Locking down desktops and mandatory profiles

[SpuffMonkey]

I've got a problem. I'm using roaming profiles and its fine for when the users log in but the kiddies here are always looking for ways around the system.

 

So what they do is log in, but whilst windows displays "applying network settings" they pull out the network cable. This leads to the profile not being loaded up and them being given the default profile with full access rights to control panel etc.

 

Does anyone know how to stop that happening ?

 

Before you image your build PC - set up a user as you would want (ie restricted) and copy their ntuser.dat to the default - then anyone logging in on the default will be equally restricted.

[tarquel]

lol nice one geoff

[Pear]

Yes, that is a brilliant idea Geoff !

 

Is there a way to transfer it to every pc (only 60) quickly ?

 

This the same problem I would have with mandatory profiles. I keep changing the settings as I'm always adding new programs so once I've updated a profile I'd have to copy it to all the other machines.

[Geoff]

put the batch file on a publically accessable share (netlogin is a good one).

Write another batch file to copy the file to the local machine

test it

use psexec to run the install batch file on all your machines.

[eduabncs]

put the batch file on a publically accessable share (netlogin is a good one).

Write another batch file to copy the file to the local machine

test it

use psexec to run the install batch file on all your machines.

 

Then sit back and watch the fun!

[MuppetQueen]

I inherited a roaming profiles system from my predecessor and would love to go mandatory. However, am I right in thinking that when the students write macros in Microsoft Office they are stored in their profile? Would mandatory profiles mean that students couldn't save their macros? Also many students have loads of work saved to their desktop so it would be difficult to implement a new system now.

 

Has anyone been in my situation where there is already a system in place? Have you managed to change it? Any tips?

[Geoff]

Macros are stored in the document. You could use folder redirection to maintain a writeable desktop. Its something I do here for staff.

[MikeR]

Hi!

 

Thought I'd ask here. I must install new software for 2 classrooms (namely Frontpage for both and Photoshop for other). We have a mandatory profile for all users.

 

So what I must do, is to copy the user profile to a new share (and rename ntuser.man to .dat) and login the test user from the classroom where I install both packages and make all the settings to both programs and copy shortcuts for all users. Then make a backup from the old profile and copy the new one over the original and rename .dat to .man. I wanna make sure that it doesn't matter if I create settings for software that doesn't exist in another classroom (I'm pretty sure it won't).

 

Is this procedure correct? And can I do the copying from Windows Explorer on the server?

[MkII]

@MikeR

 

Check out AJB's walkthrough here

[MikeR]

Thanks mark!

 

First classroom went fine, I'll try the other one later.

[MrLudwig]

Hi,

 

Ric_ mentioned a setting to prevent logon if the GPO settings are not applied. Can anyone tell me where this setting is? I've looked through the MS Policy spreadsheet and various Google searches, but can't seem to find it anywhere.

 

Mandatory profiles are preferable over roaming, as long as the GPO's are applied every time. My problem is that this is not always the case. Occasionally I've had students logged on without any policies!

 

 

Thanks,

 

 

MrLudwig

[Ric_]

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/Operations/dfe7b84d-8727-4561-9767-ccb47a5bf9ba.mspx may help you