What system settings can standard users change?

[JasonNVSD]

Our district has heavily relied on Deep Freeze for years, but we're looking at moving away from it. So I have a simple question that I've never seen discussed: what things can a standard user change that will effect other users? Thankfully it seems to be very little, but so far I've found:

 

• Display brightness (laptops)
  
• Volume/mute
  

[NB9457]

Virtually everything can be locked down via Group Policy.

 

What Server OS and Client OS are you running and what kind of restricted access and what not do you want and need?

[JasonNVSD]

Virtually everything can be locked down via Group Policy.

Yes. We will be using temporary profiles, so we're not concerned about locking down the 99% of things that only effect the current user. Hence the question, what remains changed after they log out?

 

We're Server/SCCM 2012 R2 and Windows 7.

Edited November 5, 2015 by JasonNVSD

[NB9457]

Yes. We will be using temporary profiles, so we're not concerned about locking down the 99% of things that only effect the current user. Hence the question, what remains changed after they log out?

 

We're Server/SCCM 2012 R2 and Windows 7.

 

I think if you create a power plan and enforce it, brightness can't then be changed and as to volume again lock down via a GPO.

 

As for things that stay when you log off it'll be a case of finding out and locking down whatever you find really

[3s-gtech]

If you diligently check your settings, standard users can't change anything system wide. That includes locking down things like the Accessibility settings, Control Panel, various sound and graphics options etc. Takes a long time and plenty of testing, for us our users helped by finding any holes we missed pretty quickly!

[pete]

Screen orientation if you're using Intel graphics cards and haven't stopped the tools running for the user.

[Zezima]

Screen orientation if you're using Intel graphics cards and haven't stopped the tools running for the user.

 

This via GPO? Students use Ctrl+Alt+Arrow keys ( or w/e the combination is) to change screen orientation and it's quiet annoying.

Edited November 6, 2015 by Zezima

[3s-gtech]

On the newest drivers, the Intel Control Panel is a service which you can disable via Group Policy.

[Zezima]

On the newest drivers, the Intel Control Panel is a service which you can disable via Group Policy.

 

TY, gonna look into that later on today

 

OT:

 

Why not log in and just change settings to see what stays and what doesn't? You can use "windows 7 god mode" to easily access all the windows 7 tools...

 

Create a new folder, name the folder "GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}" and that fodler then contains all win7 tools - making it a lot easier to go through to see whats available.

[JasonNVSD]

Takes a long time and plenty of testing...

Which is why I'm asking here. I was hoping someone could provide some guidance so I'm not starting from scratch.

[Arthur]

what things can a standard user change that will affect other users?

Time zone is another one. A few students found out and started changed it our school computers.

 

When I noticed I simply removed the Users group from the following policy.

 

Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > [b]Change the time zone[/b]

 

http://vgy.me/ay8dYg.png

Edited November 9, 2015 by Arthur