Local TEMP profile woes !!!!

[ajbritton]

Make the profile 'super-mandatory' by renaming the actual profile folder with a .MAN extension. Read all about it

[jcook117]

Our students have gotten wise to this trick over the past couple of days. I set the GPO settings as indicated above but they are not working as expected.

 

As a temporary solution I added this vbs script to the local computer and added it to run at system logon. The script checks, after 30 seconds, to see if the students home drive (in our case U: ) and another network drive common to all students (O: ) exists. If not, the user gets logged off.

 

It should work until I can straighten out the GPO issues.

 

I also have a meeting with the principal and a student who broke the tab on a network cable trying to get it back in. The tab got jammed in the computer's nic and bent one of the contacts. I was able to get it straightened out but do not have much time to deal with hardware damage. I am going for a combined approach of tech and some discipline.

 

VBS script:

 

'check for unplugged network cord during logon

'checks for mapped drives

'merge registry key to run

'| Windows Registry Editor Version 5.00

'| [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

'| "check-home-dir"="\"C:\\WINDOWS\\check-home-dir.vbs\""

'copy this vbs file to c:\windows directory

'John Cook - 03/2007

 

Set WshShell = WScript.CreateObject("WScript.Shell")

Set WshNetwork = WScript.CreateObject("WScript.Network")

Set ObjFSO = CreateObject("Scripting.FileSystemObject")

 

WScript.Sleep 30000 ' thirty seconds

 

If ObjFSO.DriveExists("U:") Then

If ObjFSO.DriveExists("O:") Then

Else

WshShell.Run "logoff.exe"

End If

Else

WshShell.Run "logoff.exe"

End If

[NetworkGeezer]

If they pull the cable at the right time (ie after the mandatory profile has gone down, but before the rest of the login completes) they are able to login locally and appear to get full control of the PC - any working resolutions to this would be very much appreciated...

 

You mean the GPOs are not applied to their session? They can't get admin rights just by pulling the wire out? Now that would be one MS botch up too far!

[zag]

Hmm same problem here, but its more of an annoyance than any damage coming from it. Basically have to delete their profile from the server each time it happens.

 

Biggest problem is its not just cables, we don't let the kids touch them, its when they log on over wireless and loose the connection.

 

I will look at those GPO settings, but creating a locked down default profile seems the most sensible option.

 

EDIT: does anyone know if enabling "prevent roaming profile changes propergating to the server" in GPO would fix this or should be enabled? Will that mean they cant save any favourites in IE?

[Geoff]

I think the best way to deal with this would be a VBS script that runs at system startup and sits in a loop. If it checks which network cards are connected at startup then subsequently checks the connectivity of the same cards while it's sat in loop. If something gets disconnected just reboot the machine.

[ChrisH]

I think the best way to deal with this would be a VBS script that runs at system startup and sits in a loop. If it checks which network cards are connected at startup then subsequently checks the connectivity of the same cards while it's sat in loop. If something gets disconnected just reboot the machine.

 

This is exactly what I said earlier on in the thread about writing a small program to do this and have it run as a service or something. I even managed to find some code that checks if the cable is connected. I got as far as installling Vb.net but then didnt get round to writing it as I was learning as I went along.

I would say check for connectivity. If been disconnected to a gpupdate. If still disconnected put up warning box saying "This machine will be shut down blah blah" make sure the cable has been plugged in at least a minute etc etc.

[Geoff]

Well the information is avalible to WMI. Therefore you don't need to run a program. You can get all the information you need from the Win32_NetworkAdapter. The NetConnectionStatus property is key. Although enumerating though all the NetworkAdapters and checking the AdapterType and ConfigManagerErrorCode to rule out any potential interfaces that might be broken or wireless.

[ChrisH]

Your still at the mercy of scripts being run from policies etc though. Without faffing with local policies a compiled exe running as a service would be better.

[Geoff]

You can install a vbs script as a local service with Instsrv.exe from the resource kit.

[projector1]

sorry to go off the topic but

do we need any more reasons as to why this site should not be accessible to just anyone?

as well as giving us techies invaluable help, advice guidance, it also provides the kids with information on vunerabilities that they can expliot

[webman]

Some of us (Geoff included) don't believe in 'security by obscurity'

[Geoff]

Plus the fact the site would die in about 2 seconds from the onerous vetting procedure to prove that one is a 'techie' and eligible for access.

[ICTNUT]

Hi all,

 

just come back to this topic, seems like I started something here.

 

I have a solution that work for me, in addition to the GPO settings I mentioned on the first page I now have a script that runs at srart up of the PC clears down all profiles on the local pc including the default user one, creates the default user folder and then copies a mandatory profile down from the server to the default user folder on the local pc.

 

Depending on the room they are in depends on the profile that comes down but this means that if a student does try to bypass and due to the profile being local it will always load the default user profile and lock the darlings down.

 

This proflie transfer happens once a day or if the PC is restarted (but as the kids don't have the option of a restart it tends to be once per day).

 

This has proved to work extremely well.

 

HTH

[chrbb]

Thought I'd latch onto this thread rather than start a new one!

 

I want to prevent xp machines logging on if the server is down or the network cable is out. We don't have a problem with kids pulling out cables but staff using them for laptops and forgetting to put them back in. I don't want this to affect the laptops so would a local policy setting to set the number of cached logons to 0 only set on the workstations solve this?

 

I use the MustbeValidated registry setting on w98 but can't find anything for xp.

[mac_shinobi]

Hi all,

 

just come back to this topic, seems like I started something here.

 

I have a solution that work for me, in addition to the GPO settings I mentioned on the first page I now have a script that runs at srart up of the PC clears down all profiles on the local pc including the default user one, creates the default user folder and then copies a mandatory profile down from the server to the default user folder on the local pc.

 

Depending on the room they are in depends on the profile that comes down but this means that if a student does try to bypass and due to the profile being local it will always load the default user profile and lock the darlings down.

 

This proflie transfer happens once a day or if the PC is restarted (but as the kids don't have the option of a restart it tends to be once per day).

 

This has proved to work extremely well.

 

HTH

 

Maybe you can do a wiki or something on the script as well as the GPO settings ?

[AyatollahPies]

I'm fashionably late to this thread.

 

Did you all manage to resolve your issues, or does this still plague you? I've just been notified of similar shenanigans at one of our sites.

[himesama]

Hi all,

 

just come back to this topic, seems like I started something here.

 

I have a solution that work for me, in addition to the GPO settings I mentioned on the first page I now have a script that runs at srart up of the PC clears down all profiles on the local pc including the default user one, creates the default user folder and then copies a mandatory profile down from the server to the default user folder on the local pc.

 

Depending on the room they are in depends on the profile that comes down but this means that if a student does try to bypass and due to the profile being local it will always load the default user profile and lock the darlings down.

 

This proflie transfer happens once a day or if the PC is restarted (but as the kids don't have the option of a restart it tends to be once per day).

 

This has proved to work extremely well.

 

HTH

 

Hi!

I've the very same problem in my school. Can you explain me step-by-step what you've done?

I'm not very skilled with scripts but I can manage to adapt yours to my environment (if you can share it with me).

We have a win2003 domain controlled and some already deployed gpo, so I think I can manage that part if you can tell me where I need to make the changes.

 

Thanks!

Edited April 30, 2011 by himesama

[himesama]

Nothing?

[ChrisH]

See here: EduLock