Putting Staff Laptops Onto Domain

[pritchardavid]

How many of you have staff laptops on the domain?

 

Thinking maybe this would be the best bet.

 

The school now want us to put impero onto staff laptops, for esafey

 

Now putting this on staff laptops, will require us to keep the latest version installed, which we normally do through active directory, using a msi.

 

Defo needs to stay update, because we are using version 3, we at the moment is in devlopment at release candiate.

 

 

Now that advantages of putting the laptops on the domain is good

 

- wsus will work on, so the laptops 'SHOULD' say update

- can deploy the newest flash, shockwave, adobe reader, java , impero, smartbord, interwrite, anything msi

- can get the staff work backup, using offline files to their netowork folder?, has none of them backup

 

Disavantages

 

 

- when we deploy newer versions, staff will have to wait for it to all install

- when the wsus updates the laptop, teacher may have to restart there laptop

 

both advantage and disavantage

 

- Staff has restrictions what they can do with active directory, so they will not be able to install any software without us installing it for them, so they cant install alot of rubbish on their laptop, which may cause us more work, which also mean if they can logon to there laptop at home, they can unselect the proxy settings, which mean they c ant get on the internet

 

 

Not sure stuff

 

How will the teacher be able to logon to the laptop at home?

Currentlly staff and students have mantory profiles, which are set to remove when they logoff, to stop the annpoying, cant load profile service error when they logon (Only set this for windows 7 atm)

Edited May 15, 2010 by pritchardavid

[featured_spectre]

I DONT have them on the domain for the fact that they get annoyed when they go home and have no access to H:\ and U:\ etc.

 

However I am going to change that when I get my new Staff server!

[sted]

you could always make the pc a domain member but create a local profile and block network logon so staff cant get to their network user area (or can if you map it on the local profile)

[p858snake]

You could do cache profiles so they logon with out being connected (might need to do some loopback and inheritance rules for that).

 

For the software installation being both a disadvantage and advantage, if you wanted you could use restricted groups and make them local admins of their machines. As for the proxy, there is a few proxy switching apps floating around as well (or you could convert them to firefox, or set your servers to give it out automatically with dhcp requests so you don't need to define it).

 

You should be able to tell the local update service to get the updates then not to install them till the system is shutdown/restart and then if they are done regularly enough there won't be many to apply when they do so it won't take that long.

 

Also as a bonus tip, if you have a habit of teachers leaving their laptops at home, you could set up a key server and make the machines request the keys every so often (say 30 days, so once a month).

[Kipling]

Had the same problem a few years ago and after trying a few different ways (switching to roaming profiles for staff etc) settled on making staff laptops dual-boot.

 

There are two installs of XP on each laptop, one on the domain to use at school (which gets updates etc) and the other one not on the domain but frozen, which teachers use at home. Neither partition can access/see the other and documents are synchronised via a third partition. It works well and the laptops don’t cause us half the work they used to.

[Little-Miss]

I have a local login and domain login. I don't know if im gonna keep it that way though.....i cant decide.

[pritchardavid]

I DONT have them on the domain for the fact that they get annoyed when they go home and have no access to H:\ and U:\ etc.

 

However I am going to change that when I get my new Staff server!

 

 

New staff sever?

 

What that extually gonna do then?

 

 

Some intresting ideas there, have to talk to the boss about getting the laptops on the domain, see what he thinks

 

Maybe let them have a local admin account or a restricted one, with maybe some local group policy restrictions (can these restrictions be copied easy to other computers?), and also the laptop would be mapped with there network drive which is also offline, so there files are backup on our server

 

(No teachers are doing backups, it it has become a problem, of some losing work now, hense one of our secience teacher lost all there work because the hard drive went fault, and we have tried every way to get the work back, but its impossible)

 

But on windows 7, I dont know how to back the logon screen to default to a local account, is that possible (Know it was on windows xp, because I have done that before)

Edited May 16, 2010 by pritchardavid

[glennda]

I would personally keep them off the domain. You can then just have an image that any problems you just reimage. I would then setup a systems like we have been discussing here for little miss and remote access. They can then securely use your systems inside school without the need for data to be taken out of school.

[sted]

New staff sever?

 

What that extually gonna do then?

 

 

Some intresting ideas there, have to talk to the boss about getting the laptops on the domain, see what he thinks

 

Maybe let them have a local admin account or a restricted one, with maybe some local group policy restrictions (can these restrictions be copied easy to other computers?), and also the laptop would be mapped with there network drive which is also offline, so there files are backup on our server

 

(No teachers are doing backups, it it has become a problem, of some losing work now, hense one of our secience teacher lost all there work because the hard drive went fault, and we have tried every way to get the work back, but its impossible)

 

But on windows 7, I dont know how to back the logon screen to default to a local account, is that possible (Know it was on windows xp, because I have done that before)

 

edit the local gpo computer config\admin templates\system\logon assign a default domain for logon and input the pc name. though im wondering if you could put localhost or something there

[witch]

In one school they are on the domain since last summer - they log on exactly the same at home and everything synchronises when they log back on to the domain. We used to have a lot of problems with staff losing their work, loading their laptops with absolute rubbish and putting all sorts of odd software on - but now they don't have the permissions to do it. I thought there would be screams of anguish but no, I have had almost no issues at all.

In the other school, they have the choice of being on the domain or not and so I still have the issues with losing work when hard drives go, or they delete stuff, but slowly they are learning that if they log on to the domain, their work is a lot safer!

[Domino]

I've always had staff laptops on the domain - subject to the same restrictions and policies as their desktops (with the exception of redirected start menus/desktop/etc)

 

That means no installing software, no admin privileges and all the locks they're used to.

 

Was incredibly unpopular to begin with, but once people understood the reasoning it was fine - a few actually commented about how they stayed quick for much longer than when they had full control (funny that...)

 

I don't think there's any reason for them to be installing their own software - you never know where it comes from our what it does, so how can you stay secure and licence compliant?

[featured_spectre]

Staff are on Windows 7, New staff server will be 2008R2...currently its 2003R2, so I cant apply proper GPOs without serious editing, and I cant add mandatory profiles etc (which is really going to annoy the staff!!!!).

 

We will be keeping the old one for SIMS and file storage only

Edited May 16, 2010 by featured_spectre

[jsnetman]

Its very easy really. You join them to the domain but you don't heavily restrict them in any way (Machine OU using GP loopback processing). You do Mydocs folder redirection and use a local profile and by default when they go home they still have access to their mapped home drive albeit by synchronization. One problem might be proxy settings but if you have your network setup to automatically apply proxy settings via dhcp and dns then when they go home they will get internet access whatever ISP they have. Group policy processing also plays a role here as you don't want the user logging onto a PC within school with the same relaxed policy.

[pritchardavid]

Ok know this thread is old

 

But just started to do some work on this (Totally forgot about trying this out)

 

 

Ok what I have done

 

 

Had a vista teacher's laptop that had to be reloading due to some problems

 

Imaged the laptop with windows 7

 

On the image I have a local man profile

 

I have blocked the staff laptop OU that I just created, so it doesnt get any other policy

 

Staff still have their restructions they have on desktop (basiclly nearly the same has students)

 

Profile will be cached on the laptop

 

Setup the offline files:

 

Administratively assigned offline files - Enabled, set to mapped 'O:\' Network Drive

 

Allow or Disallow use of the Offline Files feature - Enabled

 

 

Anything I missed out here?

 

Staff cant get to control panel, has I blocked this, anyway they can get to the sync panel to check, or do you think that is not needed?

 

 

I like the idea of making then you remote desktop to the school (we have that running anyway)

 

Only thing I'm thinking is that what about if some of the staff dont have Internet at home or their Internet goes down and they cant do work because of that

 

 

 

Ok some questions

 

 

When they get home will they still have all the restrictions that was set from group policy? Is all the setting saved/cached in the profile?

Also what about the mapped drive?

 

Or will I have to find the registry keys and set them to load when they log in?

 

 

 

Suppose I best set up a laptop and bring it home to complety test it out

[SYNACK]

@p-dave - use unc paths instead as these stick much better becaues they don't rely on the mapping being established before sync.

 

They should still be able to get to the sync pannel by rightclicking the systemtray icon or using Windows key + X then selecting sync center.

 

The policy should still be applied even if offline and cached.

 

You could look at DirectAccess if you are up for setting it up then the staff would be connected even while at home.

[pritchardavid]

now thats a good idea, totally forgot about direct access (also forgot what it done, just had a look at it through)