abillybob Posted June 21, 2013 Posted June 21, 2013 Hello All So I have started my new job as a network manager at a primary school this week and the network is awful! One main thing that needs sorting is that all the students and teaching staff are free to do what they want they can even create a local user and login as administrator on there computer theres no lockdowns. The place I used to work out used to buy into Novus support and I would reccomend these guys they were great we told them how we wanted the network and they wrote group policy. I kind of know a little group policy I know what it all means but I can't write it and since my new school hasn't got the budget to buy into these services and support I need to find a solution to lockdown the children that is also cheap. Please help im sick of being called out 10 times a day because little timmy has decided to move the task bar and hide it and ...... :'( HELP!
Steve21 Posted June 21, 2013 Posted June 21, 2013 Best thing to do would just be create a test user, and see what you can break. Most of the group policies you're referring to are simple yes/no options. e.g. Enable/Disable move taskbar etc. Apply a policy and see if it does what you want etc Steve
plexer Posted June 21, 2013 Posted June 21, 2013 For most admin there is no need to write anything in group policy just find the relevant setting make the changes required and have it apply somewhere. It is possible to create custom group policy objects. Ben
Davit2005 Posted June 21, 2013 Posted June 21, 2013 (edited) I kind of know a little group policy I know what it all means but I can't write it and since my new school hasn't got the budget to buy into these services and support I need to find a solution to lockdown the children that is also cheap. Please help im sick of being called out 10 times a day because little timmy has decided to move the task bar and hide it and ...... :'( HELP! Create a new OU and start building a policy from scratch and apply it to the New OU with a new test user and see what the experience is. Before you start moving the old users into the new OU create a test user in the old OU and login and out and then move the user to the new OU and see if can still login and out without any issues. The best way to learn with policies is test, test, test and deploy. Id create the new OU in the root or at least in a place where you only get the default domain policy inherited. Edited June 21, 2013 by Davit2005
JJonas Posted June 21, 2013 Posted June 21, 2013 When I set our group policy I had two computers side by side one logged into the server the other one I would use to test the changes I had just made. Put the testing computer into its own OU and apply the policy to that OU only. Dont forget the gpupdate /force when you want to push out the changes. Small moves dont make too many changes without testing.
teejay Posted June 21, 2013 Posted June 21, 2013 Have a look here Group Policy It really is something you need to sit down and learn as it is one of your main tools for managing a network and you'll be struggling to tame your network without it.
abillybob Posted June 21, 2013 Author Posted June 21, 2013 Ok so I have sorted AD with a Test OU, User and Test Computer. I have clicked Group Policy Management but do I need to create another domain or something because it seems the only think I can do is edit it in group policy editor! If anyones got instructions just to start me off so I can see how it all works and have a play that'd be ace. Thanks for all your help guys!!
Steve21 Posted June 21, 2013 Posted June 21, 2013 If I'm understanding you correctly you're trying to edit the default domain policy, which will apply to "everything" e.g. Servers. You want to create a new group policy, and link this to your test OU and use that as your play bit Thanks, Steve
JJonas Posted June 21, 2013 Posted June 21, 2013 @Steve21 is right you dont want to edit the default domain policy. I will just add when I set mine up it was half term, much easier to do without being pestered by other members of staff and students.
witch Posted June 21, 2013 Posted June 21, 2013 This is quite a good walk-through: Network Administration: Creating Group Policy Objects - For Dummies 1
abillybob Posted June 21, 2013 Author Posted June 21, 2013 Well good news and bad news have finally had a few minutes this morning to write my own bit of group policy I made a new Policy under "Group Policy Objects" called "Test" all I did was edit it so Internet Explorer would use bing.co.uk as a home page I then added the "Group Policy Test group" in AD to the Delegation tab and security filtering and made my Test PC and my Test User account to be a member of the Group Policy Test group in AD but Internet Explorer isn't changing the home page! OMG what am I doing wrong!!! Sorry Guys
X-13 Posted June 21, 2013 Posted June 21, 2013 OMG what am I doing wrong!!! gpupdate /force [On the test machine?]
abillybob Posted June 21, 2013 Author Posted June 21, 2013 gpupdate /force [On the test machine?] Sorry mate what is that and how you're talking to a newbie with group policy? Thankyou though!!!
Steve21 Posted June 21, 2013 Posted June 21, 2013 Sorry mate what is that and how you're talking to a newbie with group policy? Thankyou though!!! Basically the policies only filter to machines every hour or so by default. if you run a command prompt and type gpupdate /force on the client it'll force it to update it's policies now. Steve
X-13 Posted June 21, 2013 Posted June 21, 2013 Sorry mate what is that and how you're talking to a newbie with group policy? Thankyou though!!! Sorry. Basically the policies only filter to machines every hour or so by default. if you run a command prompt and type gpupdate /force on the client it'll force it to update it's policies now. Steve ^ This.
abillybob Posted June 21, 2013 Author Posted June 21, 2013 Thanks for the heads up as I didn't know I had to do this but it still isn't doing anything at first I made the test group policy just to change homepage to google then as it wasn't working i tryed changing it to bing but now the computer has a google homepage :S!!!
Steve21 Posted June 21, 2013 Posted June 21, 2013 Thanks for the heads up as I didn't know I had to do this but it still isn't doing anything at first I made the test group policy just to change homepage to google then as it wasn't working i tryed changing it to bing but now the computer has a google homepage :S!!! It may just be the fact the hourly update hit it during the time you had google, now it's counting down again to next update. Try the gpupdate and see if it changes to bing Steve
abillybob Posted June 21, 2013 Author Posted June 21, 2013 Hi Steve thats what I did opened cmd as admin and did the gpupdate /force and it said it was updated sucessfully (Computer and User) then I restarted the machine. But no still the same!
box_l Posted June 21, 2013 Posted June 21, 2013 In group policy manager you need to link the new policy to the ou that the computer is in. So.. In AD, move teh test pc to the new test OU. In GPMC right click the Test OU and link existing policy. Choose the test policy. Gpupdate /force on the server and the client. Reboot client. BoX
abillybob Posted June 21, 2013 Author Posted June 21, 2013 In group policy manager you need to link the new policy to the ou that the computer is in. So.. In AD, move teh test pc to the new test OU. In GPMC right click the Test OU and link existing policy. Choose the test policy. Gpupdate /force on the server and the client. Reboot client. BoX Ah ok this makes more sense now I didn't link it to an OU in AD. Though I don't seem to have Group Policy Management console only only group policy mangement??? Should I install the feature from Server Manager??? The only problem with that is it says the server will need to restart :/
mikeyd101 Posted June 21, 2013 Posted June 21, 2013 Another good command on the client is Gpresult /R And Gpresult /R /scope computer From an admin command prompt this will tell you what gpos are applied Im still pretty new to group policy but the management tool has some good explainations for what the settings do. Like everyone said apply to dummy user, computer or group. Another thing I found is if you have a computer rule it doesnt get applied if you assign it to a user.
steewy Posted July 1, 2013 Posted July 1, 2013 Here is a really good website I use to create my Group Policy and new GPO. To lock the student down you need to create a simple GPO for your domain as default. After you can add some more GPO. I tend to separate most of my GPO and give them a good name to always remember what they do. It takes time to create a proper GPO that suits your needs. To test the policy I use one VM (with a snapshot of the clean windows) and 2 tests users (staff and student). After that just apply the GPO on the computer, log on and see if it works. gpupdate /force will refresh the group policy on the computer. Keep in mind that GPO can be apply on the computer or the user.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now