Windows 2003 Group Policy

[Lespaul20]

I have been doing some work with a school where we switched to a thin client environment. Here is what we have:

1 - Active Directly Domain Controller
1- Terminal Services Server
2 - Sunray Server(these direct the Sunray Thin Clients to the TSS)

The Thin clients are connecting to the Terminal services server and authenticating through the AD on the Domain Controller.

My question is how can I implement a locked down policy so the kids have limited access to things on the Terminal Server. I have found the Group Policy Management Console and Common Scenarios but I'm not exactly how this works. If we implement a policy through AD, will that policy be enforced on the terminal server?


Example:

A student logs into the Terminal Serer authentication via AD. I need the students ability to change things to limited. Like changing desktop background, add/removing applications, shutting down... that sort of thing.

Currently I have been able to lock a few things down via gpedit.msc but that is only for that specific installation and not based on authentication.

Any help or direction on where to go would be great. Step by step would be excellent but I'll take any help.

Thanks,
LP

[Force Flow]

right click on the Organizational Unit for the users in active directory > properties > "group policy" tab

Depending on how things are configured and how up-to-date things are, you'll either see the group policy management interface or an "open" button to the snap-in.

So, you create a new group policy, and in that policy you can specify all the settings that will be applied to the users under that Organizational Unit.

[Lespaul20]

That was pretty easy. Thanks.