I am tasked with an extremely simple task at a company that I have been working for since about 2 months ago.
We have 3 servers housed for one of our clients. What we are looking to do is to get two terminal servers to start to different programs on start. This is easy to accomplish and I have. However we are also trying to get it so that just the domain users are getting the programs at start. We need for myself, my IT manager, and the lead programmer to have access to the full desktop. So what I did was to edit the permissions under the group policy tab to not allow the Policy to apply to us three. That did not work. We are all domain admins. I added that group and did not allow the policy to apply Domain admins. Still we get the application on start up. So now I add administrators and do not allow the policy to apply to administrators. This worked we could then access the full desktop! Problem is that the domain users now do not have the program to launch on start up. They have access to the desktop also.
Let me give some quick information on the network and how things are setup.
Server1- Domain Controller, Windows Server 2003 fully up to date with updates.
Server2- Backup Domain Controller, Windows Server 2008 fully up to date with updates. This server is now a terminal server.
Server3- Application Server/Terminal Server, Windows Server 2003 fully up to date with updates.
Server 2 will run an application called Haven while server 3 will use and application called Hhamis.
Server 2 and 3 were moved to an OU's called TS Haven and TS Hhamis. They were placed accordingly to what application they are expected to run.
Two group policies called TS Haven Auto-start and TS Hhamis Autostart are applied accordingly to the server that runs the application corresponding with the name of the server.
Current options configured for the group policies.
Server 2
Computer Configuration (Enabled)hide
Policieshide
Administrative Templateshide
Policy definitions (ADMX files) retrieved from the local machine.
Windows Components/Terminal Services/Terminal Server/Remote Session Environmenthide
Policy Setting Comment
Start a program on connection Enabled
Program path and file name c:\data\haven\haven.exe
Working Directory c:\data\haven
User Configuration (Enabled)hide
Policieshide
Administrative Templateshide
Policy definitions (ADMX files) retrieved from the local machine.
Windows Components/Terminal Services/Terminal Server/Remote Session Environmenthide
Policy Setting Comment
Start a program on connection Enabled
Program path and file name c:\data\haven\haven.exe
Working Directory c:\data\haven
Server 3
Computer Configuration (Enabled)
hide
Policieshide
Administrative Templateshide
Policy definitions (ADMX files) retrieved from the local machine.
Printershide
Policy Setting Comment
Disallow installation of printers using kernel-mode drivers Enabled
Windows Components/Terminal Services/Terminal Server/Printer Redirectionhide
Policy Setting Comment
Do not allow client printer redirection Enabled
Windows Components/Terminal Services/Terminal Server/Remote Session Environmenthide
Policy Setting Comment
Start a program on connection Enabled
Program path and file name "C:\Program Files\Liant\RMCOBOLv12\runcobol.exe" C:\data\HHAMIS\winhhamis.cob
Working Directory C:\data\HHAMIS\
User Configuration (Enabled)hide
Policieshide
Administrative Templateshide
Policy definitions (ADMX files) retrieved from the local machine.
Windows Components/Terminal Services/Terminal Server/Remote Session Environmenthide
Policy Setting Comment
Start a program on connection Enabled
Program path and file name C:\Program Files\Liant\RMCOBOLv12\runcobol.exe C:\data\HHAMIS\winhhamis.cob
Working Directory C:\data\HHAMIS
Any advice as to how or why this is not working would be great.
Recap: Domain users- Autostart Haven and and Hhamis on two different TS Servers. The 3 administrators- Full desktop control. I have tried to use delegation to stop the policy from applying to us but it then allows users to see the desktop.
