removing kids wallpapers

[goodhead]

we setup in GP the settings to push out a blank wallpaper, so that it would remove there pics of britney spears and fast cars etc.

 

I tested this out on my server at home and it worked ok.

 

The policy was applied to the students OU. I still see kids with stupid wallpapers.

 

What are we doing wrong?

[Jake]

Is it holding their wallpapers? Or is it reverting to the blank wallpaper when they log in, and they are changing it to their stupid wallpapers for that session?

[timbo343]

We had this problem ages ago, all i did in GP was create the blue background and then set it as the default active desktop, removed desktop icons and the option to add any pic to their desktop, works a treat.

[goodhead]

Is it holding their wallpapers? Or is it reverting to the blank wallpaper when they log in, and they are changing it to their stupid wallpapers for that session?

 

I set the GP so that any refference to setting as wallpaper, was removed.

They still must be find a way.

Maybe they are setting them again after the policy has removed it. I think the policy isn't actually doing any think.

[goodhead]

We had this problem ages ago, all i did in GP was create the blue background and then set it as the default active desktop, removed desktop icons and the option to add any pic to their desktop, works a treat.

 

does it matter what size the bmp is?

 

Perhaps i need to check what i've set in GP

 

exactly what GP settings did you use?

[GrumbleDook]

The policy is probably doing an 'apply once' setting ... so that if there is a picture it removes it.

 

By setting up a desktop background it changes it to 'apply always' ... forcing it to accept the setting and replace any desktop background with the one you specify.

 

This is what Jake does.

 

Since we have a mandatory profile and remove local profiles on a regular basis (shutdown script) we don't have this problem too much.

[goodhead]

The policy is probably doing an 'apply once' setting ... so that if there is a picture it removes it.

 

By setting up a desktop background it changes it to 'apply always' ... forcing it to accept the setting and replace any desktop background with the one you specify.

 

This is what Jake does.

 

Since we have a mandatory profile and remove local profiles on a regular basis (shutdown script) we don't have this problem too much.

 

ok i'll try applying an actual wallaper.

Where should the wallpaper be kept?

studnets dont have access to admin shares C: D:

[timbo343]

Administrative Templateshide

Control Panelhide

Policy Setting

Prohibit access to the Control Panel

Enabled

Control Panel/Add or Remove Programshide

Policy Setting

Remove Add or Remove Programs

Enabled

Control Panel/Displayhide

Policy Setting

Prevent changing wallpaper

Enabled

Remove Display in Control Panel

Enabled

Control Panel/Printershide

Policy Setting

Browse the network to find printers

Disabled

Prevent addition of printers

Enabled

Prevent deletion of printers

Enabled

Control Panel/Regional and Language Optionshide

Policy Setting

Restrict selection of Windows menus and dialogs language

Enabled

Restrict users to the following language: English

 

Desktophide

Policy Setting

Hide and disable all items on the desktop

Enabled

Prevent adding, dragging, dropping and closing the Taskbar's toolbars

Enabled

Remove the Desktop Cleanup Wizard

Enabled

Desktop/Active Desktophide

Policy Setting

Active Desktop Wallpaper

Enabled

Wallpaper Name:

Example: Using a local path: C:\windows\web\wallpaper\home.jpg

Example: Using a UNC path: \\Server\Share\Corp.jpg

Wallpaper Style: Center

 

Policy Setting

Allow only bitmapped wallpaper

Enabled

Disable Active Desktop

Disabled

Enable Active Desktop

Enabled

Allows HTML and JPEG Wallpaper

 

Policy Setting

Prohibit changes

Enabled

[timbo343]

hope you can understand that, thats our policy for the desktop setting..

[goodhead]

Administrative Templateshide

Control Panelhide

Policy Setting

Prohibit access to the Control Panel

Enabled

Control Panel/Add or Remove Programshide

Policy Setting

Remove Add or Remove Programs

Enabled

Control Panel/Displayhide

Policy Setting

Prevent changing wallpaper

Enabled

Remove Display in Control Panel

Enabled

Control Panel/Printershide

Policy Setting

Browse the network to find printers

Disabled

Prevent addition of printers

Enabled

Prevent deletion of printers

Enabled

Control Panel/Regional and Language Optionshide

Policy Setting

Restrict selection of Windows menus and dialogs language

Enabled

Restrict users to the following language: English

 

Desktophide

Policy Setting

Hide and disable all items on the desktop

Enabled

Prevent adding, dragging, dropping and closing the Taskbar's toolbars

Enabled

Remove the Desktop Cleanup Wizard

Enabled

Desktop/Active Desktophide

Policy Setting

Active Desktop Wallpaper

Enabled

Wallpaper Name:

Example: Using a local path: C:\windows\web\wallpaper\home.jpg

Example: Using a UNC path: \\Server\Share\Corp.jpg

Wallpaper Style: Center

 

Policy Setting

Allow only bitmapped wallpaper

Enabled

Disable Active Desktop

Disabled

Enable Active Desktop

Enabled

Allows HTML and JPEG Wallpaper

 

Policy Setting

Prohibit changes

Enabled

 

thanks for that. thats realy useful to compare. we'll have alook next week at our settings.

[maniac]

Silly point, but you don't run roaming profiles for your students do you? I ask because the school I work in was running roaming profiles for all the students when I first started, and this of course saves the desktop wallpaper to their profile. We had a simelar problem with the kids being able to do all sorts of stuff they shouldn't. I changed to a mandatory profile for all students about 2 weeks after I started here, and also tightened down group policy, simelar to the above, which stopped any attempts at changing wallpaper as well pluging as several other security holes.

 

We have the school logo as the backdrop here, which looks quite cool when there's an enitre room logged on.

 

Mike.

[goodhead]

Silly point, but you don't run roaming profiles for your students do you? I ask because the school I work in was running roaming profiles for all the students when I first started, and this of course saves the desktop wallpaper to their profile. We had a simelar problem with the kids being able to do all sorts of stuff they shouldn't. I changed to a mandatory profile for all students about 2 weeks after I started here, and also tightened down group policy, simelar to the above, which stopped any attempts at changing wallpaper as well pluging as several other security holes.

 

We have the school logo as the backdrop here, which looks quite cool when there's an enitre room logged on.

 

Mike.

 

we dont have roaming profiles

[timbo343]

We have really tight accounts for the kids oh and the staff... to the point where they cant run exes from their usb sticks or their userareas, they havent got profiles, they cant change anything and even the filtering is done inhouse which too is really locked down. Basically they cant do anything apart from work and browse the net. Ive got the attitude and so have the other techs that the kids are there to be tought, not to play on games and install stupid software on the machines

[Jake]

Ive got the attitude and so have the other techs that the kids are there to be tought, not to play on games and install stupid software on the machines

 

Too true, now if only the little sods would get that through their heads

[timbo343]

yep, ive even told some of the 6th formers that... and they didnt say a right lot. but best one is when you look at their machines with lan viewer and vnc, and you see them playing games, you "give them a hand" at losing then block the site in websense then refresh their IE. Obviously that the IT teachers are onto this too, they let us know when they will be letting the kids on games. Would love to see their faces.

[Jake]

If the kids at our place put as much effort into their work as they did trying to find valid proxy sites to bypass our filters, they would get decent grades.

[timbo343]

haha, ours arent as smart as that... ours just type in games into google and hope that they pop up but strangely enough... the word games is blocked in websense.

[goodhead]

yep, ive even told some of the 6th formers that... and they didnt say a right lot. but best one is when you look at their machines with lan viewer and vnc, and you see them playing games, you "give them a hand" at losing then block the site in websense then refresh their IE. Obviously that the IT teachers are onto this too, they let us know when they will be letting the kids on games. Would love to see their faces.

 

thats the attitude we should have here.

How do you stay on top of all the games. Theres so many, you could spend a lifetime just blocking them all the time.

[timbo343]

we have websense - its very very good, but very expensive at the same time, about £7,000 for 3 years for 400 clients. WE download from websense every morning with new definition files, then we add our own keywords and sites.

[goodhead]

we use Smart Reporter" by secure computing.

Its good. does the same as what yours does.

 

Its much tighter now than when it was called N2H2

[goodhead]

Administrative Templateshide

Control Panelhide

Policy Setting

Prohibit access to the Control Panel

Enabled

Control Panel/Add or Remove Programshide

Policy Setting

Remove Add or Remove Programs

Enabled

Control Panel/Displayhide

Policy Setting

Prevent changing wallpaper

Enabled

Remove Display in Control Panel

Enabled

Control Panel/Printershide

Policy Setting

Browse the network to find printers

Disabled

Prevent addition of printers

Enabled

Prevent deletion of printers

Enabled

Control Panel/Regional and Language Optionshide

Policy Setting

Restrict selection of Windows menus and dialogs language

Enabled

Restrict users to the following language: English

 

Desktophide

Policy Setting

Hide and disable all items on the desktop

Enabled

Prevent adding, dragging, dropping and closing the Taskbar's toolbars

Enabled

Remove the Desktop Cleanup Wizard

Enabled

Desktop/Active Desktophide

Policy Setting

Active Desktop Wallpaper

Enabled

Wallpaper Name:

Example: Using a local path: C:\windows\web\wallpaper\home.jpg

Example: Using a UNC path: \\Server\Share\Corp.jpg

Wallpaper Style: Center

 

Policy Setting

Allow only bitmapped wallpaper

Enabled

Disable Active Desktop

Disabled

Enable Active Desktop

Enabled

Allows HTML and JPEG Wallpaper

 

Policy Setting

Prohibit changes

Enabled

 

i've had a go at using the gpo settings you posted.

When i login as a kid i cant now apply a wallpaper. As soon as i've logged in you do see the new wallpaper kick in and replace whats there.

 

When i log off, the wallpaper that was replaced is displayed for a few seconds whilst the pc logs off.

 

How do we get rid of this?

[timbo343]

Right ok, so its working. I think the best thing to do is to wipe the machine and start again or put the image back onto the machine... but we roll out a brand new image every 6 months to computers with new updates and the background stays blue through logging in and logging off. You could always delete the local profiles that windows creates on the computer and see what that does.

[Gatt]

We use BGInfo to apply a background via a KIX scriptm, and have GP's to stop them changing them, but they still manage it via Fax & Picture viewer, and other Graphic programs.

Still found no way to stop it all together

 

@goodhead, Tim made a good suggestion about the local profiles.. what we do is run a startup script on the Comptuer PCs to run a util called DELPROF which deletes all local profiles from the machine.. This helps prevent "cached" wallpapers from appearing..

[maniac]

There is definitely a way of stopping them changing it completely, as I've achieved this on our system. Our kids used to be able to set it in picture viewer etc. but we have stopped this, only problem is I can't remember how! I'll have a look when I get in tomorrow and let you know.

 

There is also a GP setting to remove local profiles at logoff which should stop profiles being saved on the machines (you still get a directory left in documents and settings, but it will be empty) It works well for us, only time a profile gets left is if the machine is reset or switched off without the user properly logging off. It still doesn't cache any settings thou, as the next time the student logs onto the same machine, the profile gets a .001 extension to it.

 

The DELPROF utility is very good, can also be run remotely from a server pointing it at the machines using their DNS names.

[Phreadlock]

Hi hello to you all, delprof works a treat however i need to stop the students from opening paint and setting the wallpaper from there. If youi could post the details that would be geat. 8)