Force Logoff if user group polices are not applied.

[Mattjstmarys]

Hi,

 

We are having issues where students are starting login and will unplug the network cable to stop any group policy user settings applying.

 

Is there anyway to stop these logins or to force logoff if they have not got the policies?

 

Thanks

[TheRobins]

Chop their hands off

 

More importantly in this, what are they achieving, or looking to achieve by removing the cable during login>

[Mattjstmarys]

They are bypassing the Impero chrome extension so are able to get on more site than they should. they don't get their start menu or desktop and use this as an excuse for not doing any work.

[TheRobins]

I feel your pain with this one. You can force a remote GPUpdate /force but its a case of working out when that is. I am not sure of your filtering setup and transparent proxies alike, this is a time when using forced proxies would be very handy, no GPO = no internet.

 

Had a quick google for anything around but cannot see anything myself.

[GizmoIT]

Cut a short bit off the tag of the network cable so it cant be removed without a tool

[djm968]

IMHO this is a classroom control/management issue, the Teacher(s) should be made aware of what's happening and be clamping down on the behaviour.

[TheRobins]

Cut a short bit off the tag of the network cable so it cant be removed without a tool

 

Expensive but these also exist.

 

https://cpc.farnell.com/tuk/kpj2nt/t-lok-tamperproof-faceplate/dp/CS31332?mckv=s_dc|pcrid|224645161149|kword||match||plid||slid||product|CS31332|pgrid|45968746254|ptaid|pla-1394700091811|&CMP=KNC-GUK-CPC-SHOPPING&s_kwcid=AL!5616!3!224645161149!!!network}!1394700091811!&gclid=CjwKCAiAh_GNBhAHEiwAjOh3ZDvKAaF6IM0phskRpVua0Wzph-6UfQMz_2jyvCagBssCGL2sN-uhnBoC3e8QAvD_BwE

[StevieM]

I don't know if it would work but could you:

 

1. Create a script to run from a user GPO that either creates a file in a particular location or sets a registry key.

2. Schedule a local task to check if the file/key exists.

3. If it does, delete the file/key; if it doesn't, logout the user.

 

Just an idea

[djm968]

Expensive but these also exist.

 

https://cpc.farnell.com/tuk/kpj2nt/t-lok-tamperproof-faceplate/dp/CS31332?mckv=s_dc|pcrid|224645161149|kword||match||plid||slid||product|CS31332|pgrid|45968746254|ptaid|pla-1394700091811|&CMP=KNC-GUK-CPC-SHOPPING&s_kwcid=AL!5616!3!224645161149!!!network}!1394700091811!&gclid=CjwKCAiAh_GNBhAHEiwAjOh3ZDvKAaF6IM0phskRpVua0Wzph-6UfQMz_2jyvCagBssCGL2sN-uhnBoC3e8QAvD_BwE

 

That won't stop them unplugging the cable at the device end.

Edited December 17, 2021 by djm968

[TheRobins]

True, I have tamper cases on all my machines didnt come into my mind

[LeMarchand]

How about a Computer GPO that sets a scheduled task/script to check for a file that should be on the desktop after logon (or the extension, though that might not be as easy). If it doesn't exist, log off/restart, preferably after displaying a "Do not pull out the network cable you little £$^!" page for a short while?

 

Not checked if this is possible, but it sounds feasible in my mind!

 

Edit: Originally had the same sort of idea as @StevieM, but his idea appeared while I was (possibly) simplifying mine.

Edited December 17, 2021 by LeMarchand

[Boredguy]

we used to have a lot of those issues, but not so much these days

You can configure Impero to blank the screen if the network connection is removed which will alert any observant teachers at the time.

 

We also moved away from using the Impero web extension as a means to block sites, since it's such a pain at times (plus our filtering is done by the proper web filter since staff were blocking a users internet access in Impero then wondering why they couldn't do their work on site X)

[Koldov]

100% agree it is a classroom management issue but...

 

Along with this wasn't there some sort of script that could check for a network connection and shut down the machine if it didn't detect one?

 

Also good old cable ties (not sure on your machines but ours have a airflow grille at the back that allows me to loop one round the cable and then put the ends into the machine to secure tightly)!

Edited December 17, 2021 by Koldov

[LeMarchand]

Along with this wasn't there some sort of script that could check for a network connection and shut down the machine if it didn't detect one?

 

That's easy enough, but they will have put the cable back in so that they can get on the less strictly filtered internet.

[Koldov]

That's easy enough, but they will have put the cable back in so that they can get on the less strictly filtered internet.

 

Yeah good shout, it doesn't happen here so I'm just shooting in the dark.

 

Just tried it with one of ours and it seems they don't get shared drives, desktop wallpaper and a few other things but they can obviously get around a lot of things that are usually locked down with GPOs - luckily internet access is still filtered as that's at an ISP level.

 

I'd go with the file check script then (and cable ties) and a word to the teachers/SLT.

[Wubbalubbadub]

You could also look into lockable network cables.. but also.. this is clearly a classroom management problem.