New School Setup

[icecube]

Hi, Ive been thrown into the deep end so so speak.

We intend setting up or in process of setting up new network for IT Class at school.

Server with Windows Server 2008 R2 AD

30 Workstations Windows 7

Will accomodate 3 classes/grades with learners.

Need some help/advice with reagrds to initial AD setup.

What I would like to do is have:

Users > Grade 10 > 2016

Users > Grade 11 > 2016

Users > Grade 12 > 2016 etc...

Also each grade would have access to specific grades shared folder to assignments/tests etc..

Shares > Grade 10 (Only Grade 10 Users Access) etc... for other grades as well.

Anyone can give some advice on how to go about settings for permissions etc?

[sted]

to start with i wouldnt use 2008r2 anymore id be going straight to 2012r2 as thats the current server os and will be supported longer. Again if i was starting from a blank slate id be thinking hard about using windows 10 from day 1 rather than having to adapt an existing system from 7 to 10 in a few years time.

 

as to ad for users id just do year of entry for each so current y6 here is 2009 so usernames something like 9fbloggs or 9fredb the way it looks like you have it setup you would have to move/alter users every year which seems pointless to me

[icecube]

Currently only lisencing available for 2008 & Win7, so will have to work with this.

Want to have users in specific grades access only needed folders for that grade.

[TriggerHappyUK]

Want to have users in specific grades access only needed folders for that grade.

 

You can create grade security groups and bulk assign users to that group. Then only allow admins, staff and certain security groups to access that share.

 

It's a lot easier to change a user's group than it is to relocate them in AD.

[icecube]

Thanks I will look into this now & see if fits within plan.

[Pashers]

In my oppinion I don't think you'll need the Grades to be in different OUs in AD. I'd have:

Student Users > 2016

Student Users > 2015

etc.

 

Then you'll create a membership group called "2016 Grade 10", "2016 Grade 11" etc.

 

Then you can add the policies/restrictions based on the group membership rather than OU location. You'll add the users to the relavent group, then map the shared folder/drive depending on which group they are in.

[Pashers]

I feel like I should rewrite the above and use less thens

[icecube]

In my oppinion I don't think you'll need the Grades to be in different OUs in AD. I'd have:

Student Users > 2016

Student Users > 2015

etc.

 

Then you'll create a membership group called "2016 Grade 10", "2016 Grade 11" etc.

 

Then you can add the policies/restrictions based on the group membership rather than OU location. You'll add the users to the relavent group, then map the shared folder/drive depending on which group they are in.

 

This sounds more like what we have in mind.

Thanks, will read up on it.

If I do not get it working, hope you can help show me where I went wrong.

[Pashers]

Sure, let me know if you get stuck.

[icecube]

So do you right click domain > new group > Student Users

That correct? 2016 = OU?

Then a security group controlling each.

Hope im understanding, been a busy day...

[Pashers]

Just to make sure we're on the same page - AD [Active Directory], OU [Organizational Unit] (looks like the little folders),

as a rough guide line and a brief idea you could have something like:

 

mydomain.com (this should be your domain name. Right click here select organizational unit and call it Student Users)

Users (this is a default OU, you could put Student Users in here as well, or you could create an alternative OU which includes all users. Personally I don't put them in the default Users OU)

Computers (another default OU and again I don't tend to keep the computers in here.)

 

All Users > Students Users > 2016 > 16jbloggs, 16asmith, these are the individual users for 2016.

All Users > Students Users > 2015 > 15jbloggs, 15asmith, these are the individual users for 2015.

All Users > Staff > Teaching > list of staff users

or

Staff > teaching > Blah

Staff > Non-teaching > Blah

 

User Groups > 2016 Grade 10 - Add the users within 2016 who are grade 10 to this user membership group.

User Groups > 2016 Grade 9 - Add the users within 2016 who are grade 9 to this user membership group.

User Groups > 2015 Grade 10

User Groups > 2015 Grade 9

User Groups > HOD

User Groups > Finance (have as many groups as you like to help specify what requirements they may need).

 

When you have created the OUs, students, and the groups. You've assigned the students to the correct groups then you can look at the architecture for your computers.

[icecube]

Lets see:

Staff (OU)

Students (OU) > Grade 10 (OU) > username (Users withing this grade)

Students (OU) > Grade 11 (OU) > username (Users withing this grade)

 

Security Group > Grade 10 (Addusers from above OU)

 

Would it then be possible when they move to next grade just to drag & drop usernames from one OU to next grade OU?

 

Or am I over complicating things?

[sted]

staff(ou)

students(ou)>yoe2009 >username added to group grade10 alter next year if needed personally I just have a 2009 group

students(ou)>yoe2010 >username added to group grade11 alter next year if needed personally I just have a 2010 group

 

yoe=year of entry as it never changes so you don't need to alter users

[icecube]

I Will try this setup & give it a test run.

Now to search for easy script to add multiple users

[Pashers]

When they change grades, you just need to remove them from the old security group and add them to the new grade security group. They won't need to moved.

[icecube]

Just to make sure we're on the same page - AD [Active Directory], OU [Organizational Unit] (looks like the little folders),

as a rough guide line and a brief idea you could have something like:

 

mydomain.com (this should be your domain name. Right click here select organizational unit and call it Student Users)

Users (this is a default OU, you could put Student Users in here as well, or you could create an alternative OU which includes all users. Personally I don't put them in the default Users OU)

Computers (another default OU and again I don't tend to keep the computers in here.)

 

All Users > Students Users > 2016 > 16jbloggs, 16asmith, these are the individual users for 2016.

All Users > Students Users > 2015 > 15jbloggs, 15asmith, these are the individual users for 2015.

All Users > Staff > Teaching > list of staff users

or

Staff > teaching > Blah

Staff > Non-teaching > Blah

 

User Groups > 2016 Grade 10 - Add the users within 2016 who are grade 10 to this user membership group.

User Groups > 2016 Grade 9 - Add the users within 2016 who are grade 9 to this user membership group.

User Groups > 2015 Grade 10

User Groups > 2015 Grade 9

User Groups > HOD

User Groups > Finance (have as many groups as you like to help specify what requirements they may need).

 

When you have created the OUs, students, and the groups. You've assigned the students to the correct groups then you can look at the architecture for your computers.

 

Have gone your route, thanks.

Created a Shared Folders OU > Shared Grade Folder (Specific Folder For Each Grade)

Then create a Security Group for each specifying access.

 

Am I correct in going this way?

[icecube]

Can I also create another security group for roaming profiles?

[Pashers]

Have gone your route, thanks.

Created a Shared Folders OU > Shared Grade Folder (Specific Folder For Each Grade)

Then create a Security Group for each specifying access.

 

Am I correct in going this way?

 

You can do yes, so you can have the security groups specify what folder access they are allowed to have. Also if you wish, you can map the folder and assign it a drive letter if a user it to use it often.

 

As you're new are you aware about the home directories and how to use them with AD?

Edited May 30, 2016 by Pashers

[icecube]

As you're new are you aware about the home directories and how to use them with AD?

 

Im currently playing with setup in virtualbox to test whatever I learn & then implement on server.

Don't quite get you when you say home directories - I have c:\Profiles\%username% set as Roaming Folder.

Im guessing its the same.

[Pashers]

Roaming profiles is when the profile is copied onto a server and local machines. So for example the roaming profile would be \\myserver\profiles\%username%. So when a user logs onto a machine, it'll first create one on their local HDD (C:\users\%username%) then copied to the server. Roaming profiles is for the settings of the users

 

In active directory within the profiles tab (I think) there's a map a users home drive section. So you can set the drive letter (let's say "H" for now) to \\myserver\homedirectories\%username%. This is so they can store their documents

[icecube]

Yip knew that one.

But they can store documents in Roaming Profile as well, or am I wrong?

[FN-GM]

Yip knew that one.

But they can store documents in Roaming Profile as well, or am I wrong?

 

That would mean logins take forever as all the files are dragged over the network

[icecube]

But you still get users who will store most documents/files in there.

How do you curb this? Or would you apply a quota of some sorts?

Other than trying them to save in Home folder?

Also can one have AD auto create Documents, Pictures etc.. folders in Home folder?

Edited May 31, 2016 by icecube

[snagrat]

Use folder redirection to redirect Documents to the server. Then they can't save to the local documents.

 

No need to create the My Pictures etc and it happen automatically.

[icecube]

Use folder redirection to redirect Documents to the server. Then they can't save to the local documents.

 

No need to create the My Pictures etc and it happen automatically.

 

Wont that save to Profile folder? Or can I redirect to Home Folder?

Im a bit new to MS Server, sorry for the many questions.