SimpleSi Posted October 8, 2011 Posted October 8, 2011 I've moved into a school that has Viglen Classlink installed and is used by the ICT Co-ord to administer the network. For those that know me, I'm used to completely un-restricted single user logon, non-domain clients and am really impressed that right click does nothing on the pupil desktops Now I'd like to not throw the baby out with the bath water (e.g turn each computer into single admin user and just use the existing server as a file server as I like the Viglen printer/file restriction management) but I'd like to completely remove any computer restrictions from all users (lets not get into the rights and wrongs of this - its what I'd like to do ) What do I need to do to make every user have full admin rights every computer? regards Simon
FN-GM Posted October 9, 2011 Posted October 9, 2011 Erm not sure with the Viglen software, never used it. But if you visit the machines and add domain users to the local admin group that will do it. By the way I know you said you didn't want this buts a really bad idea..,
Michael Posted October 9, 2011 Posted October 9, 2011 Now I'd like to not throw the baby out with the bath water (e.g turn each computer into single admin user and just use the existing server as a file server as I like the Viglen printer/file restriction management) but I'd like to completely remove any computer restrictions from all users (lets not get into the rights and wrongs of this - its what I'd like to do ) I agree with FN-GM's comment above, but I am curious how you'd manage a network like this. For example with each pupil having their own user account, this allows each child to create their own portfolio of work. With your system or idea they cannot do this. Also, if you have/had single user accounts how would you control access to sensitive data on a file server? Permissions just wouldn't be possible to setup. I guess I'm just curious why you do things the way you do, and what's wrong with using Active Directory, Group Policies and permissions on files/folders. If anything it makes things easier, especially if you manage more than one network.
SimpleSi Posted October 9, 2011 Author Posted October 9, 2011 Ok then - one more time When I started in this job in primaries a lot of the machines wern't even networked - they had 2 machines per class with a printer switch to share a printer. Things soon progressed to each machine being networked and using HP business inkjets and simply using a Win98 machine as a file/print server. ChrisH used to work for my main network supplier and had a simple setup to map different drive letters to a folder for each class - I modified this approach and wrote a simpel AutoIt GUI app to map P: drive the the appropriate class folder. I got into using WPKG to semi-automatically install software. When W2k3 servers came along (and once I'd been shown how to set one up) I just stuck to my simple method of using them as file/print servers but also took advantage of using them as DNS/DHCP servers as well. In some cases, my original Win98 servers are still running as VMs inside W2k3 servers as its saved me the trouble of renaming things And I haven't had to learn about GPOs and AD - and I NEVER get a corrupt profile Anyway -getting back to the question But if you visit the machines and add domain users to the local admin group No way of doing something centrally? Si
glennda Posted October 9, 2011 Posted October 9, 2011 No way of doing something centrally? Si Yes you can do this via group policy - How to Add domain accounts to Local Administrators Group using GPO - Richard's myITforum Blog but you might not like that.
SimpleSi Posted October 9, 2011 Author Posted October 9, 2011 I'm not GPOphobic - I'll use one if I have too Ta Si
glennda Posted October 9, 2011 Posted October 9, 2011 All classlink does (from when i used it a few years back) is to put a different front end onto Group policys (for its restrictions parts anyway)
SimpleSi Posted October 9, 2011 Author Posted October 9, 2011 Yes - I presume that's what is does as well and since its got the ability to easily assign computers to printers I don't see any point in removing it but I don't like having to logout when a user has a problem and then log back in as an admin - not when I'm only there 3 hours a week Si
plexer Posted October 9, 2011 Posted October 9, 2011 Is the school not happy with what the viglen software allows them to do then? Ben
SimpleSi Posted October 9, 2011 Author Posted October 9, 2011 Is the school not happy with what the viglen software allows them to do then? No -I'm not happy with what it stops me from doing Si
sidewinder Posted October 10, 2011 Posted October 10, 2011 (edited) We had Classlink (since removed) and the technicians group gave local admin access as far as I can remember. Can't remember there being a way to bulk add to groups in Classlink, but easy enough to do in AD. Not sure it's a great idea mind, I understand having to log out can slow things down but all the profiles on Classlink are mandatory, so it shouldn't take long to log off/on. Weighing up the chance of students with local admin access breaking something/making changes on machines I can't say its worth it. Also, I know you say you're not doing it now, but even in the future, I would really NOT recommend turning them into standalones, especially when a domain is already setup. Edited October 10, 2011 by sidewinder
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now