Can Windows 2003 R2 Server manage Windows 7 Clients?

I have a Windows 2003 R2 64-bit Server with 8 Windows 7 clients and I've
been having problems setting up a Group Policy for these Windows 7
clients. I can't seem to turn things off (like not allowing them to
bring up the task manager, etc). I've been looking for articles that
talk about managing Windows 7 clients from a Windows 2003 Server, but
everything that I've been finding talks about the Windows 2008 Server.

Now I'm beginning to wonder if it's possible to manage Windows 7 clients
from Windows Server 2003.

Can anyone tell me if this is possible and maybe to point me in the
right direction toward looking for information on how to do it?

You have the option to create a central store for managing and replicationg
GPOs for Windows Vista and higher OS:
http://support.microsoft.com/kb/929841

For managing the GPO setting use the Windows 7 machine.
See also:
http://blogs.technet.com/grouppolicy...ironments.aspx

I think I need to get more information about how to do this.

By putting the templates in the central store of the Domain Contoller on
the Windows 2003 Server, does that mean that when I run mmc on the
Windows 7 client (while logged in as the Domain Administrator) and add
the Computer Management snap-in does this allow me to make changes
directly to the Domain Controller, or does it only allow me to define a
group policy object that I need to either apply to individual Widnows 7
Client machines or that I can load into the Domain Controller running on
the Server?

I guess what I'm wondering is how to get these new Policy definitions
applied to User's that are in the Domain where I have an OU already setup.

Configure the GPO settings you need from the Windows 7 machine with GPMC
installed las you know it from the earlier OS. They will be stored in the
central store and replciated to all DCs like the normal GPOs.

On Windows 7 you find all of them into:
C:\Windows\PolicyDefinitions

When you run rsop.msc on the client can you see that the GPO is applied you
has configured?

I copied the Policy Definitions (described in the URL:
http://support.microsoft.com/kb/929841) into the central store on the
Windows 2003 R2 Server's Domain Controller. I downloaded and then logged
in as the Domain Administrator on the Windows 7 client and installed the
RSAT for Windows 7 on the Windows 7 client. I enabled the
administration tools on the Windows 7 client and was able to bring up
the Group and User Management Console. The Management console showed
that I was pointing at the Domain and had all the Domain Controller
information contained in the forest domain. I was also able to bring up
the Group Policy Editor. The problem I'm having is that my changes don't
seem to make it back to the client.

I have a test user login and I created an Organizational Unit and
attached a Group Policy to the Organizational Unit. I put the test user
in the Organizational Unit and made some changes to the Group Policy to
remove Control-Alt-Delete options. I also added a Group Preference that
set an environment variable.

When I logged in as the test user, none of the settings were enforced.
Ctrl-Alt-Del had every option available (I had disabled several options)
and the environment variable didn't get set.

I even tried doing a gpupdate /force to force an update, but that didn't
work.

Maybe I copied the wrong Policy Definitions (I got them from the link in
http://support.microsoft.com/kb/929841). Now that I look at that, it
looks like those are for Windows Server 2008. Maybe that's the problem
and all I need to do is find them for Windows 7.

I think I'm missing something, but I haven't figured out what yet.

I got rid of the Vista Policy Definitions in the Domain Controller
central Store and then I copied the Windows 7 Policy Definitions from
C:\Windows\PolicyDefinitions to the Domain Controller central store.

I logged into the Client as the Domain Administrator and made some
changes to the Org. Unit and GPO so that the changes I wanted would be
made with the new Policy Definitions. After this I ran a 'gpupdate
/force' on the server. I then logged into the client as the testuser to
see if my policy changes got propagated.

I ran the rsop.msc on the client, but got this error message:

"The RSop snap-in was unable to generate the
computer's data due to insufficient permissions. The
snap-in will continue to start but only the user's data
will be displayed."

I looked at the Action/properties on rsop and saw this:

Mode: Logging
User name: CADLAB\testuser
Display user policy settings: Yes
Computer Name: CADLAB\CADLAB4-PC (Access Denied)
Display computer policy settings: Yes

The computers are part of the Domain, but I'm wondering if this is
because the computer itself is not in the Organizational unit. I didn't
put the computers in the OU because I didn't want to restrict based on
the computer, but do I have to put the computer into the organizational
unit in order to get the GPO to apply for a user that logs into that
computer?

I only wanted to attach the user to the Organizational Unit so that
other users could login to that same computer and not be as restricted.

This is what I want to do:

I want to have a GPO apply to a set of users (one user is called caduser
and the other user is called testuser). These users are restricted
pretty severely. For example, they can't bring up the task manager, they
can't install programs, the documents directory is cleared when caduser
logs out, etc.

I still want other groups to be able to login on these same computers
and use the same computers. Those users would have less restrictions:
They would be able to keep their Documents, etc.

Is this configuration possible or do the Computers have to be contained
within an Organizational Unit?

I thought I'd create an Organizational Unit and use a GPO to restrict
users in the OU.

CADUSERS_OU -> CADUSERS_GPO

I noticed that "Authenticated Users" are part of the CADUSERS_GPO, but
I'm wondering if I this will cause all Authenticated Users to be as
restricted as these cadusers and if so, do I need to remove
Authenticated Users from the caduser's GPO?

[Atiffita]

Yuppp we can manage Windows 7 clients from Windows Server 2003 as its the scenario in my organization. Bt blv me I don't know how it happened as It was done by my predecessor.