Disable Saving files and folders on desktop by group policy

Question

I am using Windows Server 2012 R2 (AD, DC). 20 computers are joined with DC (Users are on Win 10 OS). I want to disable desktop file saving through group policy, and in this regard, I tried following it worked for users but denies administrator. (I don't want to redirect to network share)

I created a script and added in Log On:

Echo Y| %userprofile%\desktop /g %username%:r

It worked but when I right click on desktop then new->folder, it asks for the administrator login. When I enter administrator user and password, it denies.

I have also tried following but it did not work also: Only working for users, not admin:

    IF "%username" == "administrator" (
   Echo Y| cacls %userprofile%\desktop /P %username%:W
) ELSE (
   Echo Y| cacls %userprofile%\desktop /P %username%:R
)

Can you please put the output of this command for one of your users?: icacls %userprofile% (icacls is the command that replaced cacls) — curropar, Nov 13 '17 at 09:49

score 1 · Accepted Answer · answered Jun 09 '20 at 08:08

I have tried the following and it worked. Now users have limited access on the desktop. And only the Administrator can save files or perform operation on desktop (delete/save/etc).

Echo Y| cacls %userprofile%\desktop /e /P %username%:R
Echo Y| cacls %userprofile%\desktop /t /e /g Administrators:f

Disable Saving files and folders on desktop by group policy

1 Answers1