grp policy RESTRICT saving to local disk

I have w2k3 r2 and windows xp sp 2 in a domain envi.
I want to set a policy to restrict users to save to the local hard disk
unless they are admins. How would i go about setting that up in group policy
mgmt console?

thanks in advance

There's no way to do that, the operating system can't function in this way.
Any attempt to create access control lists to enforce this will probably
result in application failure, and there's no way we can predict how Windows
itself would behave.

Thin clients based on Terminal Server might work for you.

--
Steve Riley
steve.riley@microsoft.com
http://blogs.technet.com/steriley
http://www.protectyourwindowsnetwork.com



"MIKEY LABS" <MIKEY LABS@discussions.microsoft.com> wrote in message
news:F5B996EE-3307-4203-9B49-3857603742CF@microsoft.com...
> I have w2k3 r2 and windows xp sp 2 in a domain envi.
> I want to set a policy to restrict users to save to the local hard disk
> unless they are admins. How would i go about setting that up in group
> policy
> mgmt console?
>
> thanks in advance
>
>

What about only saving to the my documents or to the profile folders only? is
that possible?
then i can do offline syncs or backup that folder?

"Steve Riley [MSFT]" wrote:

> There's no way to do that, the operating system can't function in this way.
> Any attempt to create access control lists to enforce this will probably
> result in application failure, and there's no way we can predict how Windows
> itself would behave.
>
> Thin clients based on Terminal Server might work for you.
>
> --
> Steve Riley
> steve.riley@microsoft.com
> http://blogs.technet.com/steriley
> http://www.protectyourwindowsnetwork.com
>
>
>
> "MIKEY LABS" <MIKEY LABS@discussions.microsoft.com> wrote in message
> news:F5B996EE-3307-4203-9B49-3857603742CF@microsoft.com...
> > I have w2k3 r2 and windows xp sp 2 in a domain envi.
> > I want to set a policy to restrict users to save to the local hard disk
> > unless they are admins. How would i go about setting that up in group
> > policy
> > mgmt console?
> >
> > thanks in advance
> >
> >

What is that you're trying to prevent? If users aren't local admins, then
the default permissions are fine. There's no need to tinker with them.
Standard users can't overwrite operating system files or files other than
their own.

--
Steve Riley
steve.riley@microsoft.com
http://blogs.technet.com/steriley
http://www.protectyourwindowsnetwork.com



"MIKEY LABS" <MIKEYLABS@discussions.microsoft.com> wrote in message
news:9EFF9E9F-DE15-4ACF-8625-92976AC4A420@microsoft.com...
> What about only saving to the my documents or to the profile folders only?
> is
> that possible?
> then i can do offline syncs or backup that folder?
>
> "Steve Riley [MSFT]" wrote:
>
>> There's no way to do that, the operating system can't function in this
>> way.
>> Any attempt to create access control lists to enforce this will probably
>> result in application failure, and there's no way we can predict how
>> Windows
>> itself would behave.
>>
>> Thin clients based on Terminal Server might work for you.
>>
>> --
>> Steve Riley
>> steve.riley@microsoft.com
>> http://blogs.technet.com/steriley
>> http://www.protectyourwindowsnetwork.com
>>
>>
>>
>> "MIKEY LABS" <MIKEY LABS@discussions.microsoft.com> wrote in message
>> news:F5B996EE-3307-4203-9B49-3857603742CF@microsoft.com...
>> > I have w2k3 r2 and windows xp sp 2 in a domain envi.
>> > I want to set a policy to restrict users to save to the local hard disk
>> > unless they are admins. How would i go about setting that up in group
>> > policy
>> > mgmt console?
>> >
>> > thanks in advance
>> >
>> >