Creating a locked down start menu in Vista

[strug]

Hi all,

Not an expert with creating policies so apologies if this has a simple answer that I've missed.

I've been asked to create a set of GPOs to manage some Vista desktops. These desktops are to be used by members of the public so they need to be locked down quite hard.

Most of the stuff so far has been pretty standard - however I need have close control over the users start menu programs shortcuts - basically they start with nothing and are granted access to specific applications.

So far my basic method has been to use the "Remove common programs from the start menu" setting at User Config>Policies>Admin Tools>Start Menu & Taskbar to ensure the default users start menu items are not included. To include specific apps I was planning to use Group Policy Preferences to create start menu shortcuts using item level targetting.

This works well - *except* that I'm seeing a small number of apps included in the start menu regardless (i.e. internet explorer, WIndows Mail, Windows Media Player, etc) and I can't work out how to stop these appearing.

I did try a logon script to delete the .lnk files in the users profile but it doesn't work (I'm guessing due to security permissions on the folder).

I did think about redirecting the start menu but not sure I'll get the granuality that the preferences approach provides.

WHat do you guys use to achieve this? Does anyone why I get these shortcuts and how to delete them to stop them altogether?

Any advice is appreciated.

[jeff_longley]

how many machines are you dealing with? and will they be used solely by public or a mixture of people?

Just thinking along the lines of a mandatory profile....