I struggled with this for a while but I finally figured it out. I've used this script on my servers and it works perfectly. It allows you to set all the taskbar options: 1. Hide the clock (or show it) 2. Taskbar always on top 3. Taskbar autohide 4. Show small icons on Start Menu The script could be easily modified to set these options based on group membership, username, etc. I've included the script text below, but it can also be found at: http://www.axcentsolutions.com/technical/settaskbaroptions.asp. Copy the script text and save it as a .vbs file. Read the script comments for usage instructions. The only drawback to using VBScript during login is that you have to allow users to run WSCRIPT.EXE. This is allowed by default, of course, but if you use 'Run only allowed Windows applications' (in your NT4 policy or in your AD Group Policy), and/or if you limit applications with AppSec, you'll have to allow WSCRIPT.EXE, which is the Windows Scripting Host executable. As a side note, I use both 'Run only allowed Windows applications' and AppSec, and I routinely use VBScript during the login process, which is a bit risky because I'm giving users permission to run VBScripts. To protect the server, I rename the WSCRIPT.EXE executable to something less noticeable, remove the VBS file associations, create a new association for scripts, and then allow the new executable in 'Run only...' and AppSec. Sure, it's 'security through obscurity', but VBScript is too powerful to not use it to control the user environment. JD Jeff Durbin Sr. Systems Engineer A+, N+, CCA, MCSE Axcent Solutions 16 Technology, Suite 156 Irvine, CA. 92618 949.341.0566 voice 949.341.0569 fax www.axcentsolutions.com <http://www.axcentsolutions.com/> jdurbin@xxxxxxxxxxxxxxxxxxx Register for a FREE half-day Virtual Workplace seminar by clicking here <http://www.axcentsolutions.com/seminars_events/seminars_times.asp> . '======================================================================= ========= ' ' NAME: SetTaskBarOptions.vbs ' ' AUTHOR: Jeff Durbin, Systems Engineer, Axcent Solutions www.axcentsolutions.com <http://www.axcentsolutions.com> ' DATE: 01/24/2003 ' ' COMMENT: In a Terminal Server or MetaFrame environment, the administrator ' usually tightly controls the user environment using System Policy ' or Group Policy. Policy settings make changes to registry values ' that are reflected in the user's environment. Unfortunately, some ' of the common settings, such as those that affect the Taskbar, ' are not controllable via policy. Examining the registry value ' that determines the Taskbar's configuration reveals the problem: ' the settings are lumped into a binary key. In the case of the Taskbar, ' 4 bits of byte 9 (for Window NT/2000) determine which of the Taskbar's ' options are enabled. This is a problem, as System Policies and Group ' Policy do not give us a mechanism for changing a single bit within ' a byte. Take the clock, for example. I routinely have customers that ' ask me to either turn the clock ON for all users, or turn the clock ' OFF for all users. This is not a problem for users that have never ' logged on and don't have a Terminal Server profile. I modify the ' Default User profile on the Citrix servers using REGEDT32 and set ' the options the way I want them. I'm out of luck for users with roaming ' profiles that already exist, however; because their profiles already ' exist, they never receive the settings I've made in the Default User ' profile. So the question becoms: how do you change the settings for ' users with existing profiles? ' One way would be to use REGEDT32 to load the NTUSER.DAT registry ' hive for each user and make the change. That's fine if you have 10 ' users, but if you've got 500, that's not practical. Obviously, you ' want to make a change as the user logs in. The first question to ' resolve is, what bits need to be changed? The bits and their functions ' are as follows: ' ' Bit 1 (from right): on = autohide ' Bit 2 (from right): on = always on top ' Bit 3 (from right): on = show small icons ' Bit 4 (from right): on = hide clock ' ' Auto Always Show Small Hide ' Binary Dec Hex Hide On Top Icons Clock ' ---------------------------------------------------- ' | 00000000 00 00 | | | | | ' | 00000001 01 01 | x | | | | ' | 00000010 02 02 | | x | | | ' | 00000011 03 03 | x | x | | | ' | 00000100 04 04 | | | x | | ' | 00000101 05 05 | x | | x | | ' | 00000110 06 06 | | x | x | | ' | 00000111 07 07 | x | x | x | | ' | 00001000 08 08 | | | | x | ' | 00001001 09 09 | x | | | x | ' | 00001010 10 0A | | x | | x | ' | 00001011 11 0B | x | x | | x | ' | 00001100 12 0C | | | x | x | ' | 00001101 13 0D | x | | x | x | ' | 00001110 14 0E | | x | x | x | ' | 00001111 15 0F | x | x | x | x | ' | -------------------------------------------------- ' ' Writing a script to change those bits is simple. Unfortunately, ' if you run the script during logon, the changes aren't reflected ' on the Taskbar because Explorer has already loaded. You might think ' that the changes would show up at the next login, but that's not ' the case; it seems that that the settings revert to those stored ' in the profile. You could kill Explorer and restart it, but that ' wouldn't be a very nice login for the users. ' The answer is to run the script -before- Explorer starts. To do ' this, follow these instructions*: ' ' 1. Save this script to your Winnt\system32 folder ' 2. Open winnt\system32\usrlogon.cmd ' 3. Add the following line after the @Echo off line: ' ' %windir%\system32\SetTaskBarOptions.vbs ' ' That's it. Now, when a user logs in, the script will run and set ' the options before Explorer runs, so the settings will show up ' immediately. ' ' * These instructions are for Terminal Servers. A similar technique ' can be used on non-TS machines (which don't use USRLOGON.CMD). ' At HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, ' there is a value called 'UserInit' which references an executable ' called USERINIT.EXE. You can replace the reference to USERINIT.EXE ' with a reference to a batch file (say, USERINIT.CMD). The batch ' file contents could be: ' ' @echo off ' cls ' SetTaskBarOptions.vbs ' userinit ' ' USAGE: This script relies on WMI, which is included with Win2K and above. ' Microsoft may have started distributing WMI with NT4 SP6. If you ' don't have it on your NT4 box, download it at: ' ' http://www.microsoft.com/downloads/details.aspx?FamilyID=afe41f46 <http://www.microsoft.com/downloads/details.aspx?FamilyID=afe41f46> ' -e213-4cbf-9c5b-fbf236e0e875&DisplayLang=en ' ' To configure the options, modify the variables below the line that ' reads: '*************** OPTIONS ARE SET HERE *************** ' For example, I prefer the following configuration: show clock, always ' on top, do not hide taskbar, show small icons. To achieve this result, ' I need to set two bits (always on top, show small icons), and clear ' 2 bits (auto hide taskbar, hide clock). You simply add the 4 constants ' to the appropriate variable: intBitsToSet or intBitsToClear. ' The registry key is called StuckRects in NT 4.0 and StuckRects2 in ' Windows 2000. To use the script for NT4, comment out the Stuckrects2 ' line and remove the comment character (') at the beginning of the ' Stuckrects line. ' '======================================================================= ========= Option Explicit On Error Resume Next Dim oReg Dim intBitsToClear, intBitsToSet Dim strComputer, strKeyPath, strValueName, strValue Const HKEY_CURRENT_USER = &H80000001 Const cAutoHideTaskbar = 1 Const cAlwaysOnTop = 2 Const cShowSmallIcons = 4 Const cHideClock = 8 '*************** OPTIONS ARE SET HERE *************** intBitsToSet = cAlwaysOnTop + cShowSmallIcons intBitsToClear = cAutoHideTaskbar + cHideClock '**************************************************** strComputer = "." strKeyPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Stuckrects2" ' *** For Win2K *** 'strKeyPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Stuckrects" ' *** For NT 4.0 *** strValueName = "Settings" Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _ strComputer & "\root\default:StdRegProv") oReg.GetBinaryValue HKEY_CURRENT_USER,strKeyPath,strValueName,strValue strValue(8) = strValue(8) OR intBitsToSet strValue(8) = strValue(8) AND (NOT(intBitsToClear)) oReg.SetBinaryValue HKEY_CURRENT_USER, strKeyPath, strValueName, strValue ' Set: Byte = Byte OR cShowSmallIcons ' Clear: Byte = Byte AND (NOT(cShowSmallIcons)) ' Check: if ((Byte AND cShowSmallIcons) = cShowSmallIcons) ******************************************** This Week's Sponsor: triCerat Inc. Let triCerat simplify the administration of your Terminal Servers. http://www.triCerat.com ******************************************** For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode use the below link: http://thethin.net/citrixlist.cfm