Creating a Group Policy for Citrix Servers problem 1

[blfrd76]

I've got two Citrix servers running Win2K.

ON the domain controller (also Win2K):
-Opened AD
- Created an OU called "Terminal Servers"
- Moved the two Citrix servers from "Computers" folder
into the "Terminal Servers" OU
- Clicked "Properties" on the "TS" OU
- Created a GPO called "Citrix Servers"
- Edited the GPO to disable viewiing of the C,D drives
Closed AD
- Made sure the Security tab was checked to "Apply Policy" for Authenticated users

- On the DC, ran secedit /refreshpolicy machine_policy /enforce

- Logged on to Citrix Program Neighborhood as a non-Admin user

The policy is not working. People can open published apps and still navigate to the C and D Drives on the Citrix server.

What am I forgetting?

 

[Chambers]

How about make a loopback policy and apply those GP's to a new group called "citrix policy" then add your persons to that group. You don't want to accidentely take out admins priveledge to see the local drives since you set it to authenticated users..admin is part of those

 

[blfrd76]

Solved!!
Here's the soloution:

- Create an OU called Terminal Services
- Move the Citrix servers from Computers to the Terminal
Services OU.
- Right click the TS OU and choose properties
- Go to the Group policy tab and make sure the Citrix GPO
is chosen. Then choose edit.

- Go to Computer Config > Admin Templates > System >
Group Policy and enable Loopback Processing. I chose "replace" option.
- Set whatever policies you want to. For me, I chose to hide C and Drives from Citrix users. Close the GP editor.

- On the Group policy tab that lists the new Citrix GPO:
- click Properties
- Under Security,
ADD Authenticated Users and check Apply Policy
ADD the two Citrix servers and check APPLy policy
- To filter this policy from admins
- choose the Domain Admins Group
- Check DENY on the Apply policy security setting.
-Click OK until you're back at AD, then close AD

Open a command line prompt,type this and press enter:

secedit /refreshpolicy machine_policy /enforce

Then type this and press enter:

secedit /refreshpolicy user_policy /enforce

I did the command line stuff on the server I was working on and the Citrix servers too.