Hello everybody, Scenario: Win 2008 server DC with Windows Vista Clients. I need solution for below mentioned problems: 1) Restrict users to save files on to the Desktop of local machines(Vista) 2) Need to give read only access to the USB and DVD/CD Writer for local machines(Vista) 3) As our company’s IT resources are low we don’t want to sit at each machine. So without giving local admin right if users want to install any software on to local machines which is agreed by IT Dept. How do we can handle this situation through GP or something else? (As I am new to Sys Administration, I really apperciate for describing the step by step procedure for above issues) with best regards SF

1)Not sure, it is their own profile so permissions may be a problem. How about folder redirection, this could mean that you can backup their desktop items. I assume backups is the reason that you do not want them to save there. 2)Devicewall can block or allow connections to external equipment. Not sure on its cost though. 3)GPO is a great tool but very picky with applications. They need to be in .msi format for full co-operation. you can use zap files to deploy .exe files, but is not reccomended.