Am I Missing Something?

[jertsy]

Ok, so I have a brand new domain (2012r2) and w7 clients. I am pushing images out via MDT 2013, mainly office 2013 and some general software for curriculum. I have setup GPO's for folder redirection, and created a GPO with a few settings for client lock down that applies to everyone, and 3 GPO's for staff, pupils, and a privilege one (ex RM sorry), these block stuff like regedit, cmd. Again 3 GPO's for IE lock down. I have deployed printers via GPO, this seems quite nice and reliable.

Out of the box the network seems quite locked down, I am getting some UAC prompts for standard users, stuff like java, and some IE etc.. but is that it, staff and pupils can run anything in c:\program files but nothing else. Is it that 2012R2 is locked down out the box or should I be doing anything else? I have tested installing software with both staff and pupil test accounts and its blocked, also browsing shares, network connections are blocked.

Should I be doing anything else?

 

Thanks in advance

Jetsy

[SYNACK]

The UAC prompts are only for when software tries to write to protected areas like updating java, this can be combated by pushing the updates via GPO constantly and disabling the auto update. You may also need to use GPO to add a few exceptions into the client firewalls to allow certain teraffic like network shares through - this should be on by default but it depends on the setup.

[jertsy]

The UAC prompts are only for when software tries to write to protected areas like updating java, this can be combated by pushing the updates via GPO constantly and disabling the auto update. You may also need to use GPO to add a few exceptions into the client firewalls to allow certain teraffic like network shares through - this should be on by default but it depends on the setup.

 

What I should have done then, is disable the updates in Java in my reference image. I need to tweak some other stuff so I may re-capture in the near future. I have disabled the client firewall, we have a fortigate firewall via our internet provider though. The reason I did this was to get the system center EP deploying and I was advised to disable by our SIMS support people to allow Solus 3 to work.

 

Thanks for the advice SYNACK.

[strawberry]

May need to unblock some temp files too. Zip files and pcounter use the temp files folder

[jertsy]

May need to unblock some temp files too. Zip files and pcounter use the temp files folder

 

We use papercut here. Is that via file system in GPO?

[SYNACK]

Disabling the firewall is really only a diagnostic measure, I would not deploy clients like that, much better to have the firewall up and allow exceptions, a gateway firewall means nothing if someone brings in a USB key with a virus on it and it bounces about your internal network like a ferrit on speed.

 

I'd advise pushing java via GPO too as it gets updated every week with the next hundred security vunrabilities. Jave is easy enough to push out if you are not customising it, just get the full installers from java.com, run them and they dump MSIs into the local temp folder that you can deploy.

Edited August 5, 2014 by SYNACK

[jertsy]

Hmmm, good point. I will look at what ports said systems need to operate.

Cheers