Got it in a nutshell , Roy.For it to work it's important to have a good, co-operative relationship between SMT, ICT Department, ICT Support staff and a degree of trust for the kids.
That's why your idea has met so much resistance - a lot of the techs on here don't have these luxuries ,as you may have noticed....
call it paranoia 'til it happens , but call it TROUBLE when it does!
I you create a domain security group (let us call is w00t_users for the moment) and give it local admin rights to individual machines (eg workstations in the Library) and them make students members of that group then there are all sorts of things they can see ...
But if your home areas are on the fileserver then no files (other than temp files) are on the local machine ... so they are safe.
I would seriously hope noone would make w00t_users local admins on any server ... and so they are protected.
GPOs can be used to lock down what is done with machines and if anyone is deleting system files remotely then use RIS and it will copy them back in on reboot (generally).
Area of concern would be using access to remotes shares (I won't describe who you access them here ... in case the little darlings look) and dropping alternate apps in for existing apps ... eg swapping excel for a keylogger.
There are about a few areas I would not want this securty group to have access to ... and so I set ACLs to make sure they don't have modify rights ...
And if in doubt ... use a cattleprod on the likely culprits ... it deters the others!! (only joking!)
That doesn't seem to be the case here - with redirected folders here - we still get profile areas left on the hard disk until we clean up!Originally Posted by GrumbleDook
But the profiles should not hold full documents ...
They do when you are logged in and put them on your desktop, at least if you use roaming profiles. If you redirect the users desktop then they will be wherever that is
we don't give users access to stick things on their desktop ... partly for this reason.
Actually ... telling a lie ... we do give access to staff ... but will shortly be removing that since they have roaming profiles and keep complaining about the long logon times (Yes ... it will take a long time to logon over wireless IF YOU HAVE A FOLDER OF 6GB OF CRUD ON YOUR DESKTOP!!!)
The big killer for profile logon times is cookies - ever wonder how long it takes to copy 15k cookies? A while :P
@GrumbleDook - Why not redirect the Desktop folder?
@DMcCoy - You could of course exclude the Cookies folder from the roaming profile.
Excuse me you use roaming profiles with laptops or do you have some desktops with wireless NICs?
We don't redirect staff desktops to stop them moaning if they lose connectivity because they have done something like turn of the WiFi but that will be gone once we lock down their desktops too ... we don't redirect student desktops because there is simply no need to ... we have nothing on there that we need redirecting.
I use offline files to get round the staff desktops disappearing (also do mydocs and startmenu). But only applies to staff on staff laptops.
Students desktops are redirected to a read only folder with a few shortcuts in for the more common apps.
There are currently 1 users browsing this thread. (0 members and 1 guests)
Posting Permissions
LinkBack URL
About LinkBacks