29. Implement Windows System Policies

The Ultimate Citrix Install Guide

1. Implementation Overview

2. Prepare the Network Environment

3. 3^rd Party IMA Data Store Installation & Maintenance.

4. Install Operating System

5. Install MetaFrame XP with Feature Release 2

6. Tweak Windows 2000 / MetaFrame XP

7. How to Install and Configure Microsoft Office 2000

8. Install Image Applications

9. Rapid Server Deployment

10. Install Manual Applications

11. Resource Manager 2.2 Counters Explained

12. How to Setup Automatic Reboot for MetaFrame Servers

13. MetaFrame Delegated Administration.

14. How to Set the MetaFrame Server Preference for Data Collector Elections

15. How to Create a Zone & Move MetaFrame Servers to it

16. Citrix User Policies

17. How to Implement Automatic ICA Client Updates

18. Client Drive Mapping

19. How to Implement Client to Server Content Redirection

20. How to Implement Server to Client Content Redirection

21. Publishing through the Citrix Management Console

22. How to Build a Stable Printing Environment

23. NFuse Integration

24. How to Secure an Internet Information Services (IIS) Server

25. How to Secure ICA Session Traffic with Citrix Secure Gateway (CSG) 1.1

26. MetaFrame XP Remote Administration Tools

27. ICA Clients

28. Microsoft Terminal Services License Server

29. Implement Windows System Policies.

30. Implementation - Checkpoint

6 - Readiness Phase

7 - Rollout Phase

8 - Appendix

When users access a session through a MetaFrame server, by default, they have access to all files, features and applications on the server. This gives a stray user the ability to detrimental effect all other users of the MetaFrame server. In order to prevent this behavior you will want to lockdown the environment through Computer and User Policies.

A Policy is a set of registry settings that defines the computer resources available to an individual or to a group of users. Policies define the various facets of the desktop environment that a system administrator needs to control, such as which applications are available, which applications appear on the users desktop, which applications and options appear in the Start menu, who can change their desktops and who cannot, and so forth. System policies can be implemented for specific users, groups, computers, or for all users.

In the following sections, I have documented how to implement Policies in both a Microsoft NT 4.0 and or Novell Netware environment and a Windows 2000 Active Directory environment. You will also find a great Administrative Template (MIAB.ADM) that incorporates most of the changes found throughout this document and a few more and how to add and configure it.

29. 1. MIAB Administrative Template Overview

Keeping with the goal of this project of making things simple, a gent named Tahir Saleem created an awesome Administrative Template (MIAB.ADM) to tweak and configure a MetaFrame server.

MIAB.ADM allows you to configure the following:

Source Path for windows installation

Open In Notepad. When right clicking on a file you will have the option to open it in Notepad

Command Prompt settings. Sets the following command prompt options:

o ScreenBuffer is set to 300 lines.

o WindowSize is set to 40 lines.

QuickEdit and InsertMode is Enabled

Set IRPStackSize

Set SNMP Contact

o Contact Name

o Location

Disables the configure server wizard

Report Cached Credentials. When logged on with Cached Credentials report this to the user.

Default Logon Domain. Sets the Default Logon Domain to the specified value. In a trusted environment this may be useful.

File name completion enabled in command prompt

Command Prompt Here. When right clicking on a drive or directory you will have the option to open a Command Prompt at that location

Configure TCPKeepAlive

Enable ICAKeepAlive

Disable Paging of NTExecutive

Disable Dr. Watson

Disable Printer Beeps

Disable Printer Pop-up message

Disable System Hard Error Messages

Increase Idle Connections to handle peak logon periods

Set WinStation UserOverrides:

AutoEndTasks

CusrorBlinkRate

DragFullWindows

MenuShowDelay

WaitToKillAppTimeout

SmoothScroll

Wallpaper

MinAnimate

Active Title Bar Colour for ICA Connections

Active Title Bar Colour for RDP Connections

Remove Outlook Express from the Quick Launch bar and Start Menu.

Prevent last access time stamp from being updated on NTFS partitions

SAP Settings

Enable/Disable New Visual Design

Disable Splash Screen

Disable Animation

Disable logging of Print events in Event Log

Change IM 2.0 default install drive

Set Default License Server

Hide Specified drives

Disable the Configure Server Wizard

Important: The MIAB Administrative Template is written for Windows 2000 Active Directory Group Policys ONLY.

; Methodology in a Box

; Terminal Server tunings.

; Version: 1.0

; By Tahir Saleem, NettSpesialisten

; saleem@nettspes.no

#if version <= 2

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CLASS USER ;;;;;;;;;;;;;;;;;;

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CATEGORY !!GPOnly

POLICY !!GPOnlyPolicy

KEYNAME "Software\Policies"

PART !!GPOnly_Tip1 TEXT

END PART

PART !!GPOnly_Tip2 TEXT

END PART

PART !!GPOnly_Tip3 TEXT

END PART

PART !!GPOnly_Tip4 TEXT

END PART

PART !!GPOnly_Tip5 TEXT

END PART

END POLICY

END CATEGORY

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CLASS MACHINE ;;;;;;;;;;;;;;;

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CATEGORY !!GPOnly

POLICY !!GPOnlyPolicy

KEYNAME "Software\Policies"

PART !!GPOnly_Tip1 TEXT

END PART

PART !!GPOnly_Tip2 TEXT

END PART

PART !!GPOnly_Tip3 TEXT

END PART

PART !!GPOnly_Tip4 TEXT

END PART

PART !!GPOnly_Tip5 TEXT

END PART

END POLICY

END CATEGORY

#endif

#if version >= 3

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CLASS USER ;;;;;;;;;;;;;;;;;

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CATEGORY !!MIAB

POLICY !!HideDrives

EXPLAIN !!HideDrives_Help

KEYNAME "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"

PART !!HideDrives_txt NUMERIC

VALUENAME "NoDrives" MAX 1000000000

DEFAULT "0"

END PART

END POLICY

POLICY !!ConfigServerWizard

KEYNAME "Software\Microsoft\Windows NT\CurrentVersion\Setup\Welcome"

EXPLAIN !!ConfigServerWizard_Help

ACTIONLISTON

VALUENAME "srvwiz"

VALUE NUMERIC "0"

END ACTIONLISTON

END POLICY

POLICY !!DisableICW

EXPLAIN !!DisableICW_Help

KEYNAME "Software\Microsoft\Internet Connection Wizard"

VALUENAME "Completed"

END POLICY

POLICY !!Console

KEYNAME "Console"

EXPLAIN !!Console_Help

ACTIONLISTON

VALUENAME "ScreenBufferSize"

VALUE NUMERIC "19660880" ;300 Lines

VALUENAME "WindowSize"

VALUE NUMERIC "2621520" ;40 Lines

VALUENAME "QuickEdit"

VALUE NUMERIC "1"

VALUENAME "InsertMode"

VALUE NUMERIC "1"

END ACTIONLISTON

END POLICY

CATEGORY !!SAP

POLICY !!SAPVisual

KEYNAME "Software\SAP\General\Enjoy"

EXPLAIN !!SAPVisual_Help

PART !!SAPGUIch DROPDOWNLIST REQUIRED

VALUENAME "Active"

ITEMLIST

NAME Off VALUE "Off" DEFAULT

NAME On VALUE "On"

END ITEMLIST

END PART

END POLICY

POLICY !!SAPAnimation

KEYNAME "SOFTWARE\SAP\General\Appearance"

EXPLAIN !!SAPAnimation_Help

PART !!SAPAnich DROPDOWNLIST REQUIRED

VALUENAME "Animation"

ITEMLIST

NAME Off VALUE "Off" Default

NAME On VALUE "On"

END ITEMLIST

END PART

END POLICY

POLICY !!SAPSplash

KEYNAME "SOFTWARE\SAP\General\Appearance"

EXPLAIN !!SAPSplash_Help

PART !!SAPSplach DROPDOWNLIST REQUIRED

VALUENAME "SplashOff"

ITEMLIST

NAME Off VALUE NUMERIC 1

NAME On VALUE NUMERIC 0

END ITEMLIST

END PART

END POLICY

END CATEGORY ;SAP

END CATEGORY ;MIAB

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CLASS MACHINE ;;;;;;;;;;;;;;

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CATEGORY !!MIAB

POLICY !!SourcePath

EXPLAIN !!SourcePath_Help

KEYNAME "Software\Microsoft\Windows NT\Currentversion"

PART !!SourcePath EDITTEXT

VALUENAME "SourcePath"

DEFAULT "\\Servername\I386"

END PART

END POLICY

POLICY !!CompletionChar

KEYNAME "Software\Microsoft\Command Processor"

EXPLAIN !!CompletionChar_Help

ACTIONLISTON

VALUENAME "CompletionChar"

VALUE NUMERIC 9

VALUENAME "PathCompletionChar"

VALUE NUMERIC 9

END ACTIONLISTON

ACTIONLISTOFF

VALUENAME "CompletionChar"

VALUE NUMERIC 64

VALUENAME "PathCompletionChar"

VALUE NUMERIC 64

END ACTIONLISTOFF

END POLICY

POLICY !!InternetMIB

EXPLAIN !!InternetMIB_Help

KEYNAME "System\CurrentControlSet\Services\SNMP\Parameters\RFC1156Agent"

ACTIONLISTON

VALUENAME "sysServices"

VALUE NUMERIC 72

END ACTIONLISTON

PART !!ContactName EDITTEXT REQUIRED

VALUENAME sysContact

END PART

PART !!Location EDITTEXT REQUIRED

VALUENAME sysLocation

END PART

END POLICY

POLICY !!CachedCridentials

KEYNAME "software\Microsoft\Windows NT\CurrentVersion\Winlogon"

EXPLAIN !!CachedCridentials_Help

ACTIONLISTON

VALUENAME "ReportControllerMissing"

VALUE "TRUE"

END ACTIONLISTON

END POLICY

POLICY !!DefaultDomain