Teachers computers

[eric.777]

Hi,

 

Does anyone know how to stop pupils logging on to a teacher computer?

 

We want a script that shuts the computer down when the script see staff.txt

on the root of c:\

Any ideas

[SC-UK]

If the teachers computers are in a specific OU, then in the group policy settings under computer settings and security there is an option to stop certain users/groups logging in locally. Add the students group into this setting and your students will not be able to log in.

 

Haven't got a Windows Machine with me at the moment so can't remember exactly where the setting is or what it is called but I'm sure somebody else will point it out.

 

Tom

[eric.777]

Yes did it in GPO.

Thanks for the fast response.

 

Just wanted to be smart and shut the computer down when a pupils try to logon.

[SC-UK]

Yes did it in GPO.

Thanks for the fast response.

 

Just wanted to be smart and shut the computer down when a pupils try to logon.

 

Do you mean smart or evil

[K.C.Leblanc]

if exist c:\staff.txt shutdown /s /f /c "Mr Eric is coming with his clue bat, leave while escape is still possible."

[powdarrmonkey]

Just wanted to be smart and shut the computer down when a pupils try to logon.

 

Why? All that does is inconvenience the real teacher when they turn up for the lesson thirty seconds later.

[SYNACK]

Its easy to just have a permit list of users or groups instead:

 

There is a way to do this that will allow you to just let the teachers on and block everyone else without needing to specify each group individually.

 

Make sure you have a security group with your teachers in it. Then chuck the machine into its own OU under where it is at the moment in AD and add a new group policy object to that OU. Inside that group policy you want to go to:

 

Computer Configuration> Windows Settings> Security Settings> Local Policies> User Rights Assignment: Log on locally

 

Then remove the Users group and the add the group that you created earlier. This will let your two teacher log on and also allow administrators to in case they/you need to fix something.

 

Have this setup in our school office to stop teachers messing with the reception computers.

 

Adapted from: http://www.edugeek.net/forums/windows/18819-restricting-who-can-log-certain-machine.html#post186799

[jcollings]

Is it not easier to have your machines set up so who logs on determines the restrictions in place on that machine.

 

Here we are set up so staff or students can log on to any machine and how they can see things on that machine or use things is down to who they are (via scripts and GPO). That way it makes no difference if a student logs onto a staff computer.

[SYNACK]

Sometimes you need to block a certain group from logging into a set of machines though, our systems are all locked down in the way you describe but certain machines, like the office ones are locked to only office people as the teachers used to go in there after school and trash stuff - move chair settings, jam the printer etc. In the same way the students are not allowd to log on to the office machines as they should not be in there anyway. It is just one more barrier to prevent damage and/or nusance.

[jcollings]

Sometimes you need to block a certain group from logging into a set of machines though, our systems are all locked down in the way you describe but certain machines, like the office ones are locked to only office people as the teachers used to go in there after school and trash stuff - move chair settings, jam the printer etc. In the same way the students are not allowd to log on to the office machines as they should not be in there anyway. It is just one more barrier to prevent damage and/or nusance.

 

I see your point but it's pretty poor when you can't trust fellow professionals not to trash your workspace. I guess I'm lucky here because that sort of thing just doesn't seem to happen.