Login Screens - How Have you Got Yours Setup

[russdev]

Just doing some research on what people have set up on their network. If people don't mind sharing. What GPO settings do you have setup on your login screen to customise it?

 

Regards

 

Russell

Edited April 22, 2013 by russdev

[Valyyn]

On the actual login screen, we don't have a huge amount really.

 

We got it set to show a blank frame for the user icon (ideally would like to get rid of the frame entirely, but can't do that ) and a custom background, specifically:

 

http://i.imgur.com/RrnfIdWs.jpg

[Tall_Paul]

Ours is pretty standard, with some relevant spiel concerning our network access policy (which no-one ever reads, and then look mortified when you point it out when they're in trouble).

[nickbro]

We've got this as our background picture, pick of the school

[ATTACH=CONFIG]17914[/ATTACH]

 

Looks very fancy on Windows 7 and just about Ok on XP

 

We also have this as the user picture on the lock screen

[ATTACH=CONFIG]17915[/ATTACH]

[6Foot2]

The school badge is above the username/password box and a version of the trim around our compliments slip wraps around the bottom and left of the screen. We do this by changing the oobe.bmp

 

Location: C:\Windows\System32\oobe\info\backgrounds

[localzuk]

We've not customised ours yet, as we're still using XP.

 

However, when we move to Windows 7, this will be the login screen.

 

 

The desktop picture is similar, except the logo is in the middle.

 

I also have a boot animation which is the logo fading in, then glowing.

[AlexB]

The school badge is above the username/password box and a version of the trim around our compliments slip wraps around the bottom and left of the screen. We do this by changing the oobe.bmp

 

Location: C:\Windows\System32\oobe\info\backgrounds

 

Cheers, I knew about the background change, but not the icon.

[6Foot2]

Cheers, I knew about the background change, but not the icon.

 

I haven't managed to get rid of the box that would normally hold the picture of the logged on user [empty when there is no user logged on] I have, however placed the school badge in such a way that it appears inside the box. Not as tidy as I would like but it does the job.

[russdev]

Also be interested to know what windows controls you remove an example do you remove ease of access, do you have an aup mssage etc etc etc

[localzuk]

We display an AUP/monitoring notice, but everything else is enabled - no need to disable ease of access stuff that I can see?

[6Foot2]

Also be interested to know what windows controls you remove an example do you remove ease of access, do you have an aup mssage etc etc etc

 

Looks like we are getting Impero over the summer so we should be able to set up an AUP using that?

 

Other stuff I will look at later. It doesn't make sense to continue to make changes to this network as it will all change over the summer.

[AlexB]

Also be interested to know what windows controls you remove an example do you remove ease of access, do you have an aup mssage etc etc etc

 

I tested the option of nuking EOA and it did work, however we didn't get enough trouble with it and left it alone. However if you set %SystemRoot%\System32\Utilman.exeshow to everyone deny execute/read then it will never work again

[nickbro]

Got to love how you can hack into a Windows 7 device by renaming cmd to utilman.exe, root command prompt. Thankfully our kids don't seem bright enough to boot from USB to change the c:\ of utilman

[6Foot2]

...Thankfully our kids don't seem bright enough to boot from USB to change the c:\ of utilman

 

We PXE boot our stations when building off the network. So we disable all boot devices except for HDD [first], Network card [second]

 

If they do find the network boot it asks them for the domain admin/password combination to proceed.

[nickbro]

Just make sure to put a password on the bios and that's fine

[6Foot2]

Just make sure to put a password on the bios and that's fine

 

Yes the BIOS is password protected.

[tmcd35]

From memory (couldn't tell you the exact GPO's of hand)...

 

Standard Win7 logon screen. CTRL,ALT,DEL disabled so waiting for user logon details.

AUP on logon provided by "AUP Informant" a free program I found here on Edugeek a few years back.

Custom background - single colour with school logo in top right. Start Menu and Desktop redirected to read only shares on the fileserver.

Windows 2012 file server with FSRM not allowing execuitables to be saved to home drives or other shared document folders.

GPO's to stop exe's, etc running from home drives or USB.

Only users home drives and publich shared drives viewabale in My Computer

Command prompt disabled

Properties removed from context menus

Task Manager and Lock Computer removed from CTL,ALT,DEL screen

Hide Hardware and Security tab's, Remove Map network drive/disconnect network drive, turn-off Windows hotkeys

 

And probably a few more besides.

 

We are pretty much locked down here (or atleast as much as I can work out, I'm sure 1 or 2 kiddies know how to bypass the lot...)

[bwestlake]

 

This is our one

[SovietRussia]

Do you still have to make the images a certain file size?

[localzuk]

Do you still have to make the images a certain file size?

 

Less than 250kb. The images also have to match the resolution of your computer screens - so you put a bunch of them in there of different resolutions to match all your screens.

[AngryTechnician]

• We turn off Ctrl+Alt+Del since I haven't seen a virus in the wild that tries to replace the GINA in a very long time. Hackers don't care about local credentials any more, they are more interested in online credentials.
  
• No AUP message; had one in my last school and everyone just clicked OK without reading it.
  
• Ease of access is left enabled and hasn't caused a problem for us (yet).
  

 

We also have a customised background, like most others here.

[DrCheese]

No AUP message; had one in my last school and everyone just clicked OK without reading it.

Yeah, no one reads it but they accept it by clicking on ok. It's a "cover your ass" kinda thing.

[Mr.Ben]

We have an image with the school badge before logon, then a different one without once the user has logged in.

 

This is because BG Info replaces the users desktop image every time that they log in, and overlays it with PC name, Log On Name and messages from me.

 

BGInfo resizes a single image to the screen, which distorts our school logo (so we got rid of it).

 

No AUP (this is assumed nowadays and sent to parents), Students have some AUP guidance on our intranet and in there homework diaries.

[tmcd35]

 

BGInfo resizes a single image to the screen, which distorts our school logo (so we got rid of it).

 

 

This is the one thing I think is missing from our user backgrounds. Anyone got any ideas as to the quickes/easiest way to set thsi up for everyone? Install to network share and add a line in logon.bat?

[localzuk]

Some people are saying they don't present an AUP or monitoring notice? We were told by our LEA that because our upstream ISPs (eg. our LEA and then SWGfL) monitor and intercept our communications, we have to present a "Regulatory and Investigatory Powers Act Monitoring Statement".

 

This is our current one:

 

Use of the Internet and e-mail via this machine is monitored for violations of acceptable use. LEA monitoring and Schoolname will monitor virus activity, unsuitable language use in e-mail and use of banned applications such as file-sharing software. LEA's Internet Service Provider the RBC Name monitors Internet use including attempts to access illegal websites. All users should be aware that this monitoring is taking place.Violation of the Acceptable Use Policy may result In suspension of Internet AND e-mail accounts AND In some cases disciplinary action may be appropriate including In extreme cases dismissal For gross misconduct AND criminal proceedings.

The Internet is a wonderful tool For learners but must be used responsibly. LEA AND the RBC have a duty to ensure that all users of their systems follow rules For acceptable Use. Users are required to act responsibly when using Internet systems so that all can enjoy safe Internet access. By clicking accept below, you agree that you understand monitoring is taking place AND that your Use of this system will be responsible.

Edited April 23, 2013 by localzuk