Articles

Lock Down Terminal Services

To create a whitelist of allowed programs, use "Run only allowed Windows Applications" in User Configuration, Adminitrative Templates, System.

To create a blacklist of disallowed programs, use "Don't run specified Windows applications" in the same folder.

Computer Configuration >> Administrative Templates

System >> Group Policy

User Configuration >> Administrative Templates

Control Panel

Show only specified Control Panel Applets: Enabled
List of allowed Control Panel Applets: Printers

Control Panel >> Add or Remove Programs

Control Panel/Add or Remove Programs

Policy	Setting
Hide Add New Programs page	Enabled
Hide Add/Remove Windows Components page	Enabled
Hide Change or Remove Programs page	Enabled
Hide the "Add a program from CD-ROM or floppy disk" option	Enabled
Hide the "Add programs from Microsoft" option	Enabled
Hide the "Add programs from your network" option	Enabled
Hide the Set Program Access and Defaults page	Enabled
Remove Add or Remove Programs	Enabled
Remove Support Information	Enabled

Control Panel/Display

Policy	Setting
Hide Appearance and Themes tab	Enabled
Hide Desktop tab	Enabled
Hide Screen Saver tab	Enabled
Hide Settings tab	Enabled
Prevent changing wallpaper	Enabled
Remove Display in Control Panel	Enabled
Screen Saver	Disabled

Control Panel/Display/Desktop Themes

Policy	Setting
Prevent selection of windows and buttons styles	Enabled
Prohibit selection of font size	Enabled
Prohibit Theme color selection	Enabled
Remove Theme option	Enabled

Control Panel/Regional and Language Options

Policy

Setting

Enabled

Restrict users to the following language:

English

Desktop

Policy	Setting
Do not add shares of recently opened documents to My Network Places	Enabled
Hide Internet Explorer icon on desktop	Disabled
Hide My Network Places icon on desktop	Enabled
Prohibit user from changing My Documents path	Enabled
Remove My Computer icon on the desktop	Disabled
Remove My Documents icon on the desktop	Enabled
Remove Properties from the My Computer context menu	Enabled
Remove Properties from the My Documents context menu	Enabled
Remove Properties from the Recycle Bin context menu	Enabled
Remove Recycle Bin icon from desktop	Enabled
Remove the Desktop Cleanup Wizard	Enabled

Desktop/Active Desktop

Policy

Setting

Enabled

Disallows HTML and Jpg Wallpaper

Policy

Setting

Disabled

Start Menu and Taskbar

Policy	Setting
Add Logoff to the Start Menu	Enabled
Force classic Start Menu	Disabled
Gray unavailable Windows Installer programs Start Menu shortcuts	Enabled
Remove and prevent access to the Shut Down command	Enabled
Remove Documents menu from Start Menu	Enabled
Remove Drag-and-drop context menus on the Start Menu	Disabled
Remove Help menu from Start Menu	Enabled
Remove links and access to Windows Update	Enabled
Remove Logoff on the Start Menu	Disabled
Remove My Documents icon from Start Menu	Enabled
Remove My Music icon from Start Menu	Enabled
Remove My Network Places icon from Start Menu	Enabled
Remove My Pictures icon from Start Menu	Enabled
Remove Network Connections from Start Menu	Enabled
Remove Run menu from Start Menu	Enabled
Remove Search menu from Start Menu	Enabled
Remove Set Program Access and Defaults from Start menu	Enabled
Remove the "Undock PC" button from the Start Menu	Enabled