Laptops with GPOs off the network?

[gshaw]

We've got some mobile teaching laptops that until now (with the rest of the network) used HDGuard (like Deepfreeze) to keep their config. Since then we've removed HDGuard from all machines and make more use of GPO and mandatory profiles to lock machines down centrally to save time setting them up etc.

 

This works great on the network but not so sure how well it's gonna do the trick for the laptops? I was thinking of doing...

 

- profile, redirected start menu \ desktop items on C: drive

- domain autologon reg script seems to cache itself anyway so looks alright there

- GPOs hmmm not sure how well that'll work?

 

From a quick test I've done before it seems logon scripts don't work off the domain and folder redirection goes a bit wonky as well. Is there any way round this? Only other thing is going back to local users but then how can I save policies to apply to other machines - seems a lot of work otherwise

[dtakias]

Doing things the wireless way it can be a pain and requires more effort but eventually everything works.

 

If you apply the mandatory profile the right way it should work easy with a few settings like redirecting the Applicaition Data folder to save some time during logging.

If your logon scripts work for your wired network, they should also work for the wireless as they are applied during logon and not startup. What exactly are you doing with your logon scripts?

 

Your GPOs should work as well, you might need to do a few more "gpupdate /force" but eventually they should all pick up your GPOs.

[gshaw]

That's the prob... they're being used at an outcentre miles away from this campus so no network connection at all

 

I know some GPO settings "stick" when off the network but I'm guessing logon scripts won't and folder redirection doesn't seem to like it either?

[SYNACK]

These instructions might help you copy local group policies between computers which should be more dependable:

Copy Group Policy to other machines - Winforums

 

You can do the same for the security policies with a command line tool after installing this hotfix:

The Secedit.exe command-line utility does not export a security template for local security policy in Windows XP

then using the secedit commands from here:

Chapter 5: Securing Stand-Alone Windows XP Clients

it also adds a bit of explanation on local policy setups