Student/Staff Group Policy Restrictions

[Awesome_Username]

Just wanted to see if anyone would be willing to share their group policy practices for staff/students. We currently have ours setup but we are looking to revise it since it has been in place since Windows 98. Things have only just been added to it but never really removed. We still have the original fix to allow flash drives to be installed. Really just looking for a best practices to lock them down and give them minimal access. Maybe there is something were missing or possibly overthinking. We do have a group of 1:1 students with Windows laptops as well. They seem to find creative ways to load games though they are not able to run installers. For staff, they always want full access but we are moving to install LAPS on all their devices to resolve some of that. Thanks.

[Julian]

For overall guidance, please see the NCSC best practice guidelines, very general, but as this comes from the UK government, it is very difficult to argue against official guidance.