Best Practices for setting up a staff laptop that needs to work offline

[tobiasclarity]

Hi All,

 

I am having a couple of issues setting up staff laptops on site so that they are able to go off the domain and work for example on their home wifi. All sorts of issues occur, one of the main issues i am trying to get round is there is a nag box appearing when you take the laptop offline stating there is an issue with the autocorrect file in MS Word, this only happens when conencting away from the domain. I have made registry changes but there naturally go back to their original state when it conencts back to the domain

 

Any ideas / suggestions would be much appreciated

 

Cheers

[fairm010]

We use mandatory profiles for staff that are not deleted at log off for staff. They do not have admin access over the laptop but enough to connect to their WiFi. At this point they have their normal domain laptop but then just VPN into the school.

 

Matt

[Duke5A]

- Use a proxy pac file to set proxy settings in IE. This way when they take the device home they don't have to monkey with proxy settings.

- Force the local firewall to always on in policy and only edit the domain profile. When the laptop is on the internal network your firewall exceptions will work, but when home those holes will close up.

- If you can get away with it, only give them limited user rights. Local admin on a device that leaves the district can be a pain.

- If the laptop is going to be spending a lot of time out of the district them enable the auto updaters for Flash, Java, etc...

[i4004]

- Use a proxy pac file to set proxy settings in IE. This way when they take the device home they don't have to monkey with proxy settings.

- If you can get away with it, only give them limited user rights. Local admin on a device that leaves the district can be a pain.

 

If you can't get away with it, i.e. the user needs to logon to the domain in school but then have full local admin rights for home use, what would be the best way to set that up?

[dmanning]

Hi All,

 

I am having a couple of issues setting up staff laptops on site so that they are able to go off the domain and work for example on their home wifi. All sorts of issues occur, one of the main issues i am trying to get round is there is a nag box appearing when you take the laptop offline stating there is an issue with the autocorrect file in MS Word, this only happens when conencting away from the domain. I have made registry changes but there naturally go back to their original state when it conencts back to the domain

 

Any ideas / suggestions would be much appreciated

 

Cheers

 

Is your issue with regards to word being they get the error stating they can't find the normal.dott file? If so we resolved this when we found out it was because we were using DFS Folder redirection. In order for this error to go away you need to have your laptops GPO point to the server share since it doesn't seem to support DFS. Once we did that the error went away and Offline files are working properly and syncing without any problem.

[psydii]

Psydii's quick tips:

 

Use full roaming profiles

Use folder redirection

Rely on offline files

 

Do not redirect app data

Do exclude various app data sub folders (local choice here, see what gets large, understand it then make your decision)

 

Make sure that you configure offline files to background sync even if they manually take the folders offline.

 

Don't give them admin.

Don't limit them in any other way.

If you don't have a PAC file configured accessible outside of your network, teach them how to change their own proxy settings.

 

Use chrome and it's auto update feature to keep their web browsing as safe as possible

 

Use AV that hooks in as a network filter driver to keep the rest of their internet experience safe

 

Make sure that the windows update and anti virus can work outside of your network. If you can't publish your servers to the internet, consider configuring the laptops to go direct to source bypassing your internal management tools.

 

Ideally make sure their is a secure way of getting remote control of their machine while it is off site. (We do this through our help desk software)

 

Probably forgotten a few things, but this should be enough to get you started.

 

They must bring their laptop back onto site for it to be backed up. ( unless you've got direct access configured and your file servers are accessible)