How do I hide Administrative Tools on Windows Server 2008 R2 using group-policy?

Question

We're locking down our terminal server machine for remote desktop users and can't seem to find how to hide Administrative Tools from the Start Menu for remote desktop users.

thank you!

Solution

two ways i can see

http://www.brianmadden.com/forums/t/19270.aspx

Open the GPO in gpedit.msc and go to:

User Config\Administrative Templates\Windows Components\Microsoft Management Console\ and restrict access to author mode and any MMC snap ins you don't want them to get to.

Be sure that the computer side is in loopback mode if you don't already have a policy on your TS OU that does this:

Computer Config\Administrative Templates\System\Group Policy\User Group Policy Loopback Processing Mode = enabled.

Once the policy is created, it is a good idea to deny apply rights to the administrative staff that supports the server.

OR

the way i do it is to redirect the start menu for all my terminal servers to another location e.g. \SERVER1\USERS\STARTMENU

http://technet.microsoft.com/en-us/library/cc785925(WS.10).aspx

Redirecting the Start Menu folder

Folder Redirection of the Start Menu folder is available in Windows XP, Windows XP 64-Bit Edition, or Windows Server 2003 operating systems. Start Menu redirection is treated differently from other redirected folders in that the contents of the user’s Start Menu are not copied to the redirected location. It is assumed that a redirected Start Menu has been previously created by an administrator and that all users share the same Start Menu. As a best practice for Windows XP–based computers, do not use Folder Redirection to redirect the Start Menu folder; instead, use Group Policy to control what appears on the Start Menu.