• Remove My Network Place icon from Start Menu
Recommended setting: Enabled
This policy removes the My Network Places icon from the Start menu. It is recommended that you enable this policy to prevent easy access to browsing the network.

• Add Logoff to Start Menu
Recommended setting: Enabled
It is recommended that you enable this policy to make it easy for users to log off of their Terminal Server sessions. This policy adds the "Log Off " item to the Start menu and prevents users from removing it. This setting affects the Start menu only. It does not affect the Log Off item on the Windows Security dialog box that appears when you press CTRL+ALT+DEL or CTRL+ALT+END from a Terminal Server client.

• Remove and prevent access to Shut Down command
Recommended setting: Enabled
This policy removes the ability for the user to open the Shutdown dialog box from the Start menu and from the Windows Security dialog box (CTRL+ALT+DEL). This policy does not prevent users from running programs to shut down Windows. It is recommended that you enable this policy help remove confusion from the users and prevent administrators from shutting down the system while it is in production.

• Prevent changes to Taskbar and Start Menu settings
Recommended setting: Enabled
This policy prevents customization of the taskbar and the Start menu. It can simplify the desktop by adhering to the configuration set by the administrator. It is recommended that you enable this policy to restrict the ability to add other applications to the start menu by browsing or typing the location of an application.

• Remove access to the shortcut menus for the taskbar
Recommended setting: Enabled
This policy removes the right-click menu on the taskbar. This setting does not prevent users from using other methods to issue the commands that appear on this menu. It is recommended that you enable this policy to prevent potential access to files and applications by starting Windows Explorer or Search.

• Force Classic Start Menu
Recommended setting: Enabled
This policy effects the presentation of the Start menu. The Classic Start menu in Windows 2000 allows users to begin common tasks, while the new Start menu consolidates common items onto one menu. When the Classic Start menu is used, the following icons are placed on the desktop: My Documents, My Pictures, My Music, My Computer, and My Network Places. The new Start menu starts them directly. Disabling the new Start menu removes Printers and Faxes. From Printers and Faxes, users can view Server Properties to see where the Spool folder is installed.

[User Configuration\Administrative Templates\Desktop]
• Remove Properties from My Documents shortcut menu
Recommended setting: Enabled
This setting hides Properties for the shortcut menu on My Documents. It is recommended that you enable this policy if shortcut menus are not disabled and you do not want the users to easily view or edit the location of their My Document folder.

• Remove Properties from My Computer shortcut menu
Recommended setting: Enabled
This setting hides Properties on the shortcut menu for My Computer. It is recommended that you enable this policy if shortcut menus are not disabled and you do not want the users to easily view configuration information about the Terminal Server.

• Remove Properties from Recycle Bin shortcut menu
Recommended setting: Enabled
This policy removes the Properties option from the Recycle Bin shortcut menu. It is recommended that you enable this policy if shortcut menus are not disabled and you do not want the users to easily view or change Recycle Bin settings.

• Hide My Network Places icon on desktop
Recommended setting: Enabled
It is recommended that you enable this policy to remove easy access to browsing the network for applications. This setting only affects the desktop icon. It does not prevent users from connecting to the network or browsing for shared computers on the network with other methods.

• Hide Internet Explorer Icon on the desktop
This policy removes the Internet Explorer icon from the desktop. This setting does not prevent the user from starting Internet Explorer by using other methods. Set this to enable to restrict users from as part of several settings you can use to eliminate web browsing on your Terminal Server.

• Prohibit user from changing My Documents path
Recommended setting: Enabled
This policy restricts the My Documents location to the designated location. It is recommended that you enable this policy to prevent browsing for applications.

• Hide and disable all items on the desktop
This policy removes icons, shortcuts, and other default and user-defined items from the desktop, including Briefcase, Recycle Bin, My Computer, and My Network Places. Removing icons and shortcuts does not prevent the user from using another method to start the programs or opening the items they represent. User can still save and open items on the desktop by using the Common File dialog box or Windows Explorer. The items; however, are not displayed on the desktop.

• Remove My Documents icon on the desktop
Recommended setting: Enabled
This policy removes most occurrences of the My Documents icon. It does not prevent the user from using other methods to gain access to the contents of the My Documents folder.

• Remove My Computer icon on the desktop
Recommended setting: Enabled
This policy hides My Computer from the desktop and from the new Start menu. It also hides links to My Computer in the Web view of all Explorer windows, and it hides My Computer in the Explorer folder tree pane. If the user navigates into My Computer by using the Up icon while this setting is enabled, they view an empty My Computer folder. It is recommended that you enable this policy to present users with a simpler desktop environment and remove easy access to Computer Management and System Properties by no longer allowing right-clicking of the icon.

[User Configuration\Administrative Templates\Control Panel]
• Prohibit access to the Control Panel
Recommended setting: Enabled
This policy removes access to Control Panel and disables all Control Panel programs. It also prevents Control.exe, the program file for Control Panel, from starting. It is recommended that you enable this setting to prevent users from viewing configuration information about the Terminal Server.