Applying policies on a Win2K Term Server

You can do this by first establishing groups, administrators group and user(s) group, for example. You can then set the policies for each group. The Administrators group would have the full access to the run line, network neighborhood, etc., while the users policy could be more restrictive.

There are scores of things that can be set with policies. More than could possibly be described in this thread. However, Microsoft has a great paper on that subject. It is quite thorough and illustrated quite nicely. It's broken down into dozens of separate sections, each outlining in detail the necessary explanations and step-by-step instructions.

"Step-by-Step Guide to Understanding the Group Policy Feature Set"

Group Policy is the central component of the Change and Configuration Management features of the Microsoft? Windows? 2000 operating system. Group Policy specifies settings for groups of users and of computers, including registry-based policy settings, security settings, software installation, scripts (computer startup and shutdown, and log on and log off), and folder redirection.

This document is part of a set of step-by-step guides that introduce IT managers and system administrators to the features of the Windows? 2000 operating system. This document presents a brief overview of Group Policy, and shows how to use the Group Policy snap-in to specify policy settings for groups of users and of computers. It includes information on:
 Configuring the Group Policy snap-in.
 Creating and managing Group Policy objects.
 Setting options for registry-based policy, scripts, and loopback policy.
 Using security groups with Group Policy.
 Linking multiple Group Policy Objects.
 Blocking and enforcing Group Policy.

See this whole article at:

http://www.microsoft.com/windows2000/techinfo/planning/management/groupsteps.asp

(continued..

In a Windows 2000 Domain, you can set this with Group Policy, as mentioned in the first answer (a deep subject).

If you have your Windows 2000 Term Server in a NT 4 domain, you don't have the luxury of setting policies in the AD.

Setting such policies locally will apply to every user on the box (you probably hit that wall!!).

The only method I know of to do this in an NT4 domain is to set the policies the way you want and then deny Administrators access to the Group Policy folder. Whenan admin logs in, he can't see the policy, so he has full control.

This is probably not supported. It is a hack but it does work.

As somewhat of a correction, or more accurately an addendum, to my previous answer, and after a bit of research into the issue, I found some more information that may help solve the problem.

I ran across a ZDNet article that stated the following:

“Active Directory Domain Controllers can't have local users and groups. Any users and groups created on an AD DC must be domain objects. To create and manage resources such as users and groups, you'll use the preconfigured Active Directory Users And Computers MMC. A portion of this MMC's functionality is similar to User Manager For Domains in Windows NT 4.0. To run the Active Directory Users And Computers console, choose
Start | Programs | Administrative Tools |
Active Directory Users And Computers.
If you look in the Built-in and Users containers, you'll see many of the user and group accounts you're familiar with in Windows NT 4.0. Figure F shows the contents of the Built-in container.
Just like with the Computer Management MMC, you can remotely administer another AD domain (if you have the correct permissions) by choosing Action | Connect To Domain. For additional information on creating users and groups in the AD, refer to the December 1999 Exploring Windows NT article, "Working with objects in the Active Directory."

See the article for the full explanation, illustration and additional links.

http://www.zdnetindia.com/techzone/networking/stories/37297.html

----------

Continued..)