Desktop customisation...

[X-13]

As we're getting our network redone soon, I've been thinking about GPOs and restrictions.

 

I'm considering a multi-tiered lockdown of desktop customisation for pupils/staff and wondered how everyone else is doing it.

 

 

At the moment I'm thinking of:

 

Forcing the desktop background for pupils. Staff can change it if they want.

 

Alongside that, if it's possible, pupils have no screensaver control, but staff can change the visuals [not the timeout or password on exit]

 

Nobody can change the sounds, taskbar or notifications... That's caused too many problems.

 

 

Sysadmin follows Cartman rules. "Whatever, I do what I want".

 

 

Thoughts?

[Demarcation]

Bad idea, Lock it down dont let staff do anything either, it will just cause you more issues.

If staff complain tell them its about teh corperate image, when visitors and parents visit the school.

If you allow customisation, you'll end up with a member of staff setting a picture thats not really appropriate such as a holiday snap of a beach with bare breasted ladies in the backgroud (un-noticed by the staff member) then everything kicks off, its not worth it. (and ruins the corporate image of the school with a million different desktops, and makes more work for you to manage loads of GPOs etc)

[LeMarchand]

I'd love to be able to force a suitable desktop on staff. If only so that I didn't have to see their ugly kids went I work on their machines.

[psydii]

Everybody gets everything bar Admin rights.

 

Firewall and endpoint protection stops the naughtiness.

[Domino]

additionally, we had different themes and backgrounds for staff and pupils set - you can see at a glance walking in a room if anyone's doing something silly like letting the pupils log in as them

[SpuffMonkey]

We force desktops with different colour schemes for admin staff, teachers and students - it makes it easier to spot "inappropriate" logins

[X-13]

additionally, we had different themes and backgrounds for staff and pupils set - you can see at a glance walking in a room if anyone's doing something silly like letting the pupils log in as them

 

We force desktops with different colour schemes for admin staff, teachers and students - it makes it easier to spot "inappropriate" logins

 

That's actually something I've been considering for a while.

[MordyT]

We lock them completely down. Can't change wallpaper, themes, mouse icons, taskbar location/size, or really anything. For staff and students.

 

They all have the same look, the most a person can do is enlarge the forced desktop icons.

[3s-gtech]

Lockdowns for teachers and students are roughly the same here, no real customisation at all. Much more corporate and boring but also safe and less likely to cause issues!

 

Admin staff get much less restrictive permissions - as their PCs aren't hooked up to projectors I'm not too worried if they choose a custom background.

 

Using bginfo, we could have different coloured backgrounds quite easily, but we have certain lockouts on who can log onto certain PCs anyway.

[Oaktech]

Everything locked down... The only customization allowed is the ability to change screen res or the hand of the mouse.

[MrMDStreet]

I have had everything locked down to a similar method we used with Ranger a few years ago. No right-click, desktop image standard for teachers, admin and pupils, screensaver lock timeout after 20 minutes, no searching from the start menu, no control panel access, pre-defined pinned start menu icons and desktop icons, pre-mapped drives etc.

 

However admin requested a few changes. The pink wallpaper with 'Admin' written across it was too horrible and they wanted their own wallpapers, their machines aren't parent facing so that was fine. My favourite was the request to re-enable right click in explorer and on the desktop because it meant they could no longer cut, copy & paste. I banged my head on the table for an hour, wrote a little helpful shortcuts poster and re-enabled it anyway. Too much hassle other wise.

[Joanne]

I'm considering forcing a background after summer. Currently everyone is on default Windows 7 blue with logo in the middle. There was a cheesy school one that I removed.

 

As for other stuff, kids desktop icons are redirected and they can't change anything. Staff have redirected desktops to a folder in their homedrives so can save what they want there. Currently they can set any screensaver and background they like. I like to give people more trust in terms of looking after their own computer. If they mess it up I'll reimage it. No biggie.

[MrMDStreet]

I could never get on with folder redirection. It was save me some trouble but at the moment it's not really a big issue, they have their mapped "s:\" drive and if they chose to save things on the desktop or the local documents folder, that's their own fault.

 

I have come to the conclusion that me trusting them to not install an insane amount of search bars and attempt to farm bitcoins from their machine is something that is never going to happen. However, I have a new boss soon, so my hard work could be for nothing.

[tmcd35]

Staff can, within reason, do as they please here. I don't see/feel the need to restrict their settings. They are adults in charge of kids, they should know what is and isn't appropriate. Getting it wrong is a disciplinary issue in my book, not a reason to enforce a corporate desktop on everyone because a few can't be trusted.

 

That said, I'm making one change this year. Staff Desktops are being redirected to their network home folder. Means work saved on the desktop will be backed up over night and less likely to cause issue when I want to delete profiles.

 

For pupils everything is tied down and restricted. Redirected read-only desktop and start menu. We run bginfo as part of their logon.bat script to set background image with some useful machine/user info displayed.

 

- - - Updated - - -

 

Staff can, within reason, do as they please here. I don't see/feel the need to restrict their settings. They are adults in charge of kids, they should know what is and isn't appropriate. Getting it wrong is a disciplinary issue in my book, not a reason to enforce a corporate desktop on everyone because a few can't be trusted.

 

That said, I'm making one change this year. Staff Desktops are being redirected to their network home folder. Means work saved on the desktop will be backed up over night and less likely to cause issue when I want to delete profiles.

 

For pupils everything is tied down and restricted. Redirected read-only desktop and start menu. We run bginfo as part of their logon.bat script to set background image with some useful machine/user info displayed.

[Joanne]

^^ I agree with this