redirect administrator start menu & desktop

[rocknrollstar]

Hi, I was wondering if you can help me with a problem. I have created an administrator account that the pupils will use (hear me out) to make animations. They may need access to install drivers- really it's to simplyify things for teachers and me. This is a junior school, and I know the children's abilities- certainly not able to 'get into the system'. Anyway, I created the account by copying the adminstrator account in active directory.

 

I also want to redirect the start menu, desktop, and my docs. I've done this before, and it is working fine with the pupil accounts.

 

I think I've done all the necessary things to get this special administrator account to have the redirect. However, whenever I log in as that special account, I don't get the special start menu or desktop as dictated by the GPO redirect.

 

I've tried rebooting, checking permissions on the redirect folders, examing gpresult, nothign springs to mind. Is there something special about an administrator account that says redirection won't work?

 

GPREsult says that the redirected path of the start menu and desktop are pointing to the server, however the actual desktop and startmenu are showing the icons from the default profile on that machine.

 

Any thoughts? Thank you!

[Dom_]

Not sure about your problem but wouldn't a local admin account be better, just incase the kids accidentally stumble across your user area's?

[FN-GM]

You will probably want to make them local admins and not domain admins. That way they can only do administrative tasks on the local machine and not the whole network.

[rob_f]

I'd consider instead making the users members of the local workstation administrators group rather than domain admins, if that's what you're doing. See Florian’s Blog How to use Restricted Groups? Part I for a quick howto on restricted groups. This way they have full (!) control of the local workstation, but won't be able to mess with active directory at all. I know the risks are low, but are never low enough to justify making standard users domain admins.

 

If indeed that's what you're doing... i may have misread

 

Ta,

 

Rob.

[rob_f]

three posts at the same time with the same advice... great minds think alike eh!

[Dom_]

I was just about to say that

[rocknrollstar]

Awesome- 5 replies in less than 10mins!

 

I'll give that a go. I take it that if I make the non-admin domain user a member of the local admin on the client, then the profile settings and gpo folder redirects still apply?

[rob_f]

Yeah, it's still the same user with the same GPOs and profile, they just happen to have admin rights on the local workstation.

 

Just looked at the article I referenced and there might be a bit of an error. Rather than selecting the administrators group, enter builtin\administrators

[rocknrollstar]

Thanks for your replies everyone, I'll give it a go tomorrow.

 

Cheers.

[Quackers]

You can allow normal users to load and unload device's and drivers using "load and unload device drivers" in user rights.