Face-Man Posted June 2, 2006 Posted June 2, 2006 Gatt: I love the way the white list will fit with the school moto "Bringing knowledge to life"... I predict alot of support calls on Monday. Have the excuse ready "Show me where the website .... is in your lesson plan/scheme of work and I'll allow it" Because we all know teachers manage the students use of the net rather than "go on google and type..."
sahmeepee Posted June 5, 2006 Posted June 5, 2006 I know a school that's had it like that for a while. Definitely since September. The decision was made by management and I would definitely have some problems with it if the word came down from above like that here. Teachers can make requests for rooms to be temporarily switched into blacklist-mode if they're doing research type lessons, but it's only temporary.
Gatt Posted June 5, 2006 Posted June 5, 2006 @sahmeepee: That was the barrier I hit this morning, but all I said was to make a note of the website. Since we still use google, until an appropriate educational search engine can be made available (been looking at this one, i said to the Head of IT to make a note of the green link and send me a One||Zero request with them in it & I'll check them out and unblock them
itguy78 Posted May 26, 2008 Posted May 26, 2008 Best thing I found to disable F8 LEGALLY: NOSafeMode ? The LEGAL and ELEGANT way to disable F8 and Advanced Boot Options in Windows NT? based Operating Systems (Including Windows 2000?, Windows XP? and Windows Vista?)
meastaugh1 Posted May 26, 2008 Posted May 26, 2008 You could try using the method RM use on CC3 to disable the keyboard and mouse in safe mode by deleting these reg keys: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318} HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}
jdavies Posted March 15, 2011 Posted March 15, 2011 You could try using the method RM use on CC3 to disable the keyboard and mouse in safe mode by deleting these reg keys: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318} HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318} Does that lock out the mouse and keyboard when in safe mode then? Sounds good in theory, however if the mouse and keyboard don't work the kids turn feral and start smashing them etc. Need to find a way of intergrating a script into RM so that either the machine reboots when safemode is detected or it doesn't allow them to log on while in safemode. Have set all the students as domain guests (saves space on the oh so massive 40gig hdds) so there's no local profiles to worry about
kennysarmy Posted March 15, 2011 Posted March 15, 2011 I deleted the keys and it made no difference at all on my windows 7 test pc. Both mouse and keyboard still functioned.
Arthur Posted March 15, 2011 Posted March 15, 2011 I deleted the keys and it made no difference at all on my windows 7 test pc. See the post below. You need to delete a few more registry keys... http://www.edugeek.net/forums/windows/72617-kids-messing-dos-prompt-after-f8-safe-mode-networking.html#post647516 1
gjdb Posted March 16, 2011 Posted March 16, 2011 Workarounds:Create a login script which logs off the user if it detects the environment variable SafeBoot_Option=Network Could someone build such a script, because i am not a scripting guy myself.
Steve21 Posted March 16, 2011 Posted March 16, 2011 Could someone build such a script, because i am not a scripting guy myself. Here's an older one I've used on XP before (Haven't tested it on W7 since upgrades) (Disclaimer, Was stolen from Random website years ago Not mine/schools) Set WMIService = GetObject("winmgmts:\\.\root\cimv2") Set Items = WMIService.ExecQuery("Select * from Win32_Environment") safemode = false For Each SubItems in Items if SubItems.Name = "SAFEBOOT_OPTION" and SubItems.VariableValue = "Network" then safemode = True end if if subitems.name = "lib" then username = subItems.Username end if Next if safemode = True then msgbox "We caught you " & username Set OpSysSet = WMIService.ExecQuery("select * from Win32_OperatingSystem where Primary=true") For each OpSys in OpSysSet OpSys.Shutdown() next end if Haven't tested this at all on any newer systems, but might be worth trying if you got time? Steve 1
cpjitservices Posted March 16, 2011 Posted March 16, 2011 We have Novell setup on the PC's and we've had people try to get in on safe mode with Networking, but they've never gotten any further from the Login box. Our laptops haven't got Novell installed and the kids have tried to get in on safe mode but we have those locked down with Guest accounts disabled and we have a Universal local Admin password which even if the kids did guess it thy probably wouldn't be able to make out the characters and where the numbers go and since it's about 32 characters long.............. I think we are pretty secure - although we never used to be.
Steve21 Posted March 16, 2011 Posted March 16, 2011 "but we have those locked down with Guest accounts disabled and we have a Universal local Admin password " You can log on with any user account in safemode if networking is enabled though, not just guest/admin. And being safemode no boot-services will be running. Steve
cpjitservices Posted March 16, 2011 Posted March 16, 2011 Yeah I agree anyone can login with networking enabled - only local Administrator can login to our machines in Safe-Mode with Networking. The only way you can login to the a network account is to login to the local admin account and then login to the Novell Client using the network username - even then on some machines it doesn't authenticate because the Novell services arn't running - but yeah only the local "Administrator" account we have can login. We have had students try to change this Admin password but they can't get into CMD as we have disabled it and we had one person run their own script to do it but nada - because they tried to restart to login to Admin in safe mode but Deepfreeze had kicked in by then and reverted the changes. We only have 2 local accounts thats Guest and Administrator - Guest is disabled completely, and the Admin account has a really long password
gjdb Posted March 16, 2011 Posted March 16, 2011 Atm, I am testing LanSchool and I came across this topic, so I wanted to sort this out first before going any further. And I came up with a whole other approach. I have copied the registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanSchoolStudent to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LanSchoolStudent By doing this, LanSchool will also run in Safe Mode with Network enable and the students can still be watched. I am 99.9% sure this can be done for all other remote tools, like AbControl, Netop, Vnc etc.
kennysarmy Posted March 16, 2011 Posted March 16, 2011 See the post below. You need to delete a few more registry keys... http://www.edugeek.net/forums/windows/72617-kids-messing-dos-prompt-after-f8-safe-mode-networking.html#post647516 Working now
kennysarmy Posted March 16, 2011 Posted March 16, 2011 Spoke too soon..... The pupils now tell me they can still press F8 and then choose "Directory Services Restore Mode" This boots to safe mode on our win7 test pc's and the keyboard and mouse WORK AGAIN Any ideas?
mac_shinobi Posted March 16, 2011 Posted March 16, 2011 (edited) An edited version of NTLDR : Safe boot menu (F8 key) during NTLDR - Sysinternals Forums - Page 1 Disable F8 on startup - microsoft.public.win2000.security | Google Groups Usual Warnings / cautions apply Which is also mentioned on the previous pages :-S Edited March 16, 2011 by mac_shinobi
kennysarmy Posted March 16, 2011 Posted March 16, 2011 I think we are just going to purchse NOSafeMode – The LEGAL and ELEGANT way to disable F8 and Advanced Boot Options in Windows NT™ based Operating Systems Tested and looks easy to use...
Arthur Posted March 17, 2011 Posted March 17, 2011 NoSafeMode does look like a good solution, but there is one small caveat to be aware of. The unlock password is stored in plain text in the master boot record which means anyone can view and/or modify it with a suitable hex editor. http://i.min.us/imgS8K.png
p858snake Posted March 17, 2011 Posted March 17, 2011 ^wish the kids here just did that - there seems to be some black market for key caps in the swinton area judgung from the number that go missing on a regular basis. What I would give for keyboards where the caps cant be removed *or re-arranged* and at an affordable price! Pitty you can't get soemthing like those waterproof/washable ones incased in a proper frame so they sit correctly and have the keys moulded together instead of big spaces between them....
mac_shinobi Posted March 17, 2011 Posted March 17, 2011 (edited) Disable bootdelay ie bootdelay=0 How do I decrease the boot delay? This used to be the way in windows 9x using the msdos.sys file + notepad and adding the bootdelay command would be good to know how nosafemode achieves the disabling of the F8 key or F keys in general if you re map the scan codes for the relevant F keys would that make any difference : http://vlaurie.com/computers2/Articles/remap-keyboard.htm Edited March 17, 2011 by mac_shinobi
Arthur Posted March 17, 2011 Posted March 17, 2011 Disable bootdelay In Windows Vista & 7, you can disable the boot menu entirely with bcdedit /set {bootmgr} displaybootmenu no. However, I haven't had a chance to see if this disables F8 too - it might. would be good to know how nosafemode achieves the disabling of the F8 key or F keys in general I should have mentioned in my previous post that NoSafeMode also adds some code to the MBR (at the offsets below). I think it is this which does the actual disabling of the keys. 0x1b=27 to 0x8b=139 (113 bytes) 0x8d=141 to 0x93=147 (7 bytes) If you remap the scan codes for the relevant F keys would that make any difference. Unfortunately not. It would happen too late in the boot process. 3
sukh Posted March 17, 2011 Posted March 17, 2011 Hi You may be able to achieve this on Win 7 (certain editions and if the hardware requirements are met). Read BitLocker Drive Encryption Technical Overview Recovery password The recovery password is a 48-digit, randomly-generated number that can be created during BitLocker setup. If the computer enters recovery mode, the user will be prompted to type this password using the function keys (F0 through F9). The recovery password can be managed and copied after BitLocker is enabled. Using the BitLocker control panel, the recovery password can be printed or saved to a file for future use. Sukh
kennysarmy Posted March 17, 2011 Posted March 17, 2011 I should have mentioned in my previous post that NoSafeMode also adds some code to the MBR (at the offsets below). I think it is this which does the actual disabling of the keys. 0x1b=27 to 0x8b=139 (113 bytes) 0x8d=141 to 0x93=147 (7 bytes) ( Can I ask what file this is in and what app you used to open the file? Cheers
mac_shinobi Posted March 17, 2011 Posted March 17, 2011 Can I ask what file this is in and what app you used to open the file? Cheers MBR ( Master Boot Record ) on the hard drive itself and viewed / edited it using a hex editor afaik hex editor - Google Search
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now