random stuff Bubba comes across - and needs to remember. 
Try one thing: install Microsoft Office (pretty much any version) on a Terminal Server (sorry, it's Remote Desktop Session Host, or RDS Host, since we're on Server 2008 R2). Then try to use some advanced Outlook forms - like what we do with IronMountain (formerly Mimosa) NearPoint. Chances are you'll see a message telling you to bugger off - because Form scripting is not installed.
Somtime you want to protect computer users against themselves. Especially in Remote Desktop Session (ie.e. Terminal Server) environments that would be an excellent idea.
One of the things you might want to do is to restrict the control panel items your users can access. In the past you did that by specifying which .cpl applets were permitted. Not so any more - of course
Okay, call me slow in the uptake. But what's the point of looking stuff up that you got no use for? None. So, until recently I didn't need to find out how to enable Single Sign on for users of a Terminal Server who want to use a Remote App on another machine. Luckily. The MS team already had a great blog post on enabling SSO for REmote Apps in Remote Desktop Serices.
Find it here: http://blogs.msdn.com/b/rds/archive/2007/04/19/how-to-enable-single-sign-on-for-my-terminal-server-connections.aspx
Okay, I was browsing around looking for the control panel applet names in Windows Server 2008 (or Windows 7, or Windows Server 2008R2, for that matter) to include in a new policy. Not that you ned to know what I was doing, but just throwing it out there.
Anyway, over on petri.co.il I came across a cool thing: GOD MODE.
Of course, the guys and gals in Redmont can't think of everything. One of the things they didn't think of was that not every admin is happy if his users can browse the entire network - or worse, do so by accident, consuming precious Remote Desktop Host resources in the process.
So: How do you turn that pesky Network icon off in Windows Explorer?
Easy... just set the following registry key: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C} and give it a dword:00000001 value.
Hmm. Works nicely - but kind of unpretty if you need to do it for a couple of dozen (or more) servers. Fortunately, you can create a custom admx file that turns the Network icon off in Windows Explorer for you by doing the exact same thing - but then administered centrally.
Better yet, you don't have to do it yourself: Here's the admx & adml files I use to do it. Use them as you see fit - just don't remove my credits, please.
In order to use them, unzip the zip file from this download. Place the BubbaKraut.admx and the BubbaKraut.adml files in either your local or central repository (unless you already use some of my admx files, then you'll have them already). Then add the aother two files, too. Open your Group Policy Management Console, find the BubbaKraut Customizations node in the Computer policy - and take it from there.