Is this the way to solve some of our problems?

[san_narula]

While setting up a new File Server for our staff, I have been thinking of addressing the problems I have been dealing with in the past. These are some of the issues I have inherited:

 

Some staff still save their files to the local storage even after numerous warnings that these are not being backed up. Every time there is an OS or hardware failure, I have to waste countless hours trying to recover their files.

 

It is a widespread mentality here that it is perfectly fine to save their personal data on the computers local storage as well as the network storage. This includes personal videos, photos and music etc. along with others file types.

 

Some data which is created by teachers should be shared with other teachers but it is saved in their home folders so never gets shared.

 

Staff download all sort of programs from the internet not even knowing what they do. This has resulted in number of virus/malware infections in the past including Cryptolocker.

 

Some teachers take their laptops home so they copy some folders to the local disk. Then they lose track of which files they have modified and copy the whole folders back to their home folder. This results in duplicates everywhere.

 

Teacher gets a video CD/DVD, make a copy into their home folder, give the disc to another teacher who does the same thing. This has resulted in 100’s of Gigs of duplicate files.

Many of them think desktop is to save frequently used files so they fill it up completely with files of all sizes ranging from 1MB to 1GB.

 

Although we are formulating a storage and fair use policy, it will not stop many of them from continuing similar practices in future unless they are being forced to do so via some restrictions. So this is what I have been thinking of doing:

 

Use GP to create home folders and redirect ‘My documents’ and other relevant folders to it.

 

Using FSRM Quotas, limit the home folders size to 10GB.

 

Using file screening, restrict them from saving executables, vidoes, music files etc. to their home folders. Also, restrict them from saving executables to the shared folder.

 

Hide C: using GP so they cannot save files to the local disk.

 

Enable offline folders on home folders so they can work at home and the files sync as soon as they connect back to the network.

 

Make desktop read only so they are unable to save anything to the desktop.

 

Setup Applocker policies so only approved applications can be run on the computers.

 

I know this is not going to solve all the above mentioned problems but do people think it will solve majority of them. Am I on the right track or should I use different means to address the issues. I am open to all the suggestions you may have.

 

I would also like to know what others have done who have come across similar problems. Is someone able to share their policy with me as it will give me an idea what to include in it.

Edited October 23, 2014 by san_narula
Formatiing

[caffrey]

This is sound policy, It's probably what we all have set up on a normal school network. Maybe also add stop running applications from local %temp% folders too (to stop executables being ran from zip/rar files) using software restriction policies. Also redirect internet browser downloads to their home folders.

[free780]

Block exes and zips from being downloaded. You can enable de duplication on server 2012.

[computer_expert]

If you are using server 2012, have a look at the data deduplication features. This works in a way that if you have 10 teachers copy the same 1gb file to different folders it will only take up 1gb rather than 10gb.

 

If you do go down this route you will probably need to just check that your backup software supports server 2012's data deduplication features first.

[san_narula]

This is sound policy, It's probably what we all have set up on a normal school network. Maybe also add stop running applications from local %temp% folders too (to stop executables being ran from zip/rar files) using software restriction policies. Also redirect internet browser downloads to their home folders.

 

It's good to know that I am on the right track.

 

I will add temp folders to the list.

 

Is it better to redirect the downloads to their home folders or redirect the downloads folder?

[san_narula]

Block exes and zips from being downloaded. You can enable de duplication on server 2012.

 

I already have exes blocked but they may need to download some genuine zips from some websites or through emails. How would I handle that?

 

Also, how about the genuine downloads for webinars etc as they will need to run these.

[san_narula]

If you are using server 2012, have a look at the data deduplication features. This works in a way that if you have 10 teachers copy the same 1gb file to different folders it will only take up 1gb rather than 10gb.

 

If you do go down this route you will probably need to just check that your backup software supports server 2012's data deduplication features first.

 

We are running Windows Server 2012 R2 so I will give it a try. As far as I know our backup software Veeam does not support it but I will double check it.

[free780]

Can you allow zips for certain domains?

[san_narula]

Can you allow zips for certain domains?

 

I don't think I can with Sophos but even if I could it won't work as they go to different websites and may download something which is zipped. It can be Word, PDF or something similar.

[Arthur]

I don't think I can with Sophos but even if I could it won't work

If you use AppLocker to prevent executable files from running from %TEMP%, user areas and removable storage (USB and optical), you could still allow .zip files to be downloaded.

 

Blocking executables from being saved to user areas with FSRM is a very good idea, but IIRC the default list of executable file types includes .js files which may prevent students from creating websites that include external JavaScript files.

[san_narula]

If you use AppLocker to prevent executable files from running from %TEMP%, user areas and removable storage (USB and optical), you could still allow .zip files to be downloaded.

 

Blocking executables from being saved to user areas with FSRM is a very good idea, but IIRC the default list of executable file types includes .js files which may prevent students from creating websites that include external JavaScript files.

 

Thanks for the tips. I will add these to my notes.

[san_narula]

I have only redirected Documents and Downloads folders in the past so can someone tell me if it is safe to redirect all the folders to the home folder or should I be avoiding some of them. Also, what about making the Desktops read only, should I redirect it to a separate folder?

[Arthur]

I have only redirected Documents and Downloads folders in the past so can someone tell me if it is safe to redirect all the folders to the home folder or should I be avoiding some of them.

It's generally recommended not to redirect AppData, but the other folders are fine.

 

Also, what about making the Desktops read only, should I redirect it to a separate folder?

That's up to you. Some people redirect the desktop to a single network share and make it read only (by changing the permissions so the users only have read and execute), while others redirect the desktop to the users home directory to let them save things on it.

[san_narula]

Thanks Arthur,

 

I have tested it and the redirection is working fine. I am now having some troubles with NTFS permissions but I will start a new thread for this.