How do you handle home directories on Laptops?

[Sam_Brown]

For as long as I can remember we've been using Offline Files on their home directories meaning when they log on of off the laptop automatically "synchronise" their home areas with the file server.

 

This used to work quite well but over the last few years as home areas have grown some people are having to wait 10-15 minutes every logon and logoff while their home are synchronises.

 

I was just wondering how other people handle staff home directories on laptops and manage to keep logon and logoff times low?

[FN-GM]

Are you still on XP? On Windows 7 it does it in the background.

[SYNACK]

Are you still on XP? On Windows 7 it does it in the background.

 

plus one, Offline files in Vista, 7 and 8 are way better. It's been forever but there may be an option in GPO for XP to not perform a full sync each time. We had users running alright with 80GB of files in this configuration but the offline file sync did take a while in the background.

 

With 7 I think the biggest I've come accross is 200GB via offline files.

[Sam_Brown]

Windows XP although moving to Windows 7.

 

It may be quicker on Windows 7. I will investigate when we get there. However I imagine the initial "sync" on 200gig is still likely to take some time!

 

Other solutions I've heard include...

 

* Everything is saved locally and users can run a batch file to "back up" their data to the server.

* Users have a folder within their homearea they can copy files to they want to work offline. Anything within that folder gets sync'd. Anything outside gets saved on the server only.

* No home areas whatsoever out of work and the only way to access their files is via remote access to the school resources.

 

Anyone use any of the above at all? I'm not particarily sold on any of them. Offline Files seems to be the ideal way to do things although have issues with time spent synching at the moment.

[zag]

We just have a remote access server they can login to anytime.

 

No need for synced copies when its basically in the cloud from anywhere with an internet connection.

[FN-GM]

We just have a remote access server they can login to anytime.

 

No need for synced copies when its basically in the cloud from anywhere with an internet connection.

 

With offer that as well as offline files. If you dont have an internet connection for whatever reason you can carry on working "Offline".

[Ephelyon]

We use HAP+ for remote access to files coupled with RDWeb for remote access to apps to work with them.

 

I also share the local user's home area and then map it back while on the network as \\127.0.0.1\LocalWork (hidden by a custom label) so they can access work they've saved locally while still on the network, avoiding the need to switch user.

[FN-GM]

We use HAP+ for remote access to files coupled with RDWeb for remote access to apps to work with them.

 

I also share the local user's home area and then map it back while on the network as \\127.0.0.1\LocalWork (hidden by a custom label) so they can access work they've saved locally while still on the network, avoiding the need to switch user.

 

Why would you have 2 accounts? Why not use cached credentials when using the laptop at home?

[Ephelyon]

... security. Gaining local admin access to a single laptop means you have compromised one workstation in one place which is largely just a node to interface with the main system, but gaining access to locally-cached credentials would mean an attacker could log into our remote access system at 4am and start fiddling with things, stealing or deleting data. Our defences are robust and our backup/DR facilities are strong, but the more remote access possibilities you provide (which is brilliant for productivity), the more risk of compromise.

 

Same with Offline Files; our data is a critical asset and should be stored in one place, locked by heavy doors and yada-yada-yada. Naturally it can be accessed from anywhere, but physically it needs to stay put.

Edited April 16, 2013 by Ephelyon

[Homeland]

Cisco VPN for us offline files has always been a nightmare at least this way they just go home connect to there own internet and VPN in.

[fairm010]

VPN only here. If you want to save on your desktop/My docs thats fine but staff are aware that its not backed up. Most prefer to use the VPN as they have access to all the curriculum software.

 

Matt

[FN-GM]

... security. Gaining local admin access to a single laptop means you have compromised one workstation in one place which is largely just a node to interface with the main system, but gaining access to locally-cached credentials would mean an attacker could log into our remote access system at 4am and start fiddling with things, stealing or deleting data. Our defences are robust and our backup/DR facilities are strong, but the more remote access possibilities you provide (which is brilliant for productivity), the more risk of compromise.

 

Same with Offline Files; our data is a critical asset and should be stored in one place, locked by heavy doors and yada-yada-yada. Naturally it can be accessed from anywhere, but physically it needs to stay put.

 

Locally Chached credentials are encrypted..... There is no security risk.

[Ephelyon]

I can't agree - largely because I've recovered them myself in the past.

 

Network Password Recovery Wizard: recovering domain cached credentials

 

This goes into it in more detail (albeit from the point of view of one piece of software) but the top and bottom of it is that they can be brute-forced just like any other hash (salted or otherwise). Naturally how feasible that would be time-wise depends on how secure the passwords are in the first place... but let's consider the sector we work in...

 

However, there is one advantage in that we use full-disk encryption on our laptops. But two further problems remain:

 

1) I have literally had a user get annoyed with entering a boot password, download the tool we use and physically remove the encryption. Naturally this was dealt with but not before it had been unencrypted for months;

2) Theft isn't the only way an attacker might come into contact with encrypted data - see this: Schneier on Security: "Evil Maid" Attacks on Encrypted Hard Drives