New vanilla network for teachers, group policy

[zag]

I'm just setting up a new vanilla network and have started with a group policy for teachers. In the past I have always used a management system to make all these changes so am lost in the wastelands of GPEDIT

 

So if I want to make a policy for teachers, what settings should I change?

 

I'm thinking things like Redirecting the desktop, roaming profiles, start menus, ect.

[kmount]

Install GPMC if you don't already have it asides from gpedit.

 

By change do you have something to work with already?

 

I tend to have "Computer Settings" and "User Settings" at the simplest level for two GPOs and then only edit Computer Config stuff in computer settings, and user in users then it's a case of going right through the list and setting it up exactly how you want it.

 

Not a fan of shortcuts when it comes to this I'm afraid, it pays to read into the policies and what they are doing.

[browolf]

pretty much the only thing we use group policy for on teachers laptops is

software installs

sims access

IE settings

synchronization exclusions

[randle]

The following are some of the settings I have setup on my Vanilla network and offer a few suggestions to get you started.

 

Some may be irrelevant to you or you might want the opposite setting to apply but you get the idea

 

 User configuration>Windows Settings>Internet Explorer Maintenance>Connection
 [b]Use the settings here to configure your Internet connections on a per user basis [/b]

User configuration>administrative templates>windows components>Internet explorer
 * Turn off "Delete Browsing History" functionality - Enabled

User configuration>administrative templates>windows components>Internet explorer>Internet Control Panel>Advanced Page
 * Empty Temporary Internet Files folder when browser is closed - Enabled
 * Do not save encrypted pages to disk - Enabled  

User Configuration>Administrative Templates>Windows Components>Internet Explorer>Internet Control Panel>Security Page>Local Machine Zone
 [b]Needs to be your choice of security here[/b]

User Configuration>Administrative Templates>System
 * Prevent access to registry editing tools - Enabled - Disable regedit from running silently - No

User configuration>Windows Settings>Folder Redirection
 * Basic - Redirect everyone's folder to the same location - Redirection of My Documents on Users desktop to home dir
    Grant the user exclusive right to My Documents - Enabled
    Leave the folder in the new location when policy is removed - Enabled 

User Configuration>Administrative Templates>Desktop
 * Prohibit User from Changing "My Documents" path 
 * Remove the Desktop Cleanup Wizard
 * Remove Reycle Bin from desktop

User Configuration>Administrative Templates>Windows Components>Windows Explorer
 * Do not move deleted files to the recycle bin - Enabled

User Configuration>Administrative Templates>System>User Profiles
 * Limited user profile size to 20MB with a warning message
 * Exclude directories in roaming profile - Application Data;NetHood;Recent;PrintHood;My Documents;Templates;My Settings;Cookies;History

User Configuration>Administrative Templates>Microsoft Office Outlook 2003>Miscellaneous>PST Settings
 * Default location for PST files - [i]yourhomedirletter[/i]:\Outlook Mail\ 

User Configuration>Administrative Templates>Microsoft Office Outlook 2003>Tools|Options>Other
 * Empty Deleted Items Folder upon exiting - Enabled

User Configuration>Administrative Templates>Microsoft Office Outlook 2003>Tools|Options>Advanced
 * Minimize Outlook to the system tray

User Configuration>Administrative Templates>Microsoft Office Outlook 2003>Tools|Options>AutoArchive
 * Turn on AutoArchive - Disabled

User Configuration>Administrative Templates>Start Menu and Taskbar
 * Remove links and access to Windows Update - Enabled
 * Remove Help menu from Start Menu - Enabled

Edited November 4, 2009 by randle