change the profile type to Roaming, then copy the profile to > \\server\profile\%username% and log off. > > Consider the following when implementing roaming profiles: > > 1. Do not use Offline Folder caching on roaming user profile shared > directories. > > It is important to turn off Offline Folder caching for shared directories > where roaming user profiles are stored. If you do not turn off Offline > Folder caching for a user''s profile, you might experience synchronization > problems when both Offline Folders and roaming user profiles try to > synchronize the files in a user''s profile. This does not affect your > ability to use Offline Folders with redirected folders such as My > Documents. > > 2. Do not use Encrypted File System (EFS) on files in a roaming user > profile. > > The Encrypted File System (EFS) is not compatible with roaming user > profiles. If you encrypt profile folders or files in the user profile using > EFS, the user''s profile will not roam. > > 3. Do not set disk quotas too low for users with roaming user profiles. > > If a user''s disk quotas are set too low, roaming user profile > synchronization might fail. Make sure enough disk space is allocated to > allow the system to create a temporary duplicate copy of a user''s profile. > The temporary profile is created in the user''s context as part of the > synchronization process, so it debits the user''s quota. > > 4. When creating a roaming profile shared directory, limit access to only > those users that need access. > > - Because a users roaming profile can contain personal information such as > confidential documents and EFS certificates, care should be taken to > protect access to the shared directory. Restrict access to the shared > directory to only those users that need access. You can also create a > security group for users that have profiles on a particular shared > directory, and limit access to only those users. > > - Only give users the minimum amount of permissions needed. > > - When creating the shared directory, hide it by putting a $ after the > share name. This hides the shared directory from casual browsers, and it > will not be visible in My Network Places. > > 5. Use at least Windows 2000 servers to host user roaming profile shared > directories. > > Because a users roaming profile contains personal information which is > copied to and from a client computer, and the server hosting the roaming > profile, it is important to ensure that data is protected as it travels > over the network. Potential threats to the privacy and integrity of a > user''s data come from intercepting the data as it passes over the network, > tampering with the data as it passes over the network, and spoofing the > server hosting the user''s data. Features such as Kerberos, IPSec, and > Server Message Block (SMB) signing included in Windows 2000 and the Windows > Server 2003 family can help to secure a user''s data. > > 6. Always use the NTFS file system for volumes holding user''s data. > > Configure servers hosting roaming profiles to use the NTFS File System. > Unlike FAT, NTFS supports Discretionary access control lists (DACLs) and > system access control lists (SACLs), which control who can perform > operations on a file and what events will trigger logging of actions > performed on a file. > > Related information: > > 324749 How To Create a Roaming User Profile in Windows Server 2003 > http://support.microsoft.com/?id=324749 > > 316353 How to configure a user account to use a roaming user profile in > Windows Server 2003, Windows 2000 Server, or Windows NT 4.0 > http://support.microsoft.com/?id=316353 > > Hope above information helps! please try my suggestion and let me know the > result. > > Have a nice day! > > Best Regards, > > Jenny Wu > Microsoft CSS Online Newsgroup Support > Get Secure! - www.microsoft.com/security > ================================================== ==== > This newsgroup only focuses on SBS technical issues. If you have issues > regarding other Microsoft products, you'd better post in the corresponding > newsgroups so that they can be resolved in an efficient and timely manner. > You can locate the newsgroup here: > http://www.microsoft.com/communities...s/default.aspx > > When opening a new thread via the web interface, we recommend you check the > "Notify me of replies" box to receive e-mail notifications when there are > any updates in your thread. When responding to posts via your newsreader, > please "Reply to Group" so that others may learn and benefit from your > issue. > > Microsoft engineers can only focus on one issue per thread. Although we > provide other information for your reference, we recommend you post > different incidents in different threads to keep the thread clean. In doing > so, it will ensure your issues are resolved in a timely manner. > > For urgent issues, you may want to contact Microsoft CSS directly. Please > check http://support.microsoft.com for regional support phone numbers. > > Any input or comments in this thread are highly appreciated. > ================================================== ==== > This posting is provided "AS IS" with no warranties, and confers no rights. > > -------------------- > >Thread-Topic: Standard Desktop Wallpaper for all users > >thread-index: AcWhdDurrYVPoFY7T2ex/GQNV9c2bQ== > >X-WBNR-Posting-Host: 81.179.99.59 > >From: =?Utf-8?B?U2FhamFu?= <> > >References: <AB0983B7-E9BB-48BF-8F4A-> > <> > >Subject: RE: Standard Desktop Wallpaper for all users > >Date: Mon, 15 Aug 2005 01:35:03 -0700 > >Lines: 148 > >Message-ID: <67AB41DC-F7EA-498D-A259-> > >MIME-Version: 1.0 > >Content-Type: text/plain; > > charset="Utf-8" > >Content-Transfer-Encoding: 7bit > >X-Newsreader: Microsoft CDO for Windows 2000 > >Content-Class: urn:content-classes:message > >Importance: normal > >Priority: normal > >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0 > >Newsgroups: microsoft.public.windows.server.sbs > >NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250 > >Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFT NGXA03.phx.gbl > >Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:144366 > >X-Tomcat-NG: microsoft.public.windows.server.sbs > > > >Hi > > > >Thank you for your detailed reply. Well, I saw an option in the group > policy > >to prevent users from changing the desktop wallpaper, but I do not know > how > >effective it is. Also, I have enabled this setting on individual PCs on > the > >network so that the users will not be able to change it. This does not > allow > >the users to change it using the Display Properties, but they can still > >change it using Set as Background option available for most images. Also, > we > >have a number of users who have no computer assigned to them and all the > >users have roaming profile. The setting has to be in such a way that any > user > >who logs on to any computer must have the same wallpaper. I guess the best > >way to achieve this is to associate the wallpaper with the user profiles. > Is > >there a way to do this? Any ideas welcome. Thanks again! > > > >""Jenny wu [MSFT]"" wrote: > > > >> Hi, > >> > >> Thank you for posting here! > >> > >> I am sorry for the delayed response due to weekend. Please understand > that > >> the newsgroups are staffed weekdays by Microsoft Support professionals > to > >> answer your systems and applications questions. Your understanding is > >> greatly appreciated! > >> > >> Based on my research, there is no specific group policy available to > >> disable users from changing the desktop. To achieve the goal, I suggest > >> that you configure a group policy to redirect the Desktop of the user > group > >> to a network share. We can set the NTFS permission on the network share > so > >> that users cannot change their desktop. To do so, please perform the > >> following steps: > >> > >> 1. Create a network share to store the desktop settings, such as > >> \\server\desktops. > >> 2. Open Active Directory Computers and Users snap-in. > >> 3. Locate the appropriate OU or container and click Properties. > >> 4. In the Group Policy tab, create a new group policy, and click Edit to > >> open the Group Policy edit window. > >> 5. Locate the following group policy: > >> > >> [User Configuration\Windows Settings\Folder Redirection\Desktop] > >> > >> 6. Right click Desktop, and then click Properties. > >> 7. Select "Advanced settings: Specify locations for various user groups". > >> 8. Click Add to select the user group that you want to restrict > permission, > >> and specify the Desktop share folder as \\server\desktops. > >> 9. Select the Settings property page, and click to clear the "Grant user > >> exclusive rights to my documents". You can also configure other settings > >> according to your requirement. > >> 10. Close all windows. > >> 11. Click Start, and click Run. > >> 12. Type "cmd" in the text box, and click OK. > >> 13. Type the following command to refresh the group policy settings: > >> > >> SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE > >> > >> 14. In Windows Explorer, locate the desktop share folder and configure > NTFS > >> permission to prevent users from modifying the folder. > >> 15. Logon as a user in the group to test. > >> > >> When users try to modify contents in the Desktop they will receive an > error > >> message saying "Access is denied". > >> > >> For more information about folder redirection, please refer to the > >> following Microsoft Knowledge Base articles: > >> > >> 232692 Folder Redirection Feature in Windows > >> http://support.microsoft.com/?id=232692 > >> > >> 288991 Enabling the Administrator to Have Access to Redirected Folders > >> http://support.microsoft.com/?id=288991 > >> > >> Hope this helps! If you have any further concern or question about the > >> issue, please feel free to let me know. You are always welcome! > >> > >> Have a nice day! > >> > >> Best Regards, > >> > >> Jenny Wu > >> Microsoft CSS Online Newsgroup Support > >> Get Secure! - www.microsoft.com/security > >> ================================================== ==== > >> This newsgroup only focuses on SBS technical issues. If you have issues > >> regarding other Microsoft products, you'd better post in the > corresponding > >> newsgroups so that they can be resolved in an efficient and timely > manner. > >> You can locate the newsgroup here: |
|
|
|
|
|||
|
|||
|
Jenny wu [MSFT]
Guest
Posts: n/a
|
Hi,
If you want to prevent domain users from changing wallpaper on Windows OS, the group policy 'Active Desktop Wallpaper' should be the best method. And also you can write some script to implement it. We recommend you use the group policy. I am sorry for not list the detail steps in above post, the steps: 1. Right-click the group policy objects you want to use and click 'Edit' to open Group Policy Object Editor. 2. Please locate to 'User Configuration\AdministrativeTemplates\Desktop\Acti ve Desktop' and double-click 'Active Desktop Wallpaper' to open it Properties. 3. Click 'Eabled' and Type the fully-qualified path and file name that stores the wallpaper image (generally we use UNC path). *Note: You can type a local path, such as C:\Windows\web\wallpaper\home.jpg (if you choose this path, you must ensure all client workstations have the picture in C:\Windows\web\wallpaper\home.jpg) or a UNC path, such as \\Server\Share\Corp.jpg. If the specified file is not available when the user logs on, no wallpaper is displayed. Users cannot specify alternative wallpaper. You can also use this setting to specify that the wallpaper image be centered, tiled, or stretched. Users cannot change this specification. 4. Click 'Apply' button and click ok to finish the configuration. 5. The configuration takes effect when users logon OS next time. Note: You need to enable the Active Desktop to use this setting (the policy list above item of 'Active Desktop Wallpaper' in the same location). In server there are no desktop background pictures which show in Windows XP workstation. You can copy these pictures to the server and you can find these wallpapers in Windows XP by default in: C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures The above steps I have test that work perfect and users can not change the wallpaper through setting picture as desktop background. Using the policy to apply wallpaper can not affect picture resolution, the issue caused by the picture is small and you specify it be stretched. Please try to use the picture which is wallpaper in workstations to test, how about the result? Hope this helps! I appreciate your time and effort to perform test. I am looking forward to you reply. Have a nice day! Best Regards, Jenny Wu Microsoft CSS Online Newsgroup Support Get Secure! - www.microsoft.com/security ================================================== ==== This newsgroup only focuses on SBS technical issues. If you have issues regarding other Microsoft products, you'd better post in the corresponding newsgroups so that they can be resolved in an efficient and timely manner. You can locate the newsgroup here: http://www.microsoft.com/communities...s/default.aspx When opening a new thread via the web interface, we recommend you check the "Notify me of replies" box to receive e-mail notifications when there are any updates in your thread. When responding to posts via your newsreader, please "Reply to Group" so that others may learn and benefit from your issue. Microsoft engineers can only focus on one issue per thread. Although we provide other information for your reference, we recommend you post different incidents in different threads to keep the thread clean. In doing so, it will ensure your issues are resolved in a timely manner. For urgent issues, you may want to contact Microsoft CSS directly. Please check http://support.microsoft.com for regional support phone numbers. Any input or comments in this thread are highly appreciated. ================================================== ==== This posting is provided "AS IS" with no warranties, and confers no rights. -------------------- >Thread-Topic: Standard Desktop Wallpaper for all users >thread-index: AcWif3iRYVOtcFPRSI6FwVzuOSn1zQ== >X-WBNR-Posting-Host: 84.9.38.174 >From: =?Utf-8?B?U2FhamFu?= <> >References: <AB0983B7-E9BB-48BF-8F4A-> <> <67AB41DC-F7EA-498D-A259-> <by#> >Subject: RE: Standard Desktop Wallpaper for all users >Date: Tue, 16 Aug 2005 09:28:01 -0700 >Lines: 319 >Message-ID: <537B7E80-D398-44C2-84F3-> >MIME-Version: 1.0 >Content-Type: text/plain; > charset="Utf-8" >Content-Transfer-Encoding: 7bit >X-Newsreader: Microsoft CDO for Windows 2000 >Content-Class: urn:content-classes:message >Importance: normal >Priority: normal >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0 >Newsgroups: microsoft.public.windows.server.sbs >NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250 >Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl >Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:144922 >X-Tomcat-NG: microsoft.public.windows.server.sbs > >Hi > >Thanks for your detailed reply. But I guess you didn't read my previous >message properly when you replied for the second one. I had mentioned clearly >that > >I tried enforcing this through Group Policy in the Default Domain Policy on >the server. But this shows no wallpaper on any of the PCs. When the active >desktop wallpaper is selected, >the wallpaper resolution is very bad. Is there a better way of doing this? >What should be the path of the wallpaper? How should be the attributes and >permissions set? > >Also, all the users are already using roaming profiles, so the instructions >on setting that up carries no value now, but I appreciate your effort and the >time taken. Any other suggestions? Thanks a lot! > >""Jenny wu [MSFT]"" wrote: > >> Hi, >> >> Thanks for your update! >> >> Suggestion 1: >> >> I am sorry for misunderstand you. If you want only prevent users from >> changing wallpaper, you can do as follows: >> >> Method 1: >> You can enable the group policy 'Active Desktop Wallpaper' and apply it to >> domain users. The policy can specify the desktop background ("wallpaper") >> displayed on all users' desktops. >> >> This setting lets you specify the wallpaper on users' desktops and prevents >> users from changing the image or its presentation. The wallpaper you >> specify can be stored in a bitmap (*.bmp), JPEG (*.jpg), or HTML (*.htm, >> *.html) file. >> >> Location: User Configuration\Desktop\Active Desktop\ >> >> *Note: You need to enable the Active Desktop to use this setting. This >> setting does not apply to Terminal Server sessions. >> >> Method 2: >> You can enable the group policy ' Prevent changing wallpaper' and apply it >> to domain users. The policy can prevent users from adding or changing the >> background design of the desktop. >> >> Location: User Configuration\Control Panel\Display\ >> >> By default, users can use the Desktop tab of Display in Control Panel to >> add a background design (wallpaper) to their desktop. >> >> If you enable this setting, the Desktop tab still appears, but all options >> on the tab are disabled. If you want to remove the Desktop tab, use the >> "Hide Desktop tab" setting. >> >> Suggestion 2: >> >> Technical speaking, the roaming profile is user-based. You need not prevent >> users from changing their wallpaper. For your convenience, I list the >> detail steps to setup roaming profile, you can refer to: >> >> 1. Create a Shared Folder to Store Roaming User Profiles. In SBS 2003, a >> shared folder "\\sbsserver\Users" is created by default and used for this >> purpose. >> >> 2. Configure user accounts to use roaming user profiles. >> >> To configure a user to use roaming profile: On the SBS server, in Server >> Management, locate the user, right-click on it and click Properties. On the >> Profile tab, type a UNC path in "Profile path", for example >> \\sbsserver\users\%username%. >> >> 3. Since all the clients are running Windows XP, log on & log off, the user >> profile will be upload to \\sbsserver\users\%username% automatically. >> >> If the clients are running Windows 2000, log on, in System properties >> change the profile type to Roaming, then copy the profile to >> \\server\profile\%username% and log off. >> >> Consider the following when implementing roaming profiles: >> >> 1. Do not use Offline Folder caching on roaming user profile shared >> directories. >> >> It is important to turn off Offline Folder caching for shared directories >> where roaming user profiles are stored. If you do not turn off Offline >> Folder caching for a user''s profile, you might experience synchronization >> problems when both Offline Folders and roaming user profiles try to >> synchronize the files in a user''s profile. This does not affect your >> ability to use Offline Folders with redirected folders such as My >> Documents. >> >> 2. Do not use Encrypted File System (EFS) on files in a roaming user >> profile. >> >> The Encrypted File System (EFS) is not compatible with roaming user >> profiles. If you encrypt profile folders or files in the user profile using >> EFS, the user''s profile will not roam. >> >> 3. Do not set disk quotas too low for users with roaming user profiles. >> >> If a user''s disk quotas are set too low, roaming user profile >> synchronization might fail. Make sure enough disk space is allocated to >> allow the system to create a temporary duplicate copy of a user''s profile. >> The temporary profile is created in the user''s context as part of the >> synchronization process, so it debits the user''s quota. >> >> 4. When creating a roaming profile shared directory, limit access to only >> those users that need access. >> >> - Because a users roaming profile can contain personal information such as >> confidential documents and EFS certificates, care should be taken to >> protect access to the shared directory. Restrict access to the shared >> directory to only those users that need access. You can also create a >> security group for users that have profiles on a particular shared >> directory, and limit access to only those users. >> >> - Only give users the minimum amount of permissions needed. >> >> - When creating the shared directory, hide it by putting a $ after the >> share name. This hides the shared directory from casual browsers, and it >> will not be visible in My Network Places. >> >> 5. Use at least Windows 2000 servers to host user roaming profile shared >> directories. >> >> Because a users roaming profile contains personal information which is >> copied to and from a client computer, and the server hosting the roaming >> profile, it is important to ensure that data is protected as it travels >> over the network. Potential threats to the privacy and integrity of a >> user''s data come from intercepting the data as it passes over the network, >> tampering with the data as it passes over the network, and spoofing the >> server hosting the user''s data. Features such as Kerberos, IPSec, and >> Server Message Block (SMB) signing included in Windows 2000 and the Windows >> Server 2003 family can help to secure a user''s data. >> >> 6. Always use the NTFS file system for volumes holding user''s data. >> >> Configure servers hosting roaming profiles to use the NTFS File System. >> Unlike FAT, NTFS supports Discretionary access control lists (DACLs) and >> system access control lists (SACLs), which control who can perform >> operations on a file and what events will trigger logging of actions >> performed on a file. >> >> Related information: >> >> 324749 How To Create a Roaming User Profile in Windows Server 2003 >> http://support.microsoft.com/?id=324749 >> >> 316353 How to configure a user account to use a roaming user profile in >> Windows Server 2003, Windows 2000 Server, or Windows NT 4.0 >> http://support.microsoft.com/?id=316353 >> >> Hope above information helps! please try my suggestion and let me know the >> result. >> >> Have a nice day! >> >> Best Regards, >> >> Jenny Wu >> Microsoft CSS Online Newsgroup Support >> Get Secure! - www.microsoft.com/security >> ================================================== ==== >> This newsgroup only focuses on SBS technical issues. If you have issues >> regarding other Microsoft products, you'd better post in the corresponding >> newsgroups so that they can be resolved in an efficient and timely manner. >> You can locate the newsgroup here: >> http://www.microsoft.com/communities...s/default.aspx >> >> When opening a new thread via the web interface, we recommend you check the >> "Notify me of replies" box to receive e-mail notifications when there are >> any updates in your thread. When responding to posts via your newsreader, >> please "Reply to Group" so that others may learn and benefit from your >> issue. >> >> Microsoft engineers can only focus on one issue per thread. Although we >> provide other information for your reference, we recommend you post >> different incidents in different threads to keep the thread clean. In doing >> so, it will ensure your issues are resolved in a timely manner. >> >> For urgent issues, you may want to contact Microsoft CSS directly. Please >> check http://support.microsoft.com for regional support phone numbers. >> >> Any input or comments in this thread are highly appreciated. >> ================================================== ==== >> This posting is provided "AS IS" with no warranties, and confers no rights. >> >> -------------------- >> >Thread-Topic: Standard Desktop Wallpaper for all users >> >thread-index: AcWhdDurrYVPoFY7T2ex/GQNV9c2bQ== >> >X-WBNR-Posting-Host: 81.179.99.59 >> >From: =?Utf-8?B?U2FhamFu?= <> >> >References: <AB0983B7-E9BB-48BF-8F4A-> >> <> >> >Subject: RE: Standard Desktop Wallpaper for all users >> >Date: Mon, 15 Aug 2005 01:35:03 -0700 >> >Lines: 148 >> >Message-ID: <67AB41DC-F7EA-498D-A259-> >> >MIME-Version: 1.0 >> >Content-Type: text/plain; >> > charset="Utf-8" >> >Content-Transfer-Encoding: 7bit >> >X-Newsreader: Microsoft CDO for Windows 2000 >> >Content-Class: urn:content-classes:message >> >Importance: normal >> >Priority: normal >> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0 >> >Newsgroups: microsoft.public.windows.server.sbs >> >NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250 >> >Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFT NGXA03.phx.gbl >> >Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:144366 >> >X-Tomcat-NG: microsoft.public.windows.server.sbs >> > >> >Hi >> > >> >Thank you for your detailed reply. Well, I saw an option in the group >> policy >> >to prevent users from changing the desktop wallpaper, but I do not know >> how >> >effective it is. Also, I have enabled this setting on individual PCs on >> the >> >network so that the users will not be able to change it. This does not >> allow >> >the users to change it using the Display Properties, but they can still >> >change it using Set as Background option available for most images. Also, >> we >> >have a number of users who have no computer assigned to them and all the >> >users have roaming profile. The setting has to be in such a way that any >> user >> >who logs on to any computer must have the same wallpaper. I guess the best >> >way to achieve this is to associate the wallpaper with the user profiles. >> Is >> >there a way to do this? Any ideas welcome. Thanks again! >> > >> >""Jenny wu [MSFT]"" wrote: >> > >> >> Hi, >> >> >> >> Thank you for posting here! >> >> >> >> I am sorry for the delayed response due to weekend. Please understand >> that >> >> the newsgroups are staffed weekdays by Microsoft Support professionals >> to >> >> answer your systems and applications questions. Your understanding is >> >> greatly appreciated! >> >> >> >> Based on my research, there is no specific group policy available to >> >> disable users from changing the desktop. To achieve the goal, I suggest >> >> that you configure a group policy to redirect the Desktop of the user >> group >> >> to a network share. We can set the NTFS permission on the network share >> so >> >> that users cannot change their desktop. To do so, please perform the >> >> following steps: >> >> >> >> 1. Create a network share to store the desktop settings, such as >> >> \\server\desktops. >> >> 2. Open Active Directory Computers and Users snap-in. >> >> 3. Locate the appropriate OU or container and click Properties. >> >> 4. In the Group Policy tab, create a new group policy, and click Edit to >> >> open the Group Policy edit window. >> >> 5. Locate the following group policy: >> >> >> >> [User Configuration\Windows Settings\Folder Redirection\Desktop] >> >> >> >> 6. Right click Desktop, and then click Properties. >> >> 7. Select "Advanced settings: Specify locations for various user groups". >> >> 8. Click Add to select the user group that you want to restrict >> permission, >> >> and specify the Desktop share folder as \\server\desktops. >> >> 9. Select the Settings property page, and click to clear the "Grant user >> >> exclusive rights to my documents". You can also configure other settings >> >> according to your requirement. >> >> 10. Close all windows. >> >> 11. Click Start, and click Run. >> >> 12. Type "cmd" in the text box, and click OK. >> >> 13. Type the following command to refresh the group policy settings: >> >> >> >> SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE >> >> >> >> 14. In Windows Explorer, locate the desktop share folder and configure >> NTFS >> >> permission to prevent users from modifying the folder. >> >> 15. Logon as a user in the group to test. >> >> >> >> When users try to modify contents in the Desktop they will receive an >> error >> >> message saying "Access is denied". >> >> >> >> For more information about folder redirection, please refer to the >> >> following Microsoft Knowledge Base articles: >> >> >> >> 232692 Folder Redirection Feature in Windows >> >> http://support.microsoft.com/?id=232692 >> >> >> >> 288991 Enabling the Administrator to Have Access to Redirected Folders >> >> http://support.microsoft.com/?id=288991 >> >> >> >> Hope this helps! If you have any further concern or question about the >> >> issue, please feel free to let me know. You are always welcome! >> >> >> >> Have a nice day! >> >> >> >> Best Regards, >> >> >> >> Jenny Wu >> >> Microsoft CSS Online Newsgroup Support >> >> Get Secure! - www.microsoft.com/security >> >> ================================================== ==== >> >> This newsgroup only focuses on SBS technical issues. If you have issues >> >> regarding other Microsoft products, you'd better post in the >> corresponding >> >> newsgroups so that they can be resolved in an efficient and timely >> manner. >> >> You can locate the newsgroup here: > |
|
|
|
|
|||
|
|||
|
Saajan
Guest
Posts: n/a
|
Hi
Thanks for your reply. I have tried this setting before and it didn't work for me. As mentioned earlier, when I enabled the Active Desktop Wallpaper and specified the wallpaper, the resolution is not very impressive. But when the wallpaper is set otherwise, the resolution is perfect. Also, could you please tell me, if the wallpaper is specified this way and if it works, will all the users have the same wallpaper if they log on to any PC? What about the users who do not have a PC assigned to them? As I specified earlier, all the users are using roaming profiles. Will the wallpaper be associated with their profiles? Thanks again for your help! I will try once more anyway and let you know. Regards, ""Jenny wu [MSFT]"" wrote: > Hi, > > If you want to prevent domain users from changing wallpaper on Windows OS, > the group policy 'Active Desktop Wallpaper' should be the best method. And > also you can write some script to implement it. We recommend you use the > group policy. > > I am sorry for not list the detail steps in above post, the steps: > > 1. Right-click the group policy objects you want to use and click 'Edit' to > open Group Policy Object Editor. > 2. Please locate to 'User > Configuration\AdministrativeTemplates\Desktop\Acti ve Desktop' and > double-click 'Active Desktop Wallpaper' to open it Properties. > 3. Click 'Eabled' and Type the fully-qualified path and file name that > stores the wallpaper image (generally we use UNC path). > > *Note: You can type a local path, such as > C:\Windows\web\wallpaper\home.jpg (if you choose this path, you must ensure > all client workstations have the picture in > C:\Windows\web\wallpaper\home.jpg) or a UNC path, such as > \\Server\Share\Corp.jpg. > > If the specified file is not available when the user logs on, no wallpaper > is displayed. Users cannot specify alternative wallpaper. You can also use > this setting to specify that the wallpaper image be centered, tiled, or > stretched. Users cannot change this specification. > > 4. Click 'Apply' button and click ok to finish the configuration. > 5. The configuration takes effect when users logon OS next time. > > Note: You need to enable the Active Desktop to use this setting (the policy > list above item of 'Active Desktop Wallpaper' in the same location). > > In server there are no desktop background pictures which show in Windows XP > workstation. You can copy these pictures to the server and you can find > these wallpapers in Windows XP by default in: C:\Documents and Settings\All > Users\Documents\My Pictures\Sample Pictures > > The above steps I have test that work perfect and users can not change the > wallpaper through setting picture as desktop background. Using the policy > to apply wallpaper can not affect picture resolution, the issue caused by > the picture is small and you specify it be stretched. Please try to use the > picture which is wallpaper in workstations to test, how about the result? > > Hope this helps! I appreciate your time and effort to perform test. I am > looking forward to you reply. > > Have a nice day! > > Best Regards, > > Jenny Wu > Microsoft CSS Online Newsgroup Support > Get Secure! - www.microsoft.com/security > ================================================== ==== > This newsgroup only focuses on SBS technical issues. If you have issues > regarding other Microsoft products, you'd better post in the corresponding > newsgroups so that they can be resolved in an efficient and timely manner. > You can locate the newsgroup here: > http://www.microsoft.com/communities...s/default.aspx > > When opening a new thread via the web interface, we recommend you check the > "Notify me of replies" box to receive e-mail notifications when there are > any updates in your thread. When responding to posts via your newsreader, > please "Reply to Group" so that others may learn and benefit from your > issue. > > Microsoft engineers can only focus on one issue per thread. Although we > provide other information for your reference, we recommend you post > different incidents in different threads to keep the thread clean. In doing > so, it will ensure your issues are resolved in a timely manner. > > For urgent issues, you may want to contact Microsoft CSS directly. Please > check http://support.microsoft.com for regional support phone numbers. > > Any input or comments in this thread are highly appreciated. > ================================================== ==== > This posting is provided "AS IS" with no warranties, and confers no rights. > > -------------------- > >Thread-Topic: Standard Desktop Wallpaper for all users > >thread-index: AcWif3iRYVOtcFPRSI6FwVzuOSn1zQ== > >X-WBNR-Posting-Host: 84.9.38.174 > >From: =?Utf-8?B?U2FhamFu?= <> > >References: <AB0983B7-E9BB-48BF-8F4A-> > <> > <67AB41DC-F7EA-498D-A259-> > <by#> > >Subject: RE: Standard Desktop Wallpaper for all users > >Date: Tue, 16 Aug 2005 09:28:01 -0700 > >Lines: 319 > >Message-ID: <537B7E80-D398-44C2-84F3-> > >MIME-Version: 1.0 > >Content-Type: text/plain; > > charset="Utf-8" > >Content-Transfer-Encoding: 7bit > >X-Newsreader: Microsoft CDO for Windows 2000 > >Content-Class: urn:content-classes:message > >Importance: normal > >Priority: normal > >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0 > >Newsgroups: microsoft.public.windows.server.sbs > >NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250 > >Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl > >Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:144922 > >X-Tomcat-NG: microsoft.public.windows.server.sbs > > > >Hi > > > >Thanks for your detailed reply. But I guess you didn't read my previous > >message properly when you replied for the second one. I had mentioned > clearly > >that > > > >I tried enforcing this through Group Policy in the Default Domain Policy > on > >the server. But this shows no wallpaper on any of the PCs. When the active > >desktop wallpaper is selected, > >the wallpaper resolution is very bad. Is there a better way of doing this? > >What should be the path of the wallpaper? How should be the attributes and > >permissions set? > > > >Also, all the users are already using roaming profiles, so the > instructions > >on setting that up carries no value now, but I appreciate your effort and > the > >time taken. Any other suggestions? Thanks a lot! > > > >""Jenny wu [MSFT]"" wrote: > > > >> Hi, > >> > >> Thanks for your update! > >> > >> Suggestion 1: > >> > >> I am sorry for misunderstand you. If you want only prevent users from > >> changing wallpaper, you can do as follows: > >> > >> Method 1: > >> You can enable the group policy 'Active Desktop Wallpaper' and apply it > to > >> domain users. The policy can specify the desktop background > ("wallpaper") > >> displayed on all users' desktops. > >> > >> This setting lets you specify the wallpaper on users' desktops and > prevents > >> users from changing the image or its presentation. The wallpaper you > >> specify can be stored in a bitmap (*.bmp), JPEG (*.jpg), or HTML (*.htm, > >> *.html) file. > >> > >> Location: User Configuration\Desktop\Active Desktop\ > >> > >> *Note: You need to enable the Active Desktop to use this setting. This > >> setting does not apply to Terminal Server sessions. > >> > >> Method 2: > >> You can enable the group policy ' Prevent changing wallpaper' and apply > it > >> to domain users. The policy can prevent users from adding or changing > the > >> background design of the desktop. > >> > >> Location: User Configuration\Control Panel\Display\ > >> > >> By default, users can use the Desktop tab of Display in Control Panel to > >> add a background design (wallpaper) to their desktop. > >> > >> If you enable this setting, the Desktop tab still appears, but all > options > >> on the tab are disabled. If you want to remove the Desktop tab, use the > >> "Hide Desktop tab" setting. > >> > >> Suggestion 2: > >> > >> Technical speaking, the roaming profile is user-based. You need not > prevent > >> users from changing their wallpaper. For your convenience, I list the > >> detail steps to setup roaming profile, you can refer to: > >> > >> 1. Create a Shared Folder to Store Roaming User Profiles. In SBS 2003, a > >> shared folder "\\sbsserver\Users" is created by default and used for > this > >> purpose. > >> > >> 2. Configure user accounts to use roaming user profiles. > >> > >> To configure a user to use roaming profile: On the SBS server, in Server > >> Management, locate the user, right-click on it and click Properties. On > the > >> Profile tab, type a UNC path in "Profile path", for example > >> \\sbsserver\users\%username%. > >> > >> 3. Since all the clients are running Windows XP, log on & log off, the > user > >> profile will be upload to \\sbsserver\users\%username% automatically. > >> > >> If the clients are running Windows 2000, log on, in System properties > >> change the profile type to Roaming, then copy the profile to > >> \\server\profile\%username% and log off. > >> > >> Consider the following when implementing roaming profiles: > >> > >> 1. Do not use Offline Folder caching on roaming user profile shared > >> directories. > >> > >> It is important to turn off Offline Folder caching for shared > directories > >> where roaming user profiles are stored. If you do not turn off Offline > >> Folder caching for a user''s profile, you might experience > synchronization > >> problems when both Offline Folders and roaming user profiles try to > >> synchronize the files in a user''s profile. This does not affect your > >> ability to use Offline Folders with redirected folders such as My > >> Documents. > >> > >> 2. Do not use Encrypted File System (EFS) on files in a roaming user > >> profile. > >> > >> The Encrypted File System (EFS) is not compatible with roaming user > >> profiles. If you encrypt profile folders or files in the user profile > using > >> EFS, the user''s profile will not roam. > >> > >> 3. Do not set disk quotas too low for users with roaming user profiles. > >> > >> If a user''s disk quotas are set too low, roaming user profile > >> synchronization might fail. Make sure enough disk space is allocated to > >> allow the system to create a temporary duplicate copy of a user''s > profile. > >> The temporary profile is created in the user''s context as part of the > >> synchronization process, so it debits the user''s quota. > >> > >> 4. When creating a roaming profile shared directory, limit access to > only > >> those users that need access. > >> > >> - Because a users roaming profile can contain personal information such > as > >> confidential documents and EFS certificates, care should be taken to > >> protect access to the shared directory. Restrict access to the shared > >> directory to only those users that need access. You can also create a > >> security group for users that have profiles on a particular shared > >> directory, and limit access to only those users. > >> > >> - Only give users the minimum amount of permissions needed. > >> > >> - When creating the shared directory, hide it by putting a $ after the > >> share name. This hides the shared directory from casual browsers, and it > >> will not be visible in My Network Places. > >> > >> 5. Use at least Windows 2000 servers to host user roaming profile shared > >> directories. > >> > >> Because a users roaming profile contains personal information which is > >> copied to and from a client computer, and the server hosting the roaming > >> profile, it is important to ensure that data is protected as it travels > >> over the network. Potential threats to the privacy and integrity of a > >> user''s data come from intercepting the data as it passes over the > network, > >> tampering with the data as it passes over the network, and spoofing the > >> server hosting the user''s data. Features such as Kerberos, IPSec, and > >> Server Message Block (SMB) signing included in Windows 2000 and the > Windows > >> Server 2003 family can help to secure a user''s data. > >> > >> 6. Always use the NTFS file system for volumes holding user''s data. > >> > >> Configure servers hosting roaming profiles to use the NTFS File System. > >> Unlike FAT, NTFS supports Discretionary access control lists (DACLs) and > >> system access control lists (SACLs), which control who can perform > >> operations on a file and what events will trigger logging of actions > >> performed on a file. > >> > >> Related information: > >> > >> 324749 How To Create a Roaming User Profile in Windows Server 2003 > >> http://support.microsoft.com/?id=324749 > >> > >> 316353 How to configure a user account to use a roaming user profile in > >> Windows Server 2003, Windows 2000 Server, or Windows NT 4.0 > >> http://support.microsoft.com/?id=316353 > >> > >> Hope above information helps! please try my suggestion and let me know > the > >> result. > >> > >> Have a nice day! > >> > >> Best Regards, > >> > >> Jenny Wu > >> Microsoft CSS Online Newsgroup Support > >> Get Secure! - www.microsoft.com/security > >> ================================================== ==== > >> This newsgroup only focuses on SBS technical issues. If you have issues > >> regarding other Microsoft products, you'd better post in the > corresponding |
|
|
|
|
|||
|
|||
|
Jenny wu \(MSFT\)
Guest
Posts: n/a
|
Hi,
Thanks for your update! I appreciate your time and effort to the issue. I have test the policy some times, it work well in my side. My system is SBS 2003, and all clients are Windows XP sp2. What is meaning of picture resolution? Can you give me screen shots of the wallpaper in two different situation? you can send it to my mail address: v- When the policy work, all domain users have the same wallpaper and they can not change it no matter which computer they logon in domain. In fact, domain users can logon to any computer using their user account and password in domain, which is significantly character. Users profiles includes desktop configuration which includes wallpaper, but the wallpaper policy is a domain policy which is precedence over users' configuration. So however if you configure in profile, it can not take effect when group policy work. I would like to go through the steps again with you to try to test the issue. Please strictly follow my steps to do to test if it works: 1. Type 'gpmc.msc'(no quotations marks) to open the Group Policy console and right-click Default Domain Policy and click Edit to open Group Policy Object Editor. 2. Please locate to 'User Configuration\AdministrativeTemplates\Desktop\Acti ve Desktop' and double-click 'Active Desktop Wallpaper' to open it Properties. 3. Click 'Eabled' and Type the fully-qualified path and file name that stores the wallpaper image (generally we use UNC path) and choose which method the image shows (centered, tiled, or stretched). *Note: You can type a local path, such as C:\Windows\web\wallpaper\home.jpg (if you choose this path, you must ensure all client workstations have the picture in C:\Windows\web\wallpaper\home.jpg) or a UNC path, such as \\Server\Share\Corp.jpg. If the specified file is not available when the user logs on, no wallpaper is displayed. Users cannot specify alternative wallpaper. You can also use this setting to specify that the wallpaper image be centered, tiled, or stretched. Users cannot change this specification. 4. Click 'Apply' button and click ok to finish the configuration. 5. And enable the Active Desktop to use this setting (the policy list above item of 'Active Desktop Wallpaper' in the same location). 6. Please locate to 'User Configuration\AdministrativeTemplates\Control Panel\Display\' and double click the policy ' Prevent changing wallpaper' to enable the policy. *Note: The policy can prevent users from adding or changing the background design of the desktop. these two policy combination will meet your requirements totally. 7. Type 'gpupdate /force' (no quotations marks) to apply the policy both in server side and in clients side. 8. Logoff and logon again, the group policy will take effect. Try to test, how about the result? I am currently waiting for your test result. If you have any further concern or question on the issue, please feel free to let me know. I am always happy to be assistance of you! Have a nice day! Best Regards, Jenny Wu Microsoft CSS Online Newsgroup Support Get Secure! - www.microsoft.com/security ================================================== ==== This newsgroup only focuses on SBS technical issues. If you have issues regarding other Microsoft products, you'd better post in the corresponding newsgroups so that they can be resolved in an efficient and timely manner. You can locate the newsgroup here: http://www.microsoft.com/communities...s/default.aspx When opening a new thread via the web interface, we recommend you check the "Notify me of replies" box to receive e-mail notifications when there are any updates in your thread. When responding to posts via your newsreader, please "Reply to Group" so that others may learn and benefit from your issue. Microsoft engineers can only focus on one issue per thread. Although we provide other information for your reference, we recommend you post different incidents in different threads to keep the thread clean. In doing so, it will ensure your issues are resolved in a timely manner. For urgent issues, you may want to contact Microsoft CSS directly. Please check http://support.microsoft.com for regional support phone numbers. Any input or comments in this thread are highly appreciated. ================================================== ==== This posting is provided "AS IS" with no warranties, and confers no rights. |
|
|
|
|
|||
|
|||
|
Saajan
Guest
Posts: n/a
|
Hi, The problem still persists for me. I have set the wallpaper using Group
Policy now, but as I mentioned earlier, I am experiencing trouble with the resolution. I will send you the screen shots. If there is any work around, please advice. Many Thanks! "RDRFuzz" wrote: > I am also experiencing the same issue with the wallpaper resolution. > To be a bit more specific, when you manually set wallpaper from the > client machine (windows xp), a smoothing algorithm is applied so that > if it stretches it still looks pretty good (from what I can tell this > didn't really start happening until at least 2000). However, if you > set a bitmap or even jpeg (the format that it really should be > smoothing), and set it to stretch, the algorithm is bypassed and it > looks cruddy unless it's the exact size for the resolution of the > desktop. I have a common roaming profile for generic interviewers that > could be used on machines with either 800x600 or 1024x768 desktops, and > since I can't imagine there's a way to specify a different wallpaper > based on system resolution, this must be a case of the smoothing > algorithm only working when the desktop wallpaper is set locally. > > I experience none of the other issues in this thread, just the one I > described above. Is this a known issue to Microsoft? > > -Mike Lightner > > Director of IT Services, Richard Day Research, Inc. > > |
|
|
|
|
|||
|
|||
|
Jenny wu [MSFT]
Guest
Posts: n/a
|
Hi Mohammed and Mike,
Thanks for your update! And I have received mail from Mohammed, I appreciate your time and efforts to test. I have searched many documents and found the image resolution issue. It is indeed a known issue: as it is known that the JPG/JPEG image will be changed to another image format during it transfers network, it shows poor image resolution in client workstaition when deployed by group policy for the image is placed in some network location. The issue doesn't happen in BMP image,We suggest that you use BMP image to deploy wallpaper group policy which will show perfectly either in local setting or deployed by group policy. I appreciate you understanding! If you have any further concern or question on the issue, please feel free to let me know. I am always happy to be assistance of you! Have a nice weekend! Best Regards, Jenny Wu Microsoft CSS Online Newsgroup Support Get Secure! - www.microsoft.com/security ================================================== ==== This newsgroup only focuses on SBS technical issues. If you have issues regarding other Microsoft products, you'd better post in the corresponding newsgroups so that they can be resolved in an efficient and timely manner. You can locate the newsgroup here: http://www.microsoft.com/communities...s/default.aspx When opening a new thread via the web interface, we recommend you check the "Notify me of replies" box to receive e-mail notifications when there are any updates in your thread. When responding to posts via your newsreader, please "Reply to Group" so that others may learn and benefit from your issue. Microsoft engineers can only focus on one issue per thread. Although we provide other information for your reference, we recommend you post different incidents in different threads to keep the thread clean. In doing so, it will ensure your issues are resolved in a timely manner. For urgent issues, you may want to contact Microsoft CSS directly. Please check http://support.microsoft.com for regional support phone numbers. Any input or comments in this thread are highly appreciated. ================================================== ==== This posting is provided "AS IS" with no warranties, and confers no rights. ---------------------------------------------------------------------------- ------ "Saajan" <> дÈëÓʼþ news:9AFE3145-2CBF-4868-9576-... > Hi, The problem still persists for me. I have set the wallpaper using Group > Policy now, but as I mentioned earlier, I am experiencing trouble with the > resolution. I will send you the screen shots. If there is any work around, > please advice. Many Thanks! > > "RDRFuzz" wrote: > > > I am also experiencing the same issue with the wallpaper resolution. > > To be a bit more specific, when you manually set wallpaper from the > > client machine (windows xp), a smoothing algorithm is applied so that > > if it stretches it still looks pretty good (from what I can tell this > > didn't really start happening until at least 2000). However, if you > > set a bitmap or even jpeg (the format that it really should be > > smoothing), and set it to stretch, the algorithm is bypassed and it > > looks cruddy unless it's the exact size for the resolution of the > > desktop. I have a common roaming profile for generic interviewers that > > could be used on machines with either 800x600 or 1024x768 desktops, and > > since I can't imagine there's a way to specify a different wallpaper > > based on system resolution, this must be a case of the smoothing > > algorithm only working when the desktop wallpaper is set locally. > > > > I experience none of the other issues in this thread, just the one I > > described above. Is this a known issue to Microsoft? > > > > -Mike Lightner > > > > Director of IT Services, Richard Day Research, Inc. > > > > |
|
|
|
|
|||
|
|||
|
|
|
| |
![]() |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Change/Remove Users Desktop Wallpaper | jmarsh | Windows Server | 1 | 06-30-2006 11:40 AM |
| Re: Force My Documents Desktop Icon for TS Users | Mariette Knap [SBS MVP] | Windows Server | 1 | 03-07-2006 09:44 PM |
| Forcing users to have standard desktop wallpaper | Simon Guest | Windows Server | 0 | 04-12-2005 06:48 AM |
| Assigning icons to a users desktop while still allowing them freedom. | Chris Dunkinson | Windows Small Business Server | 0 | 01-11-2005 03:01 AM |
| Shared desktop and Documents for all users | Annonymous | Windows Server | 0 | 12-02-2004 11:51 PM |
Forum Software Powered by vBulletin®, Copyright Jelsoft Enterprises Ltd.
SEO by vBSEO 3.3.2 ©2009, Crawlability, Inc. |



Linear Mode

