Configured Proxy Settings

[OutLawTorn]

One school i work at is running a program where students use laptops that they purchase from the school on a contract. When they are at school they log on to the domain using a user-account, however when they log on at home they have a laptop-specific admin account.

The problem we are finding, is that a lot of the students are using their "home" accounts when at school (thus denying them access to network drives/etc) and then complaining when it doesn't work. Ideally, they shouldn't be able to access the internet or anything at school on their "home" accounts as the browser shouldn't have the appropriate proxy settings.

My question then, does anyone have any suggestions on a script or something that could clear/disable either their proxy settings and/or school wireless settings whenever their local user account logs on (thus forcing them to use their domain account). The catch would be we wouldn't want to stop them being able to use home wireless networks when logged on as their home user.

[rob_f]

One way would be, if you have one, to use authentication on your outgoing internet proxy/filter such that only "known" users would be allowed access to the internet.

Although IMHO the setup you have anyway isn't ideal as from what I can tell you are allowing the students admin access to the laptops, which allows them to install all manner of unwanted software that puts your network at risk.

What I have seen done before is to have student laptops dual-boot, such that there is an installation of the OS for use in school and another for use at home. However you will then need some form of network security such that the "home OS" isn't allowed access to the school network.

[OutLawTorn]

Even tho the students "own" them, they are managed through the school... so we have up to date virus scanners on them, and if there is a software problem with one of them our usual solution is to just reimage them...

The proxies are managed by the NSW Dept of Education, so once a student/staff member has their username and password they can log in on any computer on the DET network (so any primary or high school in the state)... the only thing stopping them would be to not have the appropriate proxy/pac file configured... or not allowing them access to the wireless network (which is an Aruba network the school got as part of a trial)

[FN-GM]

You could still setup your own proxy server and set the proxy server IP using loopback in group polices, so then it would only apply to your computers.

We have setup authentication on our proxy now, stops people from simply plugging in there laptops

[AngryITGuy]

My question then, does anyone have any suggestions on a script or something that could clear/disable either their proxy settings and/or school wireless settings whenever their local user account logs on (thus forcing them to use their domain account). The catch would be we wouldn't want to stop them being able to use home wireless networks when logged on as their home user.

We use something similar to this script found here. Rather than using it as a script I changed to an app with buttons which allows staff to either enable/disable the school proxy when required.

The part of interest to you would be:

Const HKEY_CURRENT_USER = &H80000001

strComputer = "."
Set objRegistry = GetObject("winmgmts:\\" & strComputer & "\root\default:StdRegProv")

strKeyPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Interne t Settings"

strValueName = "ProxyEnable"
dwValue = 0
objRegistry.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName, dwValue

which basically disables the proxy.

Hope this helps

[Michael]

The easiest solution would be to create a batch file which'll run a registry file silently to remove proxy settings when logging on locally. You'd place the batch file within the Startup folder on the Start Menu.

Batch file:

@echo off
regedit /s "C:\ProxySettings\disable.reg"

Reg file:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable"=dword:00000000

However, seeing as your pupils are local administrators on the laptops (which is crazy!!), they should all be configured as limited users, otherwise they can change whatever they like!

[rob_f]

I would imagine that if the students own them (i.e. pay money for them) then they would expect to be able to install their own software. Hence why I have seen dual-boot in the past to allow this.

[Michael]

You don't really need a dual boot configuration to allow this. That's what the drop down Log on to: menu is for. Logon locally or logon to the domain.

[OutLawTorn]

The school is running an altiris deployment server, so creating the vbscript to disable the proxy, and using altiris to deploy this to the user account start menu (all of the laptop local accounts have the same username/profile paths) sounds like a go...

Thanks for the help guys (and gals?)

And yes i realise the issues with the students having local admin rights on their laptops: we had at least two infections make their way through one grade last year, but as has been said, as the girls own them it was a requirement that they could have that freedom... as the network PCs are covered by the department's licencing, they have a corporate antivirus app so they're protected from anything the girls can bring in, the main issue was caused by not being able to have the same software on the laptops as they are owned by the students themselves which we've since solved...

generally if there is any problems with the laptops, we just reimage them which takes only 20 mins or so per machine (worked out its faster than going thorugh the steps of troubleshooting problems with the software)...