+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 17
Windows Thread, Stopping Pupils Access Staff PC's in Technical; Hi We run a 2003 / XP network with Ranger on to.. I want to restrict students from accessing staff ...
  1. #1
    Grommit's Avatar
    Join Date
    Sep 2006
    Location
    Weston-super-Mare
    Posts
    1,335
    Thank Post
    31
    Thanked 54 Times in 31 Posts
    Rep Power
    24

    Stopping Pupils Access Staff PC's

    Hi

    We run a 2003 / XP network with Ranger on to..

    I want to restrict students from accessing staff PC's in the Classrooms

    I tried Ranger React to restart a PC when a member of the student goup accesses the PC but this doesn't seem to work..

    Is there something wrong and / or is there another system or way I can block the students,?

  2. #2

    Join Date
    Jan 2007
    Posts
    421
    Thank Post
    7
    Thanked 30 Times in 26 Posts
    Rep Power
    20

    Re: Stopping Pupils Access Stsff PC's

    Hmm, one really crude way is in the student logon script, to look for the machine name, and then reboot it if it's a staff machine.

  3. #3
    contink's Avatar
    Join Date
    Jul 2006
    Location
    South Yorkshire
    Posts
    3,790
    Thank Post
    303
    Thanked 327 Times in 233 Posts
    Rep Power
    117

    Re: Stopping Pupils Access Stsff PC's

    Quote Originally Posted by kylewilliamson
    Hmm, one really crude way is in the student logon script, to look for the machine name, and then reboot it if it's a staff machine.
    That was my thought too...

    Doesn't strike me as too crude though unless your staff laptops have a wide variety of names and don't follow a naming format.

  4. #4
    kerrymoralee9280
    Guest

    Re: Stopping Pupils Access Stsff PC's

    Can you not do something like this in the AD?

  5. #5

    broc's Avatar
    Join Date
    Jan 2006
    Location
    England
    Posts
    2,046
    Thank Post
    104
    Thanked 401 Times in 265 Posts
    Rep Power
    149

    Re: Stopping Pupils Access Stsff PC's

    Group policy will enable you to deny logon rights to student security groups. We have it set up to stop students logging onto staff machines, and also to stop staff logging onto curriculum laptops (to prevent them 'borrowing' them as they are better than staff laptops)

    Assuming you have a staff computer OU and policy to match, look in Computer Configuration\windows settings\security settings\local policies\user rights assignment and update "deny access to this computer from the network" and "deny log on locally" adding the security groups you need.

    If you don't have a staff computer OU & policy, maybe you need to consider setting one up.

  6. Thanks to broc from:

    AWicher (15th August 2011)

  7. #6

    Join Date
    Aug 2005
    Location
    London
    Posts
    3,144
    Thank Post
    113
    Thanked 518 Times in 447 Posts
    Blog Entries
    2
    Rep Power
    121

    Re: Stopping Pupils Access Stsff PC's

    AD allows you to specify which machines a user can log on to but not ones they can't. It's pretty crude - it's really designed for when you have specific machine/user combinations you want to enforce.

    What's special about the staff machines that you don't want pupils to use? If it's just that there are files they shouldn't get to then make sure the NTFS permissions allow "staff" to read/write as appropriate but don't allow "users" access.

    If the machine naming convention allows you to pick out staff machines then use that to determine that they should be removed, otherwise you can check the OU and knock off students from a staff OU machine.

  8. #7

    Join Date
    Jan 2007
    Location
    Clog Land
    Posts
    178
    Thank Post
    0
    Thanked 1 Time in 1 Post
    Rep Power
    0

    Re: Stopping Pupils Access Stsff PC's

    Quote Originally Posted by Grommit
    Hi

    We run a 2003 / XP network with Ranger on to..

    I want to restrict students from accessing staff PC's in the Classrooms

    I tried Ranger React to restart a PC when a member of the student goup accesses the PC but this doesn't seem to work..

    Is there something wrong and / or is there another system or way I can block the students,?
    Try setting a time delay on the Ranger react task maybe 5-10 seconds and you should then find it works.

  9. #8
    Grommit's Avatar
    Join Date
    Sep 2006
    Location
    Weston-super-Mare
    Posts
    1,335
    Thank Post
    31
    Thanked 54 Times in 31 Posts
    Rep Power
    24

    Re: Stopping Pupils Access Stsff PC's

    It's just hat the students log on tho the Teacher Classroom PC's and play the music .. blow the amps and speakers..

    Please when there is a cover the students mess around with the PC..

    As well as students fiddling with the PC's.. if they know they can logon then they wont bother going to it..

  10. #9
    DMcCoy's Avatar
    Join Date
    Oct 2005
    Location
    Isle of Wight
    Posts
    3,386
    Thank Post
    10
    Thanked 483 Times in 423 Posts
    Rep Power
    110

    Re: Stopping Pupils Access Stsff PC's

    Want to know the easy way?

    Group policy. Computer -> Security -> Local -> User Rights -> Deny log on Locally.

    I add the students group to this on our admin machines. There is one for terminal services too.

    Edit. I see this has already been suggested . It works well though.

  11. #10
    Grommit's Avatar
    Join Date
    Sep 2006
    Location
    Weston-super-Mare
    Posts
    1,335
    Thank Post
    31
    Thanked 54 Times in 31 Posts
    Rep Power
    24

    Re: Stopping Pupils Access Stsff PC's

    Quote Originally Posted by DMcCoy
    Want to know the easy way?

    Group policy. Computer -> Security -> Local -> User Rights -> Deny log on Locally.

    I add the students group to this on our admin machines. There is one for terminal services too.

    Edit. I see this has already been suggested . It works well though.
    Is this via a GPO in the AD or on each machine Locally ?

  12. #11
    Disease's Avatar
    Join Date
    Jan 2006
    Posts
    1,059
    Thank Post
    112
    Thanked 63 Times in 44 Posts
    Rep Power
    54
    I have applied this, created an OU for teachers machines, and created a GP with nothing in it apart from those settings, and I am still able to login with a staff account. what have I missed

  13. #12
    timbo343's Avatar
    Join Date
    Dec 2005
    Location
    Leeds/York area, North Yorkshire
    Posts
    2,772
    Thank Post
    251
    Thanked 220 Times in 168 Posts
    Rep Power
    87
    Have you got any policies which are overwriting this setting which may be applying higher than OU level?

  14. #13
    Disease's Avatar
    Join Date
    Jan 2006
    Posts
    1,059
    Thank Post
    112
    Thanked 63 Times in 44 Posts
    Rep Power
    54
    I have 2 policies above this one which are enforced, all IT rooms, and Teacher Machines, I have a tree like this:

    Computers OU (GPO ALL IT Rooms) Local Security setting in here disabling Auditing of Object Access This policy is Enforced
    |
    -----> Teachers Machine (GPO Teachers Machines) No Settings in GPO at moment This policy is Enforced
    |
    ----------> Pe_E-Reg (GPO PE E Reg) Contains the Disable Network Access and Local Logon This policy is Enforced
    Last edited by Disease; 28th September 2010 at 12:06 PM.

  15. #14
    timbo343's Avatar
    Join Date
    Dec 2005
    Location
    Leeds/York area, North Yorkshire
    Posts
    2,772
    Thank Post
    251
    Thanked 220 Times in 168 Posts
    Rep Power
    87
    Hmmm,,, that should work...

    Here is how mine is applying:

    Domain level: "Domain" Policy: Deny logon locally - Not defined
    |
    ---> Computer Locations OU: "Enable windows Firewall" Policy : Deny logon locally - Not defined
    |
    --------> Staff Machines OU: "Deny Student Logon" Policy: Deny Logon Locally - Security group PUPILS is configured in here.

    Where yours are enforced, mine arent...

    This could be the problem.

    Tim

  16. #15
    Galway's Avatar
    Join Date
    Jun 2007
    Location
    West Yorkshire
    Posts
    1,015
    Thank Post
    6
    Thanked 215 Times in 153 Posts
    Rep Power
    61
    Quote Originally Posted by Disease View Post
    I have applied this, created an OU for teachers machines, and created a GP with nothing in it apart from those settings, and I am still able to login with a staff account. what have I missed
    Thats the whole point ... unless you want to deny staff ??

SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. Replies: 2
    Last Post: 15th July 2010, 03:22 PM
  2. Stopping Pupils accessing things!
    By silver in forum Windows
    Replies: 2
    Last Post: 29th January 2009, 02:16 PM
  3. ex pupils and staff accounts
    By mikeymike in forum Windows
    Replies: 22
    Last Post: 8th January 2009, 09:30 AM
  4. Laptops for pupils ans staff use
    By markman in forum General Chat
    Replies: 4
    Last Post: 25th September 2008, 08:07 PM
  5. Stopping pupils downloading in IE
    By park_bench in forum Windows
    Replies: 5
    Last Post: 5th December 2006, 09:45 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •