Beginning of a new era - New network from scratch, help with Initial GPO setup

[daneil16]

Hello everyone,

 

After using RM CC3 with Windows 2003 and XP for the last 14 years, we are now about the start building a brand new network! Applause!!!!

 

We are awaiting licences for Windows Server 2012 R2, and will be building the virtual server/s very soon. We cannot start the big change over until the summer (which gives us 5 weeks to install the network, change over PC's to Win7 about 210, 80 of these will be brand new) but some things we can get started with.

 

One thing we want to get done now are the Group Policies, we obviously have our current ones for 2003 and XP (Not sure if I could export these to 2012) which may not include some policy settings but does anyone know where you can get pre-configured GPO's for schools/education from Microsoft or similar for Windows 7? We have decided not to go for Windows 8 just yet!

 

I have started to create my own, but I am unsure for some settings and would like to at least compare my own to someone else's as I go along as this is the first time I have ever done anything like this.

 

Ideally if Microsoft provide one that is pre-configured for schools that does the basics to stop the students changing settings etc that you can tweak to your own need that would be awesome.

 

 

 

Any help would be greatly received.

[Simcfc73]

If you message me your email address I will send you a copy of our main computer and user one.

[jertsy]

Hello everyone,

 

After using RM CC3 with Windows 2003 and XP for the last 14 years, we are now about the start building a brand new network! Applause!!!!

 

We are awaiting licences for Windows Server 2012 R2, and will be building the virtual server/s very soon. We cannot start the big change over until the summer (which gives us 5 weeks to install the network, change over PC's to Win7 about 210, 80 of these will be brand new) but some things we can get started with.

 

One thing we want to get done now are the Group Policies, we obviously have our current ones for 2003 and XP (Not sure if I could export these to 2012) which may not include some policy settings but does anyone know where you can get pre-configured GPO's for schools/education from Microsoft or similar for Windows 7? We have decided not to go for Windows 8 just yet!

 

I have started to create my own, but I am unsure for some settings and would like to at least compare my own to someone else's as I go along as this is the first time I have ever done anything like this.

 

Ideally if Microsoft provide one that is pre-configured for schools that does the basics to stop the students changing settings etc that you can tweak to your own need that would be awesome.

 

 

 

Any help would be greatly received.

 

Hi there,

 

I am in exactly the same boat as you, ex RM now configuring 2012R2 domain with windows 7 clients. I am doing pretty much what you are in that I'm creating test users and locking things down and deploying other things via GPO's. It would be good to compare them to someone else's. Let me know if you want to compare notes etc...

[jertsy]

If you message me your email address I will send you a copy of our main computer and user one.

 

Could you do the same for me please if I PM you?

 

Thanks

[jaminben]

Can I also have a copy....please.

 

Would be interesting to see another setup.

 

Thanks

[MordyT]

I would be interested to see another setup. Either a PM or probably best to post it on the forums

[clareq]

This is a me too post - I too am building a new 2012 R2 domain, moving away from CC4. I'm using SCCM for deployment of OS and applications, and am well ahead with that, but my major concerns are user setup (do I use mandatory profiles, roaming profiles, or no profiles at all!) and GPO settings to lock down just enough to leave the system usable.

[Si2100]

This is a me too post - I too am building a new 2012 R2 domain, moving away from CC4. I'm using SCCM for deployment of OS and applications, and am well ahead with that, but my major concerns are user setup (do I use mandatory profiles, roaming profiles, or no profiles at all!) and GPO settings to lock down just enough to leave the system usable.

 

Should be using Folder Redirection and Security Groups! Am rebuilding my network over the summer, But with 2008RC2 Enterprise, Can post bits and pieces if needs be? have a far amount on WDS and Unattended installs.

[Si2100]

This is what i currently have;

 

Default Domain Policy - only touched the password config

Default Domain Controller Policy - Not touched it

 

Default Logon Policy - contains Welcome Message for logon, and Firewall and Service configs

Workstation Restriciton - Locks down the workstation for end users

Internet Explorer Policy - Normal IE Lock down

Smoothwall Authentication - Authticated Port 3128

Teacher Folder Redirection - Need i explain? =)

Student Folder Redirection - Need i explain? =)

Managament Folder Redirection - Need i explain? =)

WSUS Workstation - Allows updates for Endpoints

WSUS Server - Allows updates for Servers

Software Deployment - used for MSI installations, and has various opitons turned on, So end users know whats being install... Verbose mode thingie!

 

Hope this helps =)

Edited May 20, 2014 by Si2100

[jertsy]

This is what i currently have;

 

Default Domain Policy - only touched the password config

Default Domain Controller Policy - Not touched it

 

Default Logon Policy - contains Welcome Message for logon, and Firewall and Service configs

Workstation Restriciton - Locks down the workstation for end users

Internet Explorer Policy - Normal IE Lock down

Smoothwall Authentication - Authticated Port 3128

Teacher Folder Redirection - Need i explain? =)

Student Folder Redirection - Need i explain? =)

Managament Folder Redirection - Need i explain? =)

WSUS Workstation - Allows updates for Endpoints

WSUS Server - Allows updates for Servers

Software Deployment - used for MSI installations, and has various opitons turned on, So end users know whats being install... Verbose mode thingie!

 

Hope this helps =)

 

Thanks a lot for that!

[jertsy]

Should be using Folder Redirection and Security Groups! Am rebuilding my network over the summer, But with 2008RC2 Enterprise, Can post bits and pieces if needs be? have a far amount on WDS and Unattended installs.

 

I'm tackling WDS\MDT next. If I need any info can I PM you please?

[Si2100]

I'm tackling WDS\MDT next. If I need any info can I PM you please?

 

Yeah sure, tbh am more active on the Spiceworks than here, So can copy and past material over :-)

[clareq]

Should be using Folder Redirection and Security Groups!

 

Oh I'm doing that. But what to do with profiles is still a valid question. I'm redirecting what I can for students (staff take laptops home, so their profiles will be roaming).

[Si2100]

Oh I'm doing that. But what to do with profiles is still a valid question. I'm redirecting what I can for students (staff take laptops home, so their profiles will be roaming).

 

Yeah, completely right! My staff laptops are currently standalone. Which is a tad of a pane, But means data is kept safe I guess

[JRowley]

If your going for 2012 and are feeling brave/adventurous you may wish to take a look at Remote Access(DirectAccess) for your staff laptops/mobile devices. Haven't used it myself but is something we are going to be looking at over the next 12 months.

 

Oh and congratulations on the new network, something a lot of us can only dream of! Atleast that's what it feels like these days.

Edited June 17, 2014 by JRowley

[DGardiner]

How to configure Roaming Profiles and Folder Redirection

 

i used this a few years back when we upgraded to 2008 to help with setting up our roaming profiles/etc, not sure how relevant it is to server 2012 but