+ Post New Thread
Results 1 to 7 of 7
Windows Server 2008 Thread, GPOs setup on new domain in Technical; Hi All, Just playing with new domain,which I plan to put live next summer. It is windows 2008R2 and I ...
  1. #1
    kcymer's Avatar
    Join Date
    Nov 2007
    Posts
    149
    Thank Post
    4
    Thanked 9 Times in 8 Posts
    Rep Power
    15

    GPOs setup on new domain

    Hi All,

    Just playing with new domain,which I plan to put live next summer.

    It is windows 2008R2 and I have few issues with setting up right gpos for students.

    I have restricted quite a lot, but kind find few things, so maybe you can help.

    How to hide few icons from accessories:
    RDP, Run, and Powershell folder

    There is quite a lot Administrative templates, so maybe I have missed something.

    Thanks in advance

  2. #2
    Azhibberd's Avatar
    Join Date
    May 2008
    Location
    Newbury,Berkshire
    Posts
    169
    Thank Post
    20
    Thanked 21 Times in 20 Posts
    Rep Power
    16
    Good to see i'm not the only one starting now with the new domain for summer Your most likely doing exactly what i'll be doing over the next few months... Testing testing testing... But anyway, Simple way we got around that was not to show the all users programs(we use redirected instead) and mandatory profiles,
    Not sure if there is any other way.. Hopefully someone else can shed some light!

  3. #3
    kcymer's Avatar
    Join Date
    Nov 2007
    Posts
    149
    Thank Post
    4
    Thanked 9 Times in 8 Posts
    Rep Power
    15
    Yeah, preparation begins early, as we are atm RM CC3 school I want to move away. We pay them around 5k for support and we don't really use it often.

    Found a kind of solution to my problem, run is not a problem as there is GPO to remove it. With other software there is a gpo which prevent users to open specified programs, you need to provide exe files. Almost everything covered, apart from task scheduler as this is msc file. So users can see those programs, but when they try to launch it, they get info that they can't as administrator restricted it. Not a solution I would like to see, but at least it works. I will look as well at your way with redirection - can you provide bit more details - do you redirect start menu components?

    Now I'm looking at mandatory profiles, I know I suppose to copy one profile and than it become one, but I'm not sure where I suppose to copy it from. Only ntuser.dat I can find on my test windows 7 machine is in c:\user\default. Would love to see some kind of detailed guide. Only what I could find is copy profile to shared folder and change ntuser.dat to ntuser.man.

  4. #4

    Join Date
    Jan 2006
    Location
    Surburbia
    Posts
    2,178
    Thank Post
    74
    Thanked 307 Times in 243 Posts
    Rep Power
    115
    I think the most effective way of sorting out menus is to redirect them so that they only get shortcuts you put there. Some folk redirect to server shares, but for various reasons I sync them to the local machine during computer startup ("them" = several different menus for different user groups).

    Note that only sorts out the Programs bit, you still need to fiddle with GPOs to control everything else.

  5. #5
    jsnetman's Avatar
    Join Date
    Oct 2007
    Posts
    887
    Thank Post
    23
    Thanked 134 Times in 126 Posts
    Rep Power
    39
    Here we don't focus on removing everything in the start menu, sort of giving them a taste of what is potentially accessible without allowing locked down users to access them (apart from control panel that is). Which is all possible via GP. I can understand if you don't want users to see icons or start menu items that they won't have access to, but giving them a standard start menu is more like what they are used to at home and more intuitive. I have seen some desktop experiences in some schools I have visited and it looks nothing like a standard desktop. I would class this as counter intuitive.
    Last edited by jsnetman; 20th October 2010 at 10:21 PM.

  6. #6
    kcymer's Avatar
    Join Date
    Nov 2007
    Posts
    149
    Thank Post
    4
    Thanked 9 Times in 8 Posts
    Rep Power
    15
    I don't want really to totally change start menu, just limit it, so pupils will not fiddle with it instead of listen to the teacher/do work. We have here few bit more able kids, they did write scripts to try hack security and other sorts of things. I don't want them really to access powershell, or task scheduler. Sometimes they pretend that computer done something weird and they have to get IT help so they come to our office for help, in slowest way they can - they have this special walking technique, where they are slower than turtle - everything to get out of the lesson. I know that most of them will not touch those programs, but small numbers will, and I know I will have teachers complaining about it.

  7. #7
    Azhibberd's Avatar
    Join Date
    May 2008
    Location
    Newbury,Berkshire
    Posts
    169
    Thank Post
    20
    Thanked 21 Times in 20 Posts
    Rep Power
    16
    Ye we had the same issue with kids writing vbs scripts etc, hence now nothing can be run without us putting it in required places!
    But basically we have the gpo for startmenu redirect to \\servername\menu$\students\etc then have folders in there for each subject and then general for those other things like volume control that is needed by all the students. This way the start menu is always the same for them, and we have full controll of what is on it as only administrators have write access to the folder!

    Gotta say not made a mandatory profile yet in windows 7 but they seem to have a little guide going on here Managing Roaming User Data Deployment Guide

SHARE:
+ Post New Thread

Similar Threads

  1. Replies: 5
    Last Post: 13th April 2010, 05:26 PM
  2. No Domain Join during Setup
    By Nick_Parker in forum Windows 7
    Replies: 19
    Last Post: 24th August 2009, 01:13 PM
  3. Replies: 4
    Last Post: 5th June 2008, 10:28 PM
  4. Replies: 4
    Last Post: 21st February 2008, 03:09 PM
  5. GPOs with everything
    By ITWombat in forum Windows
    Replies: 13
    Last Post: 3rd July 2006, 03:03 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •