Macro and VBA functions

[randle]

What are peoples general opinions about allowing students usage of Macro and VBA functions?

 

these are disabled by default on CC3 for an RM Standard usertype but know that our ICT teachers at some point will need these enabled when teaching students how to make/use these. I know custom usertypes can be created and allocated to selected year groups to allow this but would like to know if this is highly ill-advised

[NetworkGeezer]

Even if VBA is enable they should still be running with Windows restricted user rights. This means that NTFS ang reg permissions will stop them from doing any real damage.

 

I'll have to check but I think they also can't undo group policies either.

 

With AV and a good web filtering solution in place there won't much opportunity for doing anything l33t.

[webman]

We have CC3, and for the term(s) when pupils need to run macros we ask for a class list and just bump them up to Advanced users. When they've finished we just put them back to Restricted.

[randle]

That was the solution really but i wanted to stay away from the changing of usertype as i'd just forget to revoke these permissions knowing me.

[MkII]

We had a problem today with a kid that had made up a word document with a web browser built in. How _do_ you disable macro's anyway?

[Gatt]

My Office 2k3 build has macros's disabled which I am glad about cos i don't trust them here not to abuse them

 

Recently had to disabled pen drives for Year 09's due to them embedding Flash games inside Excel Spreadsheetss and copying them to their home drives (since .xls is allowed, but .swf files aren't - tho if SLT get their way I'll have to open up SWF so the kiddies can to FLASH )

[glensc]

That was the solution really but i wanted to stay away from the changing of usertype as i'd just forget to revoke these permissions knowing me.

 

Rather than bump the user type up to advanced, I copied the standard type and just added alow macros to that. Still a change of user type but only adds the minimal extra rights, so not quite as important if I forget ( or more likely don't get told they no longer need them ) to change back.

[randle]

Rather than bump the user type up to advanced, I copied the standard type and just added alow macros to that. Still a change of user type but only adds the minimal extra rights, so not quite as important if I forget ( or more likely don't get told they no longer need them ) to change back.

 

This is what i've done but still don't like the idea of allowing this seeing as the extra rights can be quite harmful in the hands of a clever student who can easily show other students once he realises the opportunity is there.

 

How _do_ you disable macro's anyway?

 

You can do this via a GPO. RM have a custom one for this but if you know how to write adm template files, you can create this yourself

[MkII]

 

How _do_ you disable macro's anyway?

 

You can do this via a GPO. RM have a custom one for this but if you know how to write adm template files, you can create this yourself

 

Nope

[ITWombat]

Recently had to disabled pen drives for Year 09's due to them embedding Flash games inside Excel Spreadsheetss and copying them to their home drives (since .xls is allowed, but .swf files aren't - tho if SLT get their way I'll have to open up SWF so the kiddies can to FLASH )

 

Actually, all Office files with embedded flash games have the word shockwaveflash written in clear text somewhere. I imagine it wouldn't take much to create a grep and squish script.. Add a bit of logging for evidence and run after the nightly backup.

 

Things will hopefully get easier once the world decides on an XML format for office documents.

 

Does anybody if it is possible to create custom AV signatures for this kind of thing. As Clam is opensource does this run to their sigs?

[randle]

 

How _do_ you disable macro's anyway?

 

You can do this via a GPO. RM have a custom one for this but if you know how to write adm template files, you can create this yourself

 

Nope

 

I think Microsoft may have some adm templates on their site to help with this or just try a google