How to go about enforcing .lnk association in gpo/gpp

[Drakaunus]

Greetings and salutations. I am a Network Administrator for a school district and recently we rolled out a new Server 2008 r2 domain. I know we are quite behind in the times but you have to understand how stubborn the board of education can be in regards to upgrading the existing domain. We only just got rid of some NT Servers. Anyway that is beside the point, with this new domain we have been rolling out Windows 7 machines and have been running into a very strange phenomenon. When some of our students log into a computer it occasionally changes the .lnk association seemingly randomly. I know it is not a virus because all of the Windows 7 machines are brand new clean images. What is more frustrating is let's say we have two students, student A and student B. Student A logs into Computer A and the .lnk association is connected to IE For some unknown reason. Student B uses computer B and the .lnk association is connected to Adobe Reader. Both students swap computers and Student A Logs into Computer B and .lnk works as intended, same with Student B on Computer A. So it is not user based, and it is not computer based so I have been racking my brain on this since school started right after labor day.

 

Right now the solution I have involves applying a registry setting in the gpo which is as follows:

 

 

Hive: HKEY_CURRENT_USER

 

Key Path: Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.l​nk

Value Name: UserChoice

Action: Delete

 

So while this does work, it unfortunately only works AFTER the user has been affected. So if Student A logs into Computer A and .lnk is connected to IE again, if they simply log off and log back in on the same machine the registry key gets deleted and it resorts back to default settings as intended. What I want to do is enforce the .lnk association to it's default setting so it can never be changed by any means. I was going to try using gpp but unfortunately you have to specify a specific executable which as we all know won't work for .lnk. So I am looking for some ideas because my brain is fried and I need to get this sorted out before my superiors flip out at the fact it is going on several weeks with no fix in sight. Any help would be much appreciated.

 

 

Chris

[markwilfan]

Greetings and salutations. I am a Network Administrator for a school district and recently we rolled out a new Server 2008 r2 domain. I know we are quite behind in the times but you have to understand how stubborn the board of education can be in regards to upgrading the existing domain. We only just got rid of some NT Servers. Anyway that is beside the point, with this new domain we have been rolling out Windows 7 machines and have been running into a very strange phenomenon. When some of our students log into a computer it occasionally changes the .lnk association seemingly randomly. I know it is not a virus because all of the Windows 7 machines are brand new clean images. What is more frustrating is let's say we have two students, student A and student B. Student A logs into Computer A and the .lnk association is connected to IE For some unknown reason. Student B uses computer B and the .lnk association is connected to Adobe Reader. Both students swap computers and Student A Logs into Computer B and .lnk works as intended, same with Student B on Computer A. So it is not user based, and it is not computer based so I have been racking my brain on this since school started right after labor day.

 

Right now the solution I have involves applying a registry setting in the gpo which is as follows:

 

 

Hive: HKEY_CURRENT_USER

 

Key Path: Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.l​nk

Value Name: UserChoice

Action: Delete

 

So while this does work, it unfortunately only works AFTER the user has been affected. So if Student A logs into Computer A and .lnk is connected to IE again, if they simply log off and log back in on the same machine the registry key gets deleted and it resorts back to default settings as intended. What I want to do is enforce the .lnk association to it's default setting so it can never be changed by any means. I was going to try using gpp but unfortunately you have to specify a specific executable which as we all know won't work for .lnk. So I am looking for some ideas because my brain is fried and I need to get this sorted out before my superiors flip out at the fact it is going on several weeks with no fix in sight. Any help would be much appreciated.

 

 

Chris

 

I've seen this on our network and put it down to students managing to change the association somehow. I usually get them to log onto a different PC, then reboot said pc and use delprof2 to remotely remove the students profile. Never found another fix for this but this works

[Drakaunus]

Thanks for the reply. I tried utilizing Delprof2 but it couldn't detect any profiles to delete whether or not I used certain parameters or just did the default which according to the site should delete all profiles except the administrators. I have literally watched the student logging in for the first time and the .lnk association is immediately wrong. Well as I said the registry fix I put into the gpo does the trick but only if they log off and on again real fast. I would manually take care of problematic profiles but I am the only Technician in a school system with 1,000+ machines across 4 buildings, not counting the fact I also am the technician for the boro, police station, and Library so unfortunately cannot always immediately delete a profile when a student has an issue so I was looking for a way to prevent it from occurring at all. So thank you for your aide Mark, but I am still open to any other suggestions anyone else might have as I continue to try to figure it out on my own. If I find a solution I will post it too for future reference.

 

Chris