Domain users can take laptops home

[Juniorz]

Hi All,

 

What is the best way to approach this. I would like the year 12 cohort to be able to take laptops home and login without the domain controller present. however I was hoping that the security policies remained the same and they could not alter anything once taken home.

 

From researching i have taken into consideration of using the following GPO: Interactive logon: Number of previous logons to cache (in case domain controller is not available)

[h=1]

[/h]as these are individual laptops assigned to the user i could set this to 1 cached credential and if i was to login as admin they wouldnt be able to scramble my password.

 

though if i was to implement this GPO would it keep previously applied group policies that i currently use to lockdown the computer.

 

Thank you in advance,

 

[FN-GM]

That would work yes. I would up the number a little, just incase someone else logins in, we don't want to lock them out.

 

Another option maybe is Direct Access? Its an automatic VPN, they turn on and connect the WIFI and the laptop will automatically VPN back to the system. That way they can access shared drives etc.

[halbaradkenafin]

Cached Logins are what we use here and it works well, keeps all the GPOs etc in place. Only thing to watch out for is redirected start menus or desktops, we set up a GPO that redirects the start menu to a local copy when a laptop user logs in, the copy is made every time it starts up with a simple robocopy batch script.

[Firefox]

Another consideration is do you want them to be able to connect the laptop to their own home network to browse the internet etc.? as if you deploy IE policies via GPO that lock down to a certain proxy server you could have issues.

[Juniorz]

Excellent! it's always good to know your on the right track So just to verify, it will keep all previous installed gpos from the last login when it was connected to a DC?

[FN-GM]

Excellent! it's always good to know your on the right track So just to verify, it will keep all previous installed gpos from the last login when it was connected to a DC?

 

Yep, correct

[DaveAngel]

Another consideration is do you want them to be able to connect the laptop to their own home network to browse the internet etc.? as if you deploy IE policies via GPO that lock down to a certain proxy server you could have issues.

 

why not create a script for location based proxy settings, for example if the ip address is within x.x.x.x - y.y.y.y use the schools proxy, otherwise use no proxy!

[Firefox]

why not create a script for location based proxy settings, for example if the ip address is within x.x.x.x - y.y.y.y use the schools proxy, otherwise use no proxy!

 

Yeah we use a proxy.pac file to get round the issue. But I'm guessing if they currently don't work from home that's never been a consideration for them