Network Guest Access

[MattDLEA]

Does anyone have a policy for guest access of their network?

 

We have a few people that come in to do clubs and special lessons, that are now asking for access to the computers.

If I created 4 accounts called guest1 etc how safe is this? I know with staff logins you have some accountability as you know who's account it is.

My thought were to create 4 and change the passwords on them every 2-4 weeks? I dont want normal teaching staff to be use them.

What access does your guests have. I was thinking of no shared drives. Just the normal (usual) programs and the internet.

 

Cheers

[plexer]

If you know who they are why not create normal named accounts to be used by them only?

 

Ben

[LP814]

Depending on the time you are based in the school, I'd be inclined to setup a username for them that you can enable or disable depending on the group active status in the school. 'Footballclub' or whatever.

 

Off the top of my head, there is a gpo that allows you to set a time period when a user can log in - any attempts outside that time period then they are refused.

 

If an after school club, set this to between 3pm and 7pm or whatever. The thing to note about that policy though is that it doesn't force log off when the time expires, so if the user is left logged in, it will stay active. It will just refuse them login during the illegal hours.

[hallb15]

We have groups in on a weekend. They have their own login which effectively logs them on as a pupil, but without access to any shared drives. They can run installed software, print, and access the internet. They can only log on to the computers in the rooms they are allocated.

I restrict their logon hours in AD to the times they are expected to be in school and I also enforce the "Network security: Force logoff when logon hours expire policy." GPO.

[plexer]

I also enforce the "Network security: Force logoff when logon hours expire policy." GPO.

 

That policy won't actually log them off though all it does is disconnect their smb session from the server.

 

Ben