Local TEMP profile woes !!!!

[ICTNUT]

Hi All,

 

I have just found that if a student logs onto a PC and at the right moment pulls the network cable out not only does the mandatory profile fail to load but he/she is the logged on locally with FULL access under a TEMP profile.

 

None of our user have local profiles and the deny logonlocally GPO setting has been set but windows seems to think that:

 

a) the user has part authenticated on the domain

b) the user does no have a local profile so what the heck I'll create one for them

c)i'll give them full access to the PC also.

 

Although they have bog standard user rights on the PC it does however allow them to bypass the proxy filtering we have setup which is also a pain.

 

My question is first and foremost does anyone know how to disable the temp profile from being created?? and not let them logon locally

 

Any help as always apreciated.........

[Midget]

I'd go and find the kid that worked this out, and give him a handshake followed by a clip around the ear.

[ICTNUT]

I have just been through GPO revising some of the settings and have addedd the following to the list:

 

Computer Config >> Admin Templates >> System >> User Profiles:

 

Delete Cached Copies of roaming profiles (Enabled) also use delprof

(NEW) Wait for remote user profile (enabled)

(NEW) Log user off when roaming profile fails (enabled)

 

I am going to wait for GPO ito update across the doamin and then try it with our test users, i'll let you know how it goes.

[ChrisH]

If your using local default profiles and not one in the netlogon then theres a post on this subject somewhere, where people put a script in the startup section to log people off if that profile was used. I also think the "wait for network" setting should help as well.

 

As for bypassing the filtering you should have your firewall set to only allow your filter access to the internet or other similar rule.

[Guest Guest]

If that dont work i vagly remember someone saying "Interactive logons...."

 

 

Have a look for that and post back as we have the same problem (but it doesnt realy matter to us as we dont have the default gateway in so they have nothing to gain by doing this...)

[plock]

My god, what time they have on their hands!

 

I'm going to give this a shot tomorrow in work! It'll be interesting to see what our GPO's are set too.

 

I'll give you some feedback depending on the outcome.

[ajbritton]

According to an MS 70-270 exam, the way to prevent users logging on whilst disconnected from the network is to set the 'cached logon count' to 0. That in combination with the 'logoff when roaming profile fails' should do the trick.

[ICTNUT]

@ajbritton

 

You are correct, I went back to basics last night and did some testing on a VMServer I have and this worked.

 

I have put this in place this morning and will again test this afternoon.

[ICTNUT]

It would seem that if you pull the NIC cable out before you logon then the cached logon count setting works however seeing as the kids are waiting for logon and then just before the profile is brought down then they pull the cable, wait for the profile error message, then put the cable back in this setting does nothing.

 

The corrupt policy setting also does not work as the profile is not being classed as corrupt just "not available"

 

This is becoming a pain in the a$£* to sort out.....

[plexer]

How about some classroom control and the kids doing this being severly disciplined as they should not be messing about with cables?

 

Not everything needs a technological solution.

 

Ben

[ajbritton]

Assuming students are working from a single mandatory profile, then you could cache it on the PC. Get a Startup Script to copy the profile down to somewhere like C:\Profiles\Students. Configure the user accounts to get their profile from C:\Profiles\Students. Obviously you will need to set the appropriate security on C:\Profiles\Students so that the students cannot mess with the files. It might even improve logon times. If you use Robocopy in the Startup Script, then even if the profile is large, it will only have to be downloaded once.

[alonebfg]

also set the local gpo to proxy then even if the do get to the local profile they will be forced to use the set proxy. If not do what i did and set the local profile proxy to stop and port to 0 and then they will have no internet access.(lol) if i rember righty a friend in a business set a sever iis and then set up a site and if someone tried to access the web via a local profile it bought up a error on event log so he also found out who it was so after finding out how the did it he told the boss got them sacked. will try find out how he did it if you like.

[ICTNUT]

@alonebfg:

 

How/where have you set the local proxy GPO to nothing (this is ideally what I need to do)

 

Have you done this locally on each PC?? (we have 600 of them)

 

Or have you done this via GPO?? (if so we have a GPO policy for proxy setup but as they are pulling the NIC cables out the GPO settings are NOT being applied.....

[ChrisH]

As I said earlier you need to configure your router/firewall to allow only your proxy to the internet and not allow them to circumvent it.

[ICTNUT]

@ ChrisH:

 

Have setup a rule in ISA to allow HTTP:HTTPS:FTP outbound access ONLY from our content filter and this works so that has solved that issue.

 

Also have put in place GPO's so that is profile is partially downloaded the user is auto logged off, this also works, have forced proxy settings on a per machine basis instead of per user although this does not really matter due to the ISA rules.

 

Local profiles are killed off each time the PC's start and in combination with cached logons set to 0 this stops that method of entry.

 

So the only thing left and between you and me might take some doing, if you allow the profile to load up to the point that the background on the desktop changes and then pull the NIC cable out this kills GPO from coming down.

 

As users are logged on with mere user rights there is not much they can do BUT they can trash the PC which is just a pain for me so how to stop this??

 

Answers on a postcard to the usual address.........

[ChrisH]

I remember a post somewhere a while ago about people saying if there was an equivalent to a *nix ifup ifdown script. Basically you want an app that can detect if a network cable is unplugged etc. Given your past contributions on the progamming front do you think you could knock up some kind of service to that effect if one does not exist?

[plexer]

Trouble is Chris he says they pull it out at the right point and then plug it in I suppose that if this script/service was continually checking for the presence of an active connection then it might work.

 

I still think a big stick with the relevant kids would work better.

 

Ben

[ICTNUT]

@ChrisH:

 

I guess I could but I don't really see the benefit in this case.

 

as I have said in a previous post the main thing was preventing the bypass of our Bloxx content filter, this has been newly installed as has ISA 2004 as before we had a smoothwall / dans guardian solution, this has been accomplished so all I want to do now is stop them from getting access to the PC itself.

 

the thing is you can only lock a PC down so much, with the only true way is preventing all kids from using them in the first place but we all know we can't do that can we (he thinks quietly to hiimself !!!)

[ChrisH]

I was thinking along the lines of if netwok cable unplugged plus other conditions then log off etc.

[ajbritton]

@ICTNUT: Any reason why my idea of a locally cached mandatory profile would be no good for you? Maybe you're using individual roaming profiles?

[ajbritton]

Another thought; Assuming temporary profiles are based on the local Default User profile, then all you need to do is create a locked down profile and distribute it to all PCs (eg using Startup script). No point it making it mandatory as temporary profiles will be deleted at logoff. You could set the desktop to be bright red to make it very obvious to teaching staff what is going on.

[alonebfg]

i had another thought i dont know if it can be done but i am sure i have seen it somewhere that you can set a gpo that if loses network it loggs off i am sure it is a script but i will have to find out.

[SpuffMonkey]

Hi

 

Did anyone get a proper resolution to this pulling out of the network cables? We're having a big problem with it at the moment.

[NetworkGeezer]

As users are logged on with mere user rights there is not much they can do BUT they can trash the PC which is just a pain for me

 

How can they do that if they have a restricted account?

[SpuffMonkey]

If they pull the cable at the right time (ie after the mandatory profile has gone down, but before the rest of the login completes) they are able to login locally and appear to get full control of the PC - any working resolutions to this would be very much appreciated...