Released: EduGeek AUP Informant

[bizzel]

One more from the labs. This little app is like the windows logon message but on steroids - great for managing your acceptable usage policies and getting responses from staff and students. Notable features include email notifications, automatic logoff, html page display and serving multiple policies depending on usertype.

 

After you deploy it to workstations, it will load each time a student logs in. If they have accepted the policy, it won't show. If they've yet to accept or decline it, it will appear and prompt them to choose. Their response is saved as a hidden file in their user area. You can then refer to this if you need to prove or disprove that they accepted the policy after catching them doing something naughty. You can choose to be notifed via email if a user declines the policy. To show the policy again, simply delete the "aup.ini" files it creates using Windows search.

 

Security-wise, it's totally student-proof. That's a bold claim but we let some of our more technical students try and get rid of it. Not one of them managed it. It sticks on top of all other windows; you can't move it, resize it, alt+f4 it or minimise it. In fact, so long as your students don't have task manager, they can't kill it.

 

Since version 1.3.0, you can modify the program's settings outside of the source code. That means it should be 100% ready to package and use on your network without needing compiling, though full source is available under the GPL 2.0 so you can edit as much as you like. Enjoy and email me at wordpress[{at}]paulbeesley.com if you need.

 

For packaging instructions, refer to the readme file that comes with the download. Creating a CC3 package is easy and I'm working on a standalone installer. You should also be able to run it from a sysvol share. The only reason I don't have a 'ready-to-go' CC3 package is because you will need to modify a config file before deployment.

 

See this thread for downloads: http://www.edugeek.net/forums/edugeek-aup-informant/17637-project-page-download-here.html

Edited August 27, 2008 by bizzel

[Ryan]

Woof, awesome Report back once you've rolled it out fully.

[Edu-IT]

This looks great! Perhaps it could be tied in with that admin bar thing? (Sorry!)

[Ryan]

A little thought: Many companies (if not all) will declare anything you produce on their time is their property, and as such they'll retain any intellectual property rights and the right to exploit or sell whatever produced as they see fit.

 

Did you do this on company time? Are they aware of, and ok with, you distributing it? I'd hate to see it bite you in the arse later.

[6Foot2]

Hi bizzel,

 

Your website mentions CC3 packages, but are there any special instructions for non RM networks? [Viglen Classlink7 here ]

Edited March 6, 2008 by 6Foot2
Correct spelling mistake.

[Gatt]

Now this looks like its worth a try!

Cheers..

[bizzel]

Phew! Finally got all the new information very quickly put together in the first post. I realise that when I first posted a link it wasn't ready to package at all. Hopefully I've sorted that out and you can quickly adapt it for your network.

 

If you've downloaded the package kit or the source before the time of this message, please re-download it. No bugs have been fixed but the instructions are much better.

 

DaveP: I don't know anything about Classlink, I'm afraid. Does it come with its own package creation tools?

Edited March 6, 2008 by bizzel

[Edu-IT]

DaveP: I don't know anything about Classlink, I'm afraid. Does it come with its own package creation tools?

No it doesn't. I think the only way to do it would be to manually install it on each machine.

[Jackd]

Could you not use WinInstall LE to make a package out of it in .msi format then distribute via GPO's. Or you could make a simple script in auto it to copy the directory and write the registry key

[bizzel]

Edit: Downloads are back up and the version has been updated to 1.3.1.

 

What's changed in 1.3.1?

 

Fixed a bug that could cause the wrong policy url to be loaded

Fixed a bug that could wrongly identify a user as not having responded when they had

Reduced memory usage slightly

Optimised startup speed

Made it easier to switch between staff and student policies

Better code comments and documentation

 

Several of those bugs were caused by switching from hard-coded settings to the config file. They should all be sorted out now.

Edited March 8, 2008 by bizzel

[sidewinder]

Looks excellent, thank you...my NM is very pleased with it

Ill soon find out when I try later, but is it possible to just put the files on a server and have the exe run on logon? Rather than worrying about an MSI

 

Also, does it defeat the point a bit if they are able to log back on after declining it? Surely then they could get up to all sorts and because they havent accepted the AUP we cant do anything?

Edited March 11, 2008 by sidewinder

[bizzel]

Looks excellent, thank you...my NM is very pleased with it

Ill soon find out when I try later, but is it possible to just put the files on a server and have the exe run on logon? Rather than worrying about an MSI

 

Also, does it defeat the point a bit if they are able to log back on after declining it? Surely then they could get up to all sorts and because they havent accepted the AUP we cant do anything?

 

I'm glad you like it. If you want to have it run from a server, you can. Grab the package kit and follow the instructions I just added on my site. Let me know if that works, it's probably a lot simpler than packages for most people.

 

As for logging off students just the once, that's sort of a best-effort on my part. Since the student user won't have the necessary permissions to disable accounts in AD, I can't do it from my app. If you have an accessible smtp server you can set the app to send you email notifications when someone declines the policy but I agree, automatic disabling of the account would be better. If anyone knows of a way to do this, let me know!

Edited March 11, 2008 by bizzel

[sidewinder]

Ah, fair point, yes, hadnt thought about that

 

In that case, in the future would it be possible to add an option that doesn't write to the file if they click decline, so it would keep showing on logon? Im thinking something that can be turned on and off in the config file, since Im sure many find it useful the way it is currently

 

Im being fussy though, it works perfectly for now, and like you say I can weed out people who have declined via the emails. I suspect the vast majority of 'rebels' will change their mind as soon as they get the warning about being logged off when clicking decline anyway

[spc-rocket]

Hi there,

 

Great app, looks great. Does this get displayed at every logon? and how does it know has logged on i.e. staff, student or are these settings customisable?

 

Thanks!

 

Ash.

[plexer]

Anyway you could use something like we do with self service password reset and that is to impersonate a user with higher priveleges when you need to in our case changing passwords but for you it would be to disable the account.

 

But if you disable the account how do they then get it enabled come see you to accept the policy so you can enable their account, or disable it for a period of time.

 

Ben

[bizzel]

Hi there,

 

Great app, looks great. Does this get displayed at every logon? and how does it know has logged on i.e. staff, student or are these settings customisable?

 

Thanks!

 

Ash.

 

Hi Ashok,

 

It's only shown once to the student. As soon as they choose to accept or decline, their preference is saved. So long as that preference file is there, they won't see it again. You can remove the preference file with a quick windows search for "aup.ini" and it'll pop right back up again.

 

It determines staff / students with a username prefix. Our school uses "stf" to prefix its staff users but you can change this in the config file. If I find a better way of doing this, I'll update the code but it's a case of making it work for the majority of schools.

 

I hope that answers a few questions. Drop me a PM if you need advice on setting it up.

[OutToLunch]

Wow! Nice job - it's like a modern version of an app I wrote a very long time ago for RM Connect 2.3 on steroids Never did get the APIs figured out to lock it down in NT/2K/XP so it was only ever properly useful on 9x stations... No longer had access to an RM network to develop it and lost the source code in an IBM Deathstar HD crash years ago. Nice to see a decent replacement I can point people at - still seem to get emails about it so it must still be linked somewhere!

 

Hmm, actually found a thread about it here - http://www.edugeek.net/forums/showthread.php?t=96 - I'm famous!

[sidewinder]

Hi Bizzel, having some problems running from a network share

Ive not even tried it on a logon script yet, because I cant actually execute it at all when its on the network. Ive tried several different clients, several servers, and both mapped and UNC shares

 

Every time I click on it I get ' Acceptable Usage Policy Informant has encountered a problem and needs to close'

 

this is the error signature

 

AppName: aup.exe AppVer: 1.0.1.0 AppStamp:47d28f1b

ModName: kernel32.dll ModVer: 5.1.2600.3119 ModStamp:46239bd5

fDebug: 0 Offset: 00012a5b

 

It runs fine from whatever local drive I put it on, but no network drives at all

[bizzel]

Hi Bizzel, having some problems running from a network share

Ive not even tried it on a logon script yet, because I cant actually execute it at all when its on the network. Ive tried several different clients, several servers, and both mapped and UNC shares

 

Every time I click on it I get ' Acceptable Usage Policy Informant has encountered a problem and needs to close'

 

this is the error signature

 

AppName: aup.exe AppVer: 1.0.1.0 AppStamp:47d28f1b

ModName: kernel32.dll ModVer: 5.1.2600.3119 ModStamp:46239bd5

fDebug: 0 Offset: 00012a5b

 

It runs fine from whatever local drive I put it on, but no network drives at all

 

As far as I'm aware, this is an issue with the .NET framework not trusting the app because it's on another machine, which is why it runs fine locally. I'll investigate what settings might need to be changed to allow full trust. Are you on CC3, by the way?

Edited March 13, 2008 by bizzel

[bizzel]

Yep, here we go. From Microsoft Support:

 

"By default, a .NET Framework application that runs from the Internet does not have the same level of trust as a .NET Framework application that runs from your local computer. An application that runs from your local computer can access resources such as the file system. However, an application that runs from the Internet or from a local intranet cannot access the file system on your local computer."

 

You can see some possible solutions here and also here, though none look to be easy for multiple computers unless you can set this via a GPO or registry key somehow.

 

I'm glad it's not my code but it's still a real pain. If you still have no luck, you'll have to package it I'm afraid. Let me know how you get on.

Edited March 13, 2008 by bizzel

[sidewinder]

Thanks for taking a look. Looks like a bit of a nightmare, might be easier to just package it...I was hoping not to, but I suppose it doesnt make much difference overall

And no we're not CC3, vanilla here

[bizzel]

I may have found a way around this one. It'll take a couple of days to investigate.

[Scotmk]

Hi

 

Has anyone packaged this for CC3 yet? if so would you like to share with me?

 

Thanks

 

Scot

[Gatt]

Bugger - running into the .NET Trust problem here

[bizzel]

Hi

 

Has anyone packaged this for CC3 yet? if so would you like to share with me?

 

Thanks

 

Scot

 

Hi Scot,

 

I'd be happy to build you a package but I'd need some information about the network you'll run it on. The only reason I haven't created a ready-made package is because you need to customise the configuration file before you package and deploy. Let me know if I can help with that at all.

 

Bugger - running into the .NET Trust problem here

 

I understand that ClickOnce signing the application goes some way towards solving the problem. I don't want to rush anything out but I'll have a small update out this week that might solve it. What I'm doing at the moment is finding out what parts of the code trigger a security exception and either I'll work around them or try to find a neater way to escalate the application's privileges. One real PITA is the fact that a .NET app running in the Intranet zone can't access the local filesystem at all! I'll let you know as soon as I get anywhere.

Edited March 25, 2008 by bizzel