adamyoung Posted June 15, 2006 Posted June 15, 2006 Does anyone use some software that undoes any changes to a local machine's hard drive on reboot? Preferably freeware (as always!) For winNT
OutToLunch Posted June 15, 2006 Posted June 15, 2006 You could have a look at the Shared Computer Toolkit - http://www.microsoft.com/windowsxp/sharedaccess/overview.mspx I haven't had a chance to play properly with it yet, but the features are quoted as Defend shared computers from unauthorized changes to the hard disk Defend Unauthorized changes to a hard disk can make shared computers less reliable. Windows Disk Protection helps to prevent users, viruses, spyware, or other programs from making permanent changes to the hard disk by clearing changes each time the computer restarts. Because certain changes, such as critical updates and antivirus signatures, need to be permanently saved, Windows Disk Protection allows you to schedule such changes to occur automatically at whatever time you choose.
adamyoung Posted June 15, 2006 Author Posted June 15, 2006 I'm after NT, anyone know of any old utilities?
ajbritton Posted June 15, 2006 Posted June 15, 2006 If your disks are formatted with NTFS, then you should have a pretty good level of control over what can be written to. Do you have a problem with a particular application/folder?
NetworkGeezer Posted June 15, 2006 Posted June 15, 2006 Are you running non-Logo apps on NT which require Power User or higher access rights?
RoyG Posted June 15, 2006 Posted June 15, 2006 Reborn card! Made by Lenten Technologies in Taiwan, variously known in the past as Teacher Smart Card, PC Cure, Safekey, now Reborn card. I'm amazed that more people aren't using these devices - we have had no instances of hacked or messed-up workstations (zero, none whatsoever!) in the 7 years we've been using them. Don't bother with any policy restrictions whatsoever on the workstations, except a BIOS password. Just restart the machine and it reverts to its original state, without any imaging across the network. They are BRILLIANT!!! Check out http://www.edugeek.net/index.php?name=Forums&file=viewtopic&t=574&postdays=0&postorder=asc&start=15 for some of my previous posts on this subject. I really can't imagine running a school network without them. Details on http://www.bits.uk.com/ RoyG
MkII Posted June 15, 2006 Posted June 15, 2006 Gotta lock 'em down to stop users downloading nasty stuff to attack you - from whatever source, and prevent users getting onto your servers and general povvishness. DeepFreeze works out at about £10 per machine.
adamyoung Posted June 16, 2006 Author Posted June 16, 2006 Basically we're cheating by installing NT and then running Citrix as its easier than configuring other thin client solutions. Just wanted something to stop them messing up the setup.
CyberNerd Posted June 16, 2006 Posted June 16, 2006 Basically we're cheating by installing NT and then running Citrix as its easier than configuring other thin client solutions. Remove the disks, PXE boot the clients and run citrix apps that way. Thinstation config is only one file ! and a PXE boot rom can easily be copied to HDD if you don't have PXE NIC's
RoyG Posted June 16, 2006 Posted June 16, 2006 Gotta lock 'em down to stop users downloading nasty stuff to attack you - from whatever source, and prevent users getting onto your servers and general povvishness. DeepFreeze works out at about £10 per machine. Got to disagree on this. Your server security needs to be 100%, but there's no need at all to worry about the workstations if you have this card installed. Anyway, the little darlings are perfectly capable of bringing nasty stuff in on disc, CD or USB stick - so why worry about them downloading to a workstation? RoyG
wesleyw Posted June 16, 2006 Posted June 16, 2006 @RoyG: Mostly so that they don't trash the PCs which we then spend time fixing. But also because if the machine becomes corrupted slightly you'll get a little problem here or there and this will stop if you use Deepfreeze of course it will also fix the big problems and Viruses will not cause as many problems either and of course if combined with decent RIS or Ghost imaging you'll have cut your workload drastically! Wes
NetworkGeezer Posted June 16, 2006 Posted June 16, 2006 @Royg two things: If even if server security is a 100%, if students or other non-repsonsible users have admin access to a client PC they can use it for phishing. I hope you don't login into the machines with server or personal credentials. They will also have access to other user profiles which maybe not inline with DPA. At the very least they will be able to play games and such which also goes against the reason why they are in school in the first place.
wesleyw Posted June 16, 2006 Posted June 16, 2006 As a side point to this if you are running a Deepfreeze type piece of software and Ghost/RIS and you make sure that the servers are locked down securely then if the clients have AV and firewalls setup then locking down the PCs is optional. Discuss? Wes
RoyG Posted June 16, 2006 Posted June 16, 2006 @Royg two things: If even if server security is a 100%, if students or other non-repsonsible users have admin access to a client PC they can use it for phishing. I hope you don't login into the machines with server or personal credentials. They will also have access to other user profiles which maybe not inline with DPA. At the very least they will be able to play games and such which also goes the reason why they are in school in the first place.
NetworkGeezer Posted June 16, 2006 Posted June 16, 2006 OK I have edited the post but my central thrust still remains when kids have admin rights on a machine they own. OK you may argue that a reboot will remove any sniffers and the like but that's if the machine is always rebooted at the end of a user session. Students should only be able to run software that has been provided for them by authorised personnel. Unless Group Policies or other measures are in place the kids run whatever they like, games and/or malware.
RoyG Posted June 16, 2006 Posted June 16, 2006 Ooops! Try again! @Royg two things: If even if server security is a 100%, if students or other non-repsonsible users have admin access to a client PC they can use it for phishing. I hope you don't login into the machines with server or personal credentials. They will also have access to other user profiles which maybe not inline with DPA. Very rarely log on as admin, and if I do the computer always gets restarted - problem solved! The log-off user option is disabled so kids have to restart machines after use - that's about the only policy used. At the very least they will be able to play games and such which also goes the reason why they are in school in the first place. Games - you really could spend your entire life trying to physically prevent kids from playing games - and still fail! Block every known games .exe file? Block every known games website? The responsibility for keeping kids on task in a lesson is the teacher's. It really doesn't matter whether the gamer is using a PC, a PSP, a pack of cards or pair of dice! By all means help the teacher, but don't take sole responsibility for their class discipline! RoyG (ex-teacher!)
webman Posted June 16, 2006 Posted June 16, 2006 You simply stop pupils from running EXEs from their Work areas or %temp% in combination with a reliable web filter/firewall.
RoyG Posted June 16, 2006 Posted June 16, 2006 You simply stop pupils from running EXEs from their Work areas or %temp% Sorry - just far too crude. There are plenty of .exe files I'm more than happy for them to run, to encourage them to experiment, to encourage them to program & compile etc. etc. If you apply such a sledge-hammer approach the kids will never be onside with you and will find other less subtle ways of screwing things up! in combination with a reliable web filter/firewall. If you've found a web filter that blocks ALL games sites, let me know and I'll recommend E2BL to use it! RoyG
wesleyw Posted June 16, 2006 Posted June 16, 2006 And of course an allow this with paths as well as filename would mean you wouldn't have to keep adding new EXEs all the time to the blacklist! Wes
pmassingham Posted June 16, 2006 Posted June 16, 2006 Roy and I have chatted about these cards for some time. We are putting 380 new desktops in this summer and guess what - we can't afford the cards!! At about £30 a go, the school reckons that my time (and the technicians) is paid for, so they might as well get us to run around ghosting, RISing, securing, anti-virusing, etc. Sadly, those with the hands on the purse strings can't see how KISS can really be beneficial. So it looks like cash for a software solution to the author of the question, or thin clients (as already stated).
MkII Posted June 16, 2006 Posted June 16, 2006 You simply stop pupils from running EXEs from their Work areas or %temp% Sorry - just far too crude. There are plenty of .exe files I'm more than happy for them to run, to encourage them to experiment, to encourage them to program & compile etc. etc. If you apply such a sledge-hammer approach the kids will never be onside with you and will find other less subtle ways of screwing things up! in combination with a reliable web filter/firewall. If you've found a web filter that blocks ALL games sites, let me know and I'll recommend E2BL to use it! RoyG I like the analogy of driving a car - you will never experience the thrill of the open road whilst learning and accompanied by an instructor or other driver. I've seen a Deep Freeze setup and thought it wholly appropriate for adults. For school kids I can't see it working. Teachers being in full control of classrooms of kids is a pipe dream I think. You need to do what is reasonably possible to provide a safe working environment for your users. I know a lot of people bang on about personal freedoms and how kids should be free to experience everything - I personally thinks that's nonsense [/discuss lol]. Not that anyone here has suggested that, or that any solutions suggested don't work for you.
RoyG Posted June 16, 2006 Posted June 16, 2006 Roy and I have chatted about these cards for some time. We are putting 380 new desktops in this summer and guess what - we can't afford the cards!! At about £30 a go, the school reckons that my time (and the technicians) is paid for, so they might as well get us to run around ghosting, RISing, securing, anti-virusing, etc. Sadly, those with the hands on the purse strings can't see how KISS can really be beneficial. So it looks like cash for a software solution to the author of the question, or thin clients (as already stated). Hard luck Peter - I think the bean-counters at your school have got it badly wrong! I wish you well in the task or installing & securing such a large replacement system. I like the analogy of driving a car - you will never experience the thrill of the open road whilst learning and accompanied by an instructor or other driver. True - as long as you have a little bit of instruction first!! I've seen a Deep Freeze setup and thought it wholly appropriate for adults. For school kids I can't see it working. All I can say is that the Reborn Card system (I guess a hardware version of DeepFreeze) really does work for us. Teachers being in full control of classrooms of kids is a pipe dream I think. You need to do what is reasonably possible to provide a safe working environment for your users. Agree with you, but emphasis on "reasonable"! But I also believe that you need to do what is reasonably possible to provide as stimulating a working environment as possible, which is not strangled by excessive controls & restrictions. What's the problem with kids changing their desktops or installing Portable Firefox, or compiling and testing some VB programs etc etc ......? I know a lot of people bang on about personal freedoms and how kids should be free to experience everything - I personally thinks that's nonsense [/discuss lol]. Also agree, there are some things best not experienced at a young age, but care needs to be taken that restrictions don't also remove a bunch of valuable experiences. A balance is necessary. Final thought... By far the biggest benefit is to me! Using these cards has dramatically reduced the boring bit of my workload (fiddling with Group Policies, restoring images and so on). This academic year I have only had to do any repair or restoration work on 3 desktop machines that the kids use - 1 RAM failure and 2 HDD failures. Because the kids know how the cards work they simply don't bother any more to try to hack them. We actively encourage them to try new things, with no instances of any real hassle due to any exe files they run. The only example of problems was when some bright spark dumped a file called something like "the best game in the universe.exe" into a shared area. Anyone daft enough to run it found their home directory blitzed (easily restored from backup)! A month's ban from Computer Rooms (highly publicised!) seems to have prevented any other such tricks. I rest my case! RoyG P.S. Apologies for the long post. Have a good weekend!
ajbritton Posted June 17, 2006 Posted June 17, 2006 If you use cards that protect your PCs, what protects any laptops on the network?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now