Server 2008 build for school network - advice please

[flashsnaps]

Hi all,

 

I have been asked to build a Server for a small school with around 80students and 40staff.

I am going to build up a HP ML350 G6 with a RAID5 array and running Server2008 ENT R2

 

Main requirements for staff and students are Internet, word, excel, powerpoint, editing pictures and printing. No emails.

 

I am planning to create mandatory profiles for all students with home directories to save data. Staff will have roaming profiles with a home directory.

 

Any one got any advice on any special tweaks or configuration they have to lock down or things I should be aware of, this is the first build I have done for a school as I usually build SBS servers.

 

I have an untangle box in placed which will deal with content filtering etc.

[timzim]

What type of school? Private/state? Primary/secondary? Well-behaved/naughty students? These will all affect how you lock-down your network (although Ofsted would have us believe otherwise...).

[flashsnaps]

Private/primary school /reasonably well behaved.

[skawarrior]

Our service manager banned the use of memory sticks last year and this policy is applying to our new domain currently being built. Our old domain was CC3 so we just used the management console to remove access however this has had to be configured in the new non cc3 domain.

 

I imported this adm which should remove access to all removable storage media by disabling the drivers

HOWTO: Use Group Policy to disable USB, CD-ROM, Floppy Disk and LS-120 drivers

 

Students are encouraged to use the skydrive associated with their Live@edu accounts but when required I will manually copy work from a memory stick to student work areas.

 

At first I thought it was a bit excessive as most viruses are caught by Sophos but the knock on effect has been a huge decrease in MP3 files as they can't bring in the contents of their P2P download folders from home.

[littlehoughton]

I wouldnt personally use mandatory profiles, i have found folder redirection to be less hassle. Also I try not to use any start menu redirection as well and prefer to use group policy to lock down any settings and have uptodate images and where possible use a software deployment soloution to roll out software when needed. Roaming profiles for Staff is OK but staff will need a little instruction on the do's and dont's, if possible if it's acceptable to staff i would do a desktop redirection and lock it down forcing work to be saved to network drives. Politics in school will decide what the users want, its best you spend a day talking to them and finding out all their needs and expectations. But as a rule Roaming Profiles in large environments are a nightmare, mandatory profiles at somepoint will cause issues and present a single point of failure (in my opinion anyway!). Good Luck