goodhead Posted February 15, 2007 Posted February 15, 2007 we setup in GP the settings to push out a blank wallpaper, so that it would remove there pics of britney spears and fast cars etc. I tested this out on my server at home and it worked ok. The policy was applied to the students OU. I still see kids with stupid wallpapers. What are we doing wrong?
Jake Posted February 15, 2007 Posted February 15, 2007 Is it holding their wallpapers? Or is it reverting to the blank wallpaper when they log in, and they are changing it to their stupid wallpapers for that session?
timbo343 Posted February 15, 2007 Posted February 15, 2007 We had this problem ages ago, all i did in GP was create the blue background and then set it as the default active desktop, removed desktop icons and the option to add any pic to their desktop, works a treat.
goodhead Posted February 15, 2007 Author Posted February 15, 2007 Is it holding their wallpapers? Or is it reverting to the blank wallpaper when they log in, and they are changing it to their stupid wallpapers for that session? I set the GP so that any refference to setting as wallpaper, was removed. They still must be find a way. Maybe they are setting them again after the policy has removed it. I think the policy isn't actually doing any think.
goodhead Posted February 15, 2007 Author Posted February 15, 2007 We had this problem ages ago, all i did in GP was create the blue background and then set it as the default active desktop, removed desktop icons and the option to add any pic to their desktop, works a treat. does it matter what size the bmp is? Perhaps i need to check what i've set in GP exactly what GP settings did you use?
GrumbleDook Posted February 15, 2007 Posted February 15, 2007 The policy is probably doing an 'apply once' setting ... so that if there is a picture it removes it. By setting up a desktop background it changes it to 'apply always' ... forcing it to accept the setting and replace any desktop background with the one you specify. This is what Jake does. Since we have a mandatory profile and remove local profiles on a regular basis (shutdown script) we don't have this problem too much.
goodhead Posted February 15, 2007 Author Posted February 15, 2007 The policy is probably doing an 'apply once' setting ... so that if there is a picture it removes it. By setting up a desktop background it changes it to 'apply always' ... forcing it to accept the setting and replace any desktop background with the one you specify. This is what Jake does. Since we have a mandatory profile and remove local profiles on a regular basis (shutdown script) we don't have this problem too much. ok i'll try applying an actual wallaper. Where should the wallpaper be kept? studnets dont have access to admin shares C: D:
timbo343 Posted February 15, 2007 Posted February 15, 2007 Administrative Templateshide Control Panelhide Policy Setting Prohibit access to the Control Panel Enabled Control Panel/Add or Remove Programshide Policy Setting Remove Add or Remove Programs Enabled Control Panel/Displayhide Policy Setting Prevent changing wallpaper Enabled Remove Display in Control Panel Enabled Control Panel/Printershide Policy Setting Browse the network to find printers Disabled Prevent addition of printers Enabled Prevent deletion of printers Enabled Control Panel/Regional and Language Optionshide Policy Setting Restrict selection of Windows menus and dialogs language Enabled Restrict users to the following language: English Desktophide Policy Setting Hide and disable all items on the desktop Enabled Prevent adding, dragging, dropping and closing the Taskbar's toolbars Enabled Remove the Desktop Cleanup Wizard Enabled Desktop/Active Desktophide Policy Setting Active Desktop Wallpaper Enabled Wallpaper Name: Example: Using a local path: C:\windows\web\wallpaper\home.jpg Example: Using a UNC path: \\Server\Share\Corp.jpg Wallpaper Style: Center Policy Setting Allow only bitmapped wallpaper Enabled Disable Active Desktop Disabled Enable Active Desktop Enabled Allows HTML and JPEG Wallpaper Policy Setting Prohibit changes Enabled
timbo343 Posted February 15, 2007 Posted February 15, 2007 hope you can understand that, thats our policy for the desktop setting..
goodhead Posted February 15, 2007 Author Posted February 15, 2007 Administrative Templateshide Control Panelhide Policy Setting Prohibit access to the Control Panel Enabled Control Panel/Add or Remove Programshide Policy Setting Remove Add or Remove Programs Enabled Control Panel/Displayhide Policy Setting Prevent changing wallpaper Enabled Remove Display in Control Panel Enabled Control Panel/Printershide Policy Setting Browse the network to find printers Disabled Prevent addition of printers Enabled Prevent deletion of printers Enabled Control Panel/Regional and Language Optionshide Policy Setting Restrict selection of Windows menus and dialogs language Enabled Restrict users to the following language: English Desktophide Policy Setting Hide and disable all items on the desktop Enabled Prevent adding, dragging, dropping and closing the Taskbar's toolbars Enabled Remove the Desktop Cleanup Wizard Enabled Desktop/Active Desktophide Policy Setting Active Desktop Wallpaper Enabled Wallpaper Name: Example: Using a local path: C:\windows\web\wallpaper\home.jpg Example: Using a UNC path: \\Server\Share\Corp.jpg Wallpaper Style: Center Policy Setting Allow only bitmapped wallpaper Enabled Disable Active Desktop Disabled Enable Active Desktop Enabled Allows HTML and JPEG Wallpaper Policy Setting Prohibit changes Enabled thanks for that. thats realy useful to compare. we'll have alook next week at our settings.
maniac Posted February 15, 2007 Posted February 15, 2007 Silly point, but you don't run roaming profiles for your students do you? I ask because the school I work in was running roaming profiles for all the students when I first started, and this of course saves the desktop wallpaper to their profile. We had a simelar problem with the kids being able to do all sorts of stuff they shouldn't. I changed to a mandatory profile for all students about 2 weeks after I started here, and also tightened down group policy, simelar to the above, which stopped any attempts at changing wallpaper as well pluging as several other security holes. We have the school logo as the backdrop here, which looks quite cool when there's an enitre room logged on. Mike.
goodhead Posted February 15, 2007 Author Posted February 15, 2007 Silly point, but you don't run roaming profiles for your students do you? I ask because the school I work in was running roaming profiles for all the students when I first started, and this of course saves the desktop wallpaper to their profile. We had a simelar problem with the kids being able to do all sorts of stuff they shouldn't. I changed to a mandatory profile for all students about 2 weeks after I started here, and also tightened down group policy, simelar to the above, which stopped any attempts at changing wallpaper as well pluging as several other security holes. We have the school logo as the backdrop here, which looks quite cool when there's an enitre room logged on. Mike. we dont have roaming profiles
timbo343 Posted February 15, 2007 Posted February 15, 2007 We have really tight accounts for the kids oh and the staff... to the point where they cant run exes from their usb sticks or their userareas, they havent got profiles, they cant change anything and even the filtering is done inhouse which too is really locked down. Basically they cant do anything apart from work and browse the net. Ive got the attitude and so have the other techs that the kids are there to be tought, not to play on games and install stupid software on the machines
Jake Posted February 15, 2007 Posted February 15, 2007 Ive got the attitude and so have the other techs that the kids are there to be tought, not to play on games and install stupid software on the machines Too true, now if only the little sods would get that through their heads
timbo343 Posted February 15, 2007 Posted February 15, 2007 yep, ive even told some of the 6th formers that... and they didnt say a right lot. but best one is when you look at their machines with lan viewer and vnc, and you see them playing games, you "give them a hand" at losing then block the site in websense then refresh their IE. Obviously that the IT teachers are onto this too, they let us know when they will be letting the kids on games. Would love to see their faces.
Jake Posted February 15, 2007 Posted February 15, 2007 If the kids at our place put as much effort into their work as they did trying to find valid proxy sites to bypass our filters, they would get decent grades.
timbo343 Posted February 15, 2007 Posted February 15, 2007 haha, ours arent as smart as that... ours just type in games into google and hope that they pop up but strangely enough... the word games is blocked in websense.
goodhead Posted February 15, 2007 Author Posted February 15, 2007 yep, ive even told some of the 6th formers that... and they didnt say a right lot. but best one is when you look at their machines with lan viewer and vnc, and you see them playing games, you "give them a hand" at losing then block the site in websense then refresh their IE. Obviously that the IT teachers are onto this too, they let us know when they will be letting the kids on games. Would love to see their faces. thats the attitude we should have here. How do you stay on top of all the games. Theres so many, you could spend a lifetime just blocking them all the time.
timbo343 Posted February 15, 2007 Posted February 15, 2007 we have websense - its very very good, but very expensive at the same time, about £7,000 for 3 years for 400 clients. WE download from websense every morning with new definition files, then we add our own keywords and sites.
goodhead Posted February 15, 2007 Author Posted February 15, 2007 we use Smart Reporter" by secure computing. Its good. does the same as what yours does. Its much tighter now than when it was called N2H2
goodhead Posted February 22, 2007 Author Posted February 22, 2007 Administrative Templateshide Control Panelhide Policy Setting Prohibit access to the Control Panel Enabled Control Panel/Add or Remove Programshide Policy Setting Remove Add or Remove Programs Enabled Control Panel/Displayhide Policy Setting Prevent changing wallpaper Enabled Remove Display in Control Panel Enabled Control Panel/Printershide Policy Setting Browse the network to find printers Disabled Prevent addition of printers Enabled Prevent deletion of printers Enabled Control Panel/Regional and Language Optionshide Policy Setting Restrict selection of Windows menus and dialogs language Enabled Restrict users to the following language: English Desktophide Policy Setting Hide and disable all items on the desktop Enabled Prevent adding, dragging, dropping and closing the Taskbar's toolbars Enabled Remove the Desktop Cleanup Wizard Enabled Desktop/Active Desktophide Policy Setting Active Desktop Wallpaper Enabled Wallpaper Name: Example: Using a local path: C:\windows\web\wallpaper\home.jpg Example: Using a UNC path: \\Server\Share\Corp.jpg Wallpaper Style: Center Policy Setting Allow only bitmapped wallpaper Enabled Disable Active Desktop Disabled Enable Active Desktop Enabled Allows HTML and JPEG Wallpaper Policy Setting Prohibit changes Enabled i've had a go at using the gpo settings you posted. When i login as a kid i cant now apply a wallpaper. As soon as i've logged in you do see the new wallpaper kick in and replace whats there. When i log off, the wallpaper that was replaced is displayed for a few seconds whilst the pc logs off. How do we get rid of this?
timbo343 Posted February 22, 2007 Posted February 22, 2007 Right ok, so its working. I think the best thing to do is to wipe the machine and start again or put the image back onto the machine... but we roll out a brand new image every 6 months to computers with new updates and the background stays blue through logging in and logging off. You could always delete the local profiles that windows creates on the computer and see what that does.
Gatt Posted February 22, 2007 Posted February 22, 2007 We use BGInfo to apply a background via a KIX scriptm, and have GP's to stop them changing them, but they still manage it via Fax & Picture viewer, and other Graphic programs. Still found no way to stop it all together @goodhead, Tim made a good suggestion about the local profiles.. what we do is run a startup script on the Comptuer PCs to run a util called DELPROF which deletes all local profiles from the machine.. This helps prevent "cached" wallpapers from appearing..
maniac Posted February 22, 2007 Posted February 22, 2007 There is definitely a way of stopping them changing it completely, as I've achieved this on our system. Our kids used to be able to set it in picture viewer etc. but we have stopped this, only problem is I can't remember how! I'll have a look when I get in tomorrow and let you know. There is also a GP setting to remove local profiles at logoff which should stop profiles being saved on the machines (you still get a directory left in documents and settings, but it will be empty) It works well for us, only time a profile gets left is if the machine is reset or switched off without the user properly logging off. It still doesn't cache any settings thou, as the next time the student logs onto the same machine, the profile gets a .001 extension to it. The DELPROF utility is very good, can also be run remotely from a server pointing it at the machines using their DNS names.
Phreadlock Posted March 10, 2007 Posted March 10, 2007 Hi hello to you all, delprof works a treat however i need to stop the students from opening paint and setting the wallpaper from there. If youi could post the details that would be geat. 8)
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now