Grrrr these kids need locking.....

[abillybob]

Hello All

So I have started my new job as a network manager at a primary school this week and the network is awful! One main thing that needs sorting is that all the students and teaching staff are free to do what they want they can even create a local user and login as administrator on there computer theres no lockdowns. The place I used to work out used to buy into Novus support and I would reccomend these guys they were great we told them how we wanted the network and they wrote group policy. I kind of know a little group policy I know what it all means but I can't write it and since my new school hasn't got the budget to buy into these services and support I need to find a solution to lockdown the children that is also cheap. Please help im sick of being called out 10 times a day because little timmy has decided to move the task bar and hide it and ...... :'(

 

HELP!

[Steve21]

Best thing to do would just be create a test user, and see what you can break. Most of the group policies you're referring to are simple yes/no options. e.g. Enable/Disable move taskbar etc.

 

Apply a policy and see if it does what you want etc

 

Steve

[plexer]

For most admin there is no need to write anything in group policy just find the relevant setting make the changes required and have it apply somewhere.

 

It is possible to create custom group policy objects.

 

Ben

[Davit2005]

I kind of know a little group policy I know what it all means but I can't write it and since my new school hasn't got the budget to buy into these services and support I need to find a solution to lockdown the children that is also cheap. Please help im sick of being called out 10 times a day because little timmy has decided to move the task bar and hide it and ...... :'(

 

HELP!

 

Create a new OU and start building a policy from scratch and apply it to the New OU with a new test user and see what the experience is. Before you start moving the old users into the new OU create a test user in the old OU and login and out and then move the user to the new OU and see if can still login and out without any issues.

 

The best way to learn with policies is test, test, test and deploy. Id create the new OU in the root or at least in a place where you only get the default domain policy inherited.

Edited June 21, 2013 by Davit2005

[JJonas]

When I set our group policy I had two computers side by side one logged into the server the other one I would use to test the changes I had just made.

 

Put the testing computer into its own OU and apply the policy to that OU only.

 

Dont forget the gpupdate /force when you want to push out the changes.

 

Small moves dont make too many changes without testing.

[teejay]

Have a look here Group Policy

 

It really is something you need to sit down and learn as it is one of your main tools for managing a network and you'll be struggling to tame your network without it.

[abillybob]

Ok so I have sorted AD with a Test OU, User and Test Computer. I have clicked Group Policy Management but do I need to create another domain or something because it seems the only think I can do is edit it in group policy editor! If anyones got instructions just to start me off so I can see how it all works and have a play that'd be ace.

 

Thanks for all your help guys!!

[Steve21]

If I'm understanding you correctly you're trying to edit the default domain policy, which will apply to "everything" e.g. Servers.

 

You want to create a new group policy, and link this to your test OU and use that as your play bit

 

Thanks,

Steve

[JJonas]

@Steve21 is right you dont want to edit the default domain policy.

 

I will just add when I set mine up it was half term, much easier to do without being pestered by other members of staff and students.

[witch]

This is quite a good walk-through:

Network Administration: Creating Group Policy Objects - For Dummies

[abillybob]

Well good news and bad news have finally had a few minutes this morning to write my own bit of group policy I made a new Policy under "Group Policy Objects" called "Test" all I did was edit it so Internet Explorer would use bing.co.uk as a home page I then added the "Group Policy Test group" in AD to the Delegation tab and security filtering and made my Test PC and my Test User account to be a member of the Group Policy Test group in AD but Internet Explorer isn't changing the home page! OMG what am I doing wrong!!!

Sorry Guys

[X-13]

OMG what am I doing wrong!!!

 

gpupdate /force [On the test machine?]

[abillybob]

gpupdate /force [On the test machine?]

 

Sorry mate what is that and how you're talking to a newbie with group policy? Thankyou though!!!

[Steve21]

Sorry mate what is that and how you're talking to a newbie with group policy? Thankyou though!!!

 

Basically the policies only filter to machines every hour or so by default.

 

if you run a command prompt and type gpupdate /force on the client it'll force it to update it's policies now.

 

Steve

[X-13]

Sorry mate what is that and how you're talking to a newbie with group policy? Thankyou though!!!

 

Sorry.

 

Basically the policies only filter to machines every hour or so by default.

 

if you run a command prompt and type gpupdate /force on the client it'll force it to update it's policies now.

 

Steve

 

^ This.

[abillybob]

Thanks for the heads up as I didn't know I had to do this but it still isn't doing anything at first I made the test group policy just to change homepage to google then as it wasn't working i tryed changing it to bing but now the computer has a google homepage :S!!!

[Steve21]

Thanks for the heads up as I didn't know I had to do this but it still isn't doing anything at first I made the test group policy just to change homepage to google then as it wasn't working i tryed changing it to bing but now the computer has a google homepage :S!!!

 

It may just be the fact the hourly update hit it during the time you had google, now it's counting down again to next update.

 

Try the gpupdate and see if it changes to bing

 

Steve

[abillybob]

Hi Steve thats what I did opened cmd as admin and did the gpupdate /force and it said it was updated sucessfully (Computer and User) then I restarted the machine. But no still the same!

[box_l]

In group policy manager you need to link the new policy to the ou that the computer is in.

 

So..

 

In AD, move teh test pc to the new test OU.

In GPMC right click the Test OU and link existing policy.

Choose the test policy.

Gpupdate /force on the server and the client.

Reboot client.

 

BoX

[abillybob]

In group policy manager you need to link the new policy to the ou that the computer is in.

 

So..

 

In AD, move teh test pc to the new test OU.

In GPMC right click the Test OU and link existing policy.

Choose the test policy.

Gpupdate /force on the server and the client.

Reboot client.

 

BoX

 

Ah ok this makes more sense now I didn't link it to an OU in AD. Though I don't seem to have Group Policy Management console only only group policy mangement??? Should I install the feature from Server Manager??? The only problem with that is it says the server will need to restart :/

[mikeyd101]

Another good command on the client is

 

Gpresult /R

 

And

 

Gpresult /R /scope computer

From an admin command prompt this will tell you what gpos are applied

 

Im still pretty new to group policy but the management tool has some good explainations for what the settings do. Like everyone said apply to dummy user, computer or group.

 

Another thing I found is if you have a computer rule it doesnt get applied if you assign it to a user.

[steewy]

Here is a really good website I use to create my Group Policy and new GPO.

To lock the student down you need to create a simple GPO for your domain as default.

After you can add some more GPO.

I tend to separate most of my GPO and give them a good name to always remember what they do.

 

It takes time to create a proper GPO that suits your needs.

 

To test the policy I use one VM (with a snapshot of the clean windows) and 2 tests users (staff and student).

 

After that just apply the GPO on the computer, log on and see if it works.

 

gpupdate /force will refresh the group policy on the computer.

 

Keep in mind that GPO can be apply on the computer or the user.