We're seriously considering switching away from Windows 7 to Server 2012R2 as our View desktop. Mostly I have everything working OK. Here's my one issue. Over the years we have just let users be administrators on their own desktops. While I realize that this can be an issue with Windows, the number of times that we would have had to get involved to solve some issue if the user hadn't been a local admin are too numerous to count... so we're not going to abandon that strategy. However, since we are potentially handing them a server with hooks into AD and utilities like Server Manager that were never meant to be used by regular users, I am in a quandary as to how to give them a functional desktop, let them be local admins and restrict them from things that could potentially cause issues.
I've already seen the GPO's that can be created to hide things like the Server Manager and Powershell icons and keep the SM from starting at boot. I've also played with just renaming executables like SM and PS so that even if the icons are there they don't do anything. However, I'm afraid that I will miss something that could become a problem if a user stumbled upon it and I was wondering if VMware or any user here might have a list of tweaks to do to neuter the server part of the server.
Thanx... Jon