Whats the best way to provide a locked down PC?

[Triumph]

I've been asked to provide a PC to reception class(4 - 5 year olds) for unsupervised use. It needs internet as they want education city, some local games, printer - scary idea! and ability to save their work. They have an ancient XP standalone PC that was locked down by a previous technician using dark arts many years ago but it's dying. Any suggestions for a solution that allows them to have a positive independant educational experience with a PC but stops them trashing it and making lots of work for me will be gratefully received. We are a primary school using ranger, server 2008 R2, Win 7. Thanks.

[Steve21]

I've been asked to provide a PC to reception class(4 - 5 year olds) for unsupervised use. It needs internet as they want education city, some local games, printer - scary idea! and ability to save their work. They have an ancient XP standalone PC that was locked down by a previous technician using dark arts many years ago but it's dying. Any suggestions for a solution that allows them to have a positive independant educational experience with a PC but stops them trashing it and making lots of work for me will be gratefully received. We are a primary school using ranger, server 2008 R2, Win 7. Thanks.

Guess it depends how locked down you want it, but obviously normal GPOs would do a lot of what you want.

If you want it more "trashed" proof, You could always get a single ultimate/enterprise copy, and make the pc boot from a read-only VHD? Then if it gets trashed, it'll fix on reboot anyway?

Steve

[Pete10141748]

GPO's will lock down everything you need to block the kids from doing, it's what I do here for the Reception class children and no problems as of yet.
I also created a mandatory profile for them to use so they can't make changes to the dekstop, start menu etc. and no accicental changes are saved if they manage to do anything by mistake.

You could have a look at this too: 5 alternatives to Windows SteadyState for Windows 7 - Instant Fundas

Alternatives to SteadyState for Win7, so any changes made to the PC will be disregarded when it is shutdown, making sure that whatever they do the PC will always start up in the perfect* state you first created it in.

Obviously make sure they are saving their work to a network location otherwise that will be lost too!

*as perfect as you build it, anyway!

[elsiegee40]

I lock down PCs in EYFS (we have a Pre School as well as a reception Class) using GPO too.

If it's "standalone"... not on the network... set it up with two accounts; a password protected admin account and a limited account with no password for the children to use. (I've done that too in the past). Our filtering is RM's safetynet plus, so everything using our broadband gets filtered content.