GPO deployment advice needed

[projector1]

the school currently has a two domians

one for admin

one for circullum

the circ domian is setup with a 2000 server set up as an AD server

GPO's were setup well before i arrived.

they are structured as follows

in an ou called C USERS

you have and ou for

-staff

-pupils

-admins

each one has a policy applied to it to lock down and removed access to the key elements such as control panel

 

All the workstations are located in a ou that has a workstation policy applied to it.

 

Now this is where i need some advice.

We have purchased a batch of pcs (30)

 

i have setup one of these pcs as a test.

i have created an ou for it called music wkn and moved the pc into it.

I then created a test user who i then dumped in an a new ou called

circ users. I have setup GPOs called lockdown to restrict access to various settings.

 

The current machines have network management software installed. In order to save the school some money and also further and develop my knowledge i want to have pcs that are managed directly rather than through the network managment software.

 

As all the users are in the ou's under the C USERS, unless i move them manually to the lockdown gpo each time they have a lesson in the music centre, when the users log on they will not get my set policies apply.

 

The network management software uses an interface for the users to access the resources such as drives and software. This means that they have no access to the program start menu and desktop. I could enable the restrictions but, do not want to.

 

The policies are old and do contain legacy info.

 

many thanks

(donated my 25 quid thanks to fantastic help given in the past)

[john]

I have my users having a standard set GP for them so all students have 1 GP and the workstations have different ones. Would this not work for your system, so you put the students in the pupils OU and then make a new workstations one and make a new GP for those machines?

[projector1]

update i managed to solve it

 

I used a feature called loopback policy in replace mode. This way the gpos meant for the user are totally ignored.

i got the loopback info from the mark minasi GROUP POLICY, PROFILES, AND INTELLIMORROR BOOK