Network Managment of Netbooks

[Little-Miss]

The school wants to get in a trolley of netbooks and one thing my LM has asked what happens when they go on the network he wants evil Winsuite on them.

 

I dont really wanna buy more licenses for winsuite because i hate it lol. Am i right in thinking that i could just use Windows 2k3 GP's and the like to lock them down? Then that way they're safe, without Winevil and kids can log onto their network account.... right?

[plexer]

Thats correct.

 

Ben

[Little-Miss]

Great...

 

Now is there like an LEA standard set of permissions to follow, or is it whatever we deem appropriate? I had a guy in from Tempus who said that if i was to have a new server installed they would do it to LEA standard....

[Dafty]

The best thing I could suggest is to look through Becta and see if you can find any guidelines.

 

At our site we set group policies according to what we deem to be appropriate.

[K.C.Leblanc]

File permissions shouldn't need changing, they main topic you'll have to look into is Group Policy. Lots of schools now use it to lock down their workstations.

 

You however will have to forgot WinSuite's logging and auditing functions. Since the last time I did anything with WinSuite was in 2001, I don't know exactly what functionaly you'll be missing.

 

You'll also need to work out a method to only apply the group policy to the netbooks and not the whole network.

 

Do I dare ask why the head of ICT is so attached to WinSuite?

[Little-Miss]

They don't do change here....

 

Sorry, that's what i meant, policies...

 

Winsuite logs and audits?! I just use Policy Manager and the add a user function.

 

The only thing i think Winsuite does in particular is have that desktop function, where you add the program icons.

 

But i only think they'll be wanting some sort of office program on there...i wasnt planning on them being a desktop replacement yet.

[Jon]

I work mostly in primary schools, the ONLY advantage I can see of using the dreaded winsuite is that the pupils can click there name from a list to log on rather than having to type in thier username, which the younger ones would struggle with.

 

Other than that i think it sucks, you can get much better desktop security with GP and redirected desktops.

[Little-Miss]

Blimey Jon we dont even have that! I know its exist but it isnt in place here...

[button_ripple]

I would let your line manager know that WinSuite is no longer supported, you can get licences, but that is it!

 

You can do everything WinSuite does with group policies (apart from the log on thing!!)

 

We got rid of WinSuite here about 1 1/2 years ago, never looked back!

[Little-Miss]

How have you got past the XP Home upgrade? Does it not take up a chunk of HDD?

[p858snake]

You'll also need to work out a method to only apply the group policy to the netbooks and not the whole network.

From memory you create a OU group and place the computers (aka the netbooks) within and then you apply the group policy only to them.

[Ric_]

Asus Eee PCs at Egglescliffe School | Open Source Schools is an interesting read. If you followed the model used there it would save you vast amounts of money!

[Jamman960]

Correct me if I'm wrong but mixing between group policy and winsuite won't be a walk in the park, most of the restrictions will have to be applied via user group policys applied to the students OU which will take affect wherever the students logon although I guess if the same restrictions are being applied via GPO and winsuite you'll be able to remove winsuite at a later date and not notice the difference. I'm not sure whether group policy would override winsuites policys though - I've never had the misfortune of dealing with winsuite other than ripping it out to setup a new vanilla network

[Little-Miss]

Bloody thing is causing me nothing but grief!

[SYNACK]

Correct me if I'm wrong but mixing between group policy and winsuite won't be a walk in the park, most of the restrictions will have to be applied via user group policys applied to the students OU which will take affect wherever the students logon although I guess if the same restrictions are being applied via GPO and winsuite you'll be able to remove winsuite at a later date and not notice the difference. I'm not sure whether group policy would override winsuites policys though - I've never had the misfortune of dealing with winsuite other than ripping it out to setup a new vanilla network

 

You should be able to add all of the winsuite computers to a group and then use security to deny read access to the lockdown GPOs and only apply the policy if it the machine is not in the winsuite computer group.

 

As to how they coexist I can't really say but I assume that winsuite uses registry tweaks to lock down most aspects which is simmilar to group policy. Group policy however is applied at login time and so at least initially winsuite would probably override any settings that it was told to as it is probably applied later. GPOs also apply to a limited extent during background policy refreshes which happen about every 90 minutes so at this point the GP settings would probably override winsuite.

[SimpleSi]

Asus Eee PCs at Egglescliffe School | Open Source Schools is an interesting read.

 

I thought the bit about not using smb shares due to much greater network traffic was quite interesting and I wonder how true it is.

 

And for primary, saving to local machine and then uploading to a VLE would be a lot of effort for teachers/pupils - especially Y2! (unless there's some free VLE thats a lot easier to use than Moodle )

 

regards

 

Simon

[Little-Miss]

What would you do in my situation? They're pretty useless if the kids cant save anything...

[Jobos]

I’m in a similar situation in that one of my schools is using Winsuite in the ICT room but not in the classrooms and then in the ICT room it’s only the students who get the Winsuite restrictions/set desktop.

 

Due to me not wanting to install Winsuite on the new replacement server I’m going to remove Winsuite from the ICT room computers so I’m in the process of making a new GP that will redirect the desktop to a shared folder containing the icons/shortcuts and only apply this GP to students that logon to the ICT room computers using a WMI filter on the computer name. This GP will only need the desktop redirection as the other students restrictions will come from the existing default student GP that applies to students whether in the ICT room or the classrooms.

[m25man]

We had to come up with a solution that would work in the school library.

 

We decided to use a wireless laptop locked down with microsoft steady state.

 

Stripped it bare, auto login with generic accounts.

 

The kids get the bare minimum of Apps but can save to USB and can reach their home areas through the web portal/VLE.

 

We found that this method removed all of the overheads associated with Domain Group Polices, Management Software and Folder redirection.

 

The log on times are absolutely minimum meaning that anyone can pick up a laptop turn it on and be on the web in less than a minute.

The users are happy and the vandalism has been reduced to near zero.

 

If the kids have to wait 5 mins before the machines are ready there would be no keytops left and who knows what else they will do to them to kill the time!

 

Now we are going to do the same with some netbooks and Windows 7 the 5Hr battery life of the 6 cell devices together with the automatic reset of the OS by Steady State make management a thing of the past.

 

Download details: SteadyState

 

Works for us, not everybodies cup of tea but certainly in the Library but it solved our challenges.