Restricting MMC.

[boomam]

Ive worked it all out, and saved it in a MMC called 'Pupil Password Management'
But it wont open, for anyone, unless its run on the server.

Microsoft Management Console
MMC cannot copen the file XXXXXXX\Pupil Password Management v1.msc.

This may be because the file does not exist, is not an MMC console, or was created by a later version of MMC. This may also be because you do not have sufficient access rights to the file.

[boomam]

Sorted that, redid the mmc on my XP workstation.

Now the problem is that all the menu options under right click work.
How do i disable them all, apart from passwords?

[ICTNUT]

Did you save the file itself or a shortcut to the file??

Also was it done on the server?? The MMC on the server could be v3.0 but the desktops could be v2.0, this was a problem I ran into when I rolled mine out.

Download MMC 3.0 for XP SP2

[ICTNUT]

You need to login as a teacher that is likely to use this and test it that way.

Create a test user that you can delete, disable etc...

Right click will work regardless but if you select something that you do not have the rights to do it will give you access denied.

[boomam]

You need to login as a teacher that is likely to use this and test it that way.

Create a test user that you can delete, disable etc...

Right click will work regardless but if you select something that you do not have the rights to do it will give you access denied.

Sorted it, everything does appear, but nothing but properties & password actually work. Which is fine byme.
Just need to roll out MMC to every computer with just the snap-ins installing on each system, and not displaying shortcuts...

[ICTNUT]

Good to see you go it sorted

Take a look at the custom adminpak.msi install link I posted earlier this will show you exactly how to do it.

[boomam]

Good to see you go it sorted

Take a look at the custom adminpak.msi install link I posted earlier this will show you exactly how to do it.

I take that that the:
msiexec /i adminpak.msi ADDLOCAL=FeADTools /qb
command can be run as a startup script in a GPO?
Plus, what does the command switch "/qb" do. I'd like to find a list of command switches for that, but cant.
As i'd like to find the switches to make the install happen silently, and to add no shortcuts.

That 'staff' guide you created, in your first post, by any chance do you have the original template for that lying around in a format i can edit? Im too lazy to create one myself.

Thanks for all the help btw. Its been much appriciated. .

[Geoff]

Here's the technet article on msiexec command line options. Beware, it is long and complex.

http://technet2.microsoft.com/window....mspx?mfr=true

[boomam]

Here's the technet article on msiexec command line options. Beware, it is long and complex.

http://technet2.microsoft.com/window....mspx?mfr=true

Thanks.
Doesnt look like theres a command to set it so no shortcuts are installed, although changing the command to:

msiexec /i adminpak.msi ADDLOCAL=FeADTools /qn

Will hide the install process.

[Geoff]

Thanks.
Doesnt look like theres a command to set it so no shortcuts are installed

Normally, you need to alter the tables in the MSI (or use a transform) to prevent those sorts of operations. Have a look at ORCA.

http://support.microsoft.com/kb/255905

[boomam]

Normally, you need to alter the tables in the MSI (or use a transform) to prevent those sorts of operations. Have a look at ORCA.

http://support.microsoft.com/kb/255905

How do i use Orca to remove the shortcuts?
It just looks like the editing program for FM at the moment! .

[boomam]

lol. Sorted it!
Dunno if this was the right way of doing it, but i just removed the shortcut and shortcuticons tables from the left columns, and re-saved.
I tested it on a VM of a base XP install, and no shortcuts showed up! .

[Geoff]

How do i use Orca to remove the shortcuts?

That depends on the MSI. Check the properties table.

[boomam]

Ive just seen this:
http://www.edugeek.net/forums/showpo...11&postcount=3
I cant get the view on the left without the entire AD showing, hows he done that?

Plus, is there a way i can stop the user pressing backspace too many times to get access to the rest of AD?

[ICTNUT]

is there a way i can stop the user pressing backspace too many times to get access to the rest of AD?

Short answer is no but if youhave got the correct permissionsin place this should not be a problem really.