Startup script that disables local account while on school network

Hi all,

[Background Story]

We run a laptop scheme for our students and are currently in our fourth year. The laptops run XP (2 years worth), Vista (1 year) and Win 7 (1 year). Each student with a laptop has a domain account (to use while in school) and a local account on the laptop (to use while at home). We locally manage our domain and AD. Our servers are running Server 2008.

[Problem]

Over the years we have repeatedly told the students to logon to the school domain while in school and NOT their local accounts. They say that the reason that they are on their local account is that they can't get to the homework they have done. But we have put a link to their local documents in the start menu when they are logged onto the domain.

[Solution]

I'm looking for a way to disable all local accounts (apart from the administrator account) when they turn on their laptops in school. Thus forcing them to logon to the domain. Then, when they turn off their laptops at the end of the day, another script will enable the accounts.

[Thanks]

I hope that someone could help me with this and appreciate anyone that has read through to this point.

Cheers,

Chris.

Why do you have separate accounts? Could you just not cache the domain account on there and then assign something like power user or local admin via restricted groups in gp, instead of dealing with separate accounts?

What p858snake said ..

They used to have separate accounts for staff laptops here before I started, but now they all use one account with the relevant things applied to them (to be honest, I keep the machines locked down somewhat anyway as they are a school machine and they shouldn't be installing little Jonny's latest game for them to play).

Also, a script wouldn't work for the techy savvy kids, as if they simply booted the machine with the WiFi turned off / Eth not plugged in, they would be able to get their local accounts whilst in school by plugging in / turning on after they've booted up their machines. Where as a single sign on gets round this as whichever way they work, if they want internet / file access in school they need to have the net on, so the machine will automagically connect to the network with no issues ..

Quote:

---

Originally Posted by p858snake

Why do you have separate accounts?

---

The laptops belong to the students (they are bought through a kind of hp scheme from the school), but they are still theoretically 'owned' by the school until the parents have finished paying for them. Thanks to the original plan from the SLT, there is such a grey area concerning what the students and us can and can't do with the laptops. If I had my way, I would scrap the scheme completely and go back to desktops and department laptops!!

Quote:

---

Originally Posted by TriggerHappyUK

The laptops belong to the students (they are bought through a kind of hp scheme from the school), but they are still theoretically 'owned' by the school until the parents have finished paying for them. Thanks to the original plan from the SLT, there is such a grey area concerning what the students and us can and can't do with the laptops. If I had my way, I would scrap the scheme completely and go back to desktops and department laptops!!

---

Yuk .. feel for you there then as it's such a nightmare .. I guess the only thing you could do then would be to limit the use of school facilities to authenticated users only, which means if they log on with their AD credentials they'll get internet, files, printing, etc, etc, however, if they use their local account they get nothing, no internet, no files, no printing, just whatever they have access to locally ..

Code:

---

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objNetwork = CreateObject("WScript.Network")
strComputer = objNetwork.ComputerName

Set colAccounts = GetObject("WinNT://" & strComputer & "")
colAccounts.Filter = Array("user")

serverFile = "\\server\share\file.name"

If objFSO.FileExists(serverFile) Then
        For Each objUser In colAccounts
                If objUser.Name <> "Administrator" Then
                        objUser.AccountDisabled = True
                        objUser.SetInfo()
                End If
        Next
Else
        For Each objUser In colAccounts
                objUser.AccountDisabled = False
                objUser.SetInfo()
        Next
End If

---

Assuming the script can be stored on, and run from, the local machine (so that it works when they aren't connected to the network) then this would do it. However, as pointed out, if they simply disconnect their cable or switch off the wireless, then it wouldn't work. The above solution might be better, although I've never had to set that kind of thing up so I wouldn't know how easy or hard it might be.

Script made up from examples here:

http://www.activexperts.com/activmon...ps/localusers/

Client Side Extensions (GPOP) can add delete and disable local accounts but the magic is that it has item level targeting. You could have it look for a server or a certain ip range and then disable or renable the account depending.

I'd make to entries:

disable account x + ILT if iprange isn't xxx to xxx

enable account x + ILT if iprange is xxx to xxx