mandatory profile perhaps? With AD you don't really need them as AD does that job now.
Printable View
mandatory profile perhaps? With AD you don't really need them as AD does that job now.
Had been thinking about that but just tried on a test user withno mandatory profile - same problem - any shortcut on the desktop will run if its in the allowed list, but same program wont run from start menu
Is the location of the start menu allowed? for example c:\documents and settings\username\start menu\ for unrestricted rights?
the LNK start menu files need to be in a place that SRP has unrestricted access.
Thanks fooby - added the .LNK filetype and that sorted it!
Set up folder redirection on the start menu and the desktop as well which is working a dream
still getting an error with CScript.exe but reckon I need to open up the .VBS files to allow them to run.
A few more tweaks and it'll be ready to roll out
Their profile are locked down as tight as possible - start menu only has "Programs" and "Log off <username>" context menu removed from desktop, start menu and task bar, notification area gone access to all drives and network shares (bar one on the desktop)
@Gatt: When you get it perfected you should post the policy settings (export an HTML document using GPMC) so that others can learn from your experience.
Will do ric, may be a few weeks til I'm happy that all the software I need is in place on the policy and that the "bugs" have been worked out
the Plan is to implement it around the half-term break in Feb
Did you install Office with the option to use MSI shortcuts? (i think it does this by default) If so i am going to hazard a guess that you havent allowed the location where the shortcuts point to access to run, but hte shortcuts on the desktop will probably be "normal" shortcuts so do not suffer the same problem.
@E1uSiV3 - I got Office sorted - had to un-restrict the .LNK files
however, I still cannot get CSCRIPT.EXE to run even though I have authorised it to run along with VBS script files..
I'm attaching a copy of my curent GPO policy settings - however this is not yet complete as i am going to try and limit the list of programs further and also start adding Favourites URLs
It is a highly restricted profile for the students so i wont be flavour of the month with them when i implement it in a few weeks time!
You can use these settings yourselves but please let me know of any improvements you think could be made to the policy
The only problem with unrestricting the *.lnk part, is, i have an exe on my usb stick, all i need to do is create a shortcut to that exe on the stick (or user folder / home dir etc) then it will become allowed.
What you should do, is
unrestricted access to \\server\share\startmenu\
which is a read only share, or unrestricted access to whereever the start menu files are.
fooby
I didnt skip to page 2 before writing my answer whoops lol :oops:Quote:
Originally Posted by Gatt
@ fooby: yeah i got a few wildcards to restrict, though at the moment the pupils cannot access their USB sticks at all!
Trying to get my printers to map correctly as per this post from Ric_
Ok just locked the little darlings out with the new policy (attached)
had a few minor problems where I forgot to amend the path of the re-directed desktop and start menu - funny to se them all gripe about not being able to get on the web - out of a class of 31 only 1 said he couldnt get into Corel Draw!!
Still got a few programs to add to the restriction list and trying to get the desktop to be enforced through either GPO or a Reg Hack.
Comments & Suggestions welcome, and you are free to implement this as you see fit.