Group Policy guidelines needed for students in years 3 - 6

[richard]

I'm having problems with slow login times at a junior school I work for and after having a good look at the problem and running Dcdiag and Netdiag I have come to the conclusion that the group policy for students is at fault. Now I have no real experience of group policy's for this age range as I am used to secondary schools where we locked down everything and anything. What I am looking at doing is creating as simple a policy as possible but also keeping a reasonable level of security.

If any one has a template or breakdown of what they have done I would be most grateful.

[eean]

How slow are you talking about? I wouldn't have thought that adding or removing a few policy settings would make a significant difference. My first guess is that the slow part is due to redirection of my docs/start menu etc.. There is a bug fix from microsoft which knocks 20 secons off logon (search here for it or let me know and I'll post it again).
Have you disabled the machine settings portion of the gpo?
What sort of setup do you have? Roaming profiles? Man profiles?

I've attached the our GPO results for the pupils OU. I've restricted most things really: hidden local drives (but not denied access to them), removed extra start menu stuff... removed internet options, removed access to the control panel but I wouldn't go as far as, say, removing RH context menu.

Have you had a look at this thread?

http://www.edugeek.net/index.php?nam...ewtopic&t=3758

[richard]

The logon time is approximately 1 min 30 secs from the time a student enters their password. compared to 15 seconds for mine which has admin rights. The staff logon time runs somewhere in the middle. We have mandatory profiles set up (4 in all). I have already applied the patch from Microsoft to the server and all the stations and it didn't do much to the logon times at all.

[eean]

Are you redirecting folders? If you aren't the patch won't make any difference. If you aren't redirecting folders, where is your desktop and my docs stored? If it's still within the profile then that will be being copied over the network every time you logon.

1 min 30 is really high. Ours is about 20 seconds (over a wireless network with 600mhz celerons):
7 seconds loading personal settings
3-5 seconds applying personal settings
The rest is the logon script farting about with printers and the AV loading.

Which bit is slow? If it's loading personal settings, then your network link is slow and/or your profile is too big. (Our profiles are about 1MB) If it's applying personal settings, then yes, you're GP is at fault.
Have you checked your DNS settings? On your computer, your only DNS should be your internal Domain server - NOT the DNS server provided by your LEA.

Have you tried disabling the GP to see what happens? Then try creating a temporary new one with only, say, one setting changed?

[richard]

We are redirecting folders for all users. I can't tell you exactly where things such as the programs folder and desktops are stored as i'm not at that school today.

The profile size if I remember correctly is about 1MB and the DNS settings are fine as we are not directly connected to our LEA yet.

[bossman]

We have roaming profiles for all users:
logon times are thus:

restricted user type new profile = 30 - 40 secs
when user logs off and back in again = 12 - 15 secs.

staff user type new profile = 30 - 40 secs
when user logs off and back in again = 12 - 15 secs.

Admin user type new profile = 20 - 30secs
when user logs off and back in again = 12 - 15 secs.

RMCC3 Gb fibre backbone to cisco catalyst layer 3 switches and 100Mb cat5e direct to client. Slowest workstation 1.8Ghz with 256 ram 5400 hdd.