Stopping Pupils Access Staff PC's

[Grommit]

Hi

 

We run a 2003 / XP network with Ranger on to..

 

I want to restrict students from accessing staff PC's in the Classrooms

 

I tried Ranger React to restart a PC when a member of the student goup accesses the PC but this doesn't seem to work..

 

Is there something wrong and / or is there another system or way I can block the students,?

[kylewilliamson]

Hmm, one really crude way is in the student logon script, to look for the machine name, and then reboot it if it's a staff machine.

[contink]

Hmm, one really crude way is in the student logon script, to look for the machine name, and then reboot it if it's a staff machine.

That was my thought too...

 

Doesn't strike me as too crude though unless your staff laptops have a wide variety of names and don't follow a naming format.

[Guest kerrymoralee9280]

Can you not do something like this in the AD?

[broc]

Group policy will enable you to deny logon rights to student security groups. We have it set up to stop students logging onto staff machines, and also to stop staff logging onto curriculum laptops (to prevent them 'borrowing' them as they are better than staff laptops)

 

Assuming you have a staff computer OU and policy to match, look in Computer Configuration\windows settings\security settings\local policies\user rights assignment and update "deny access to this computer from the network" and "deny log on locally" adding the security groups you need.

 

If you don't have a staff computer OU & policy, maybe you need to consider setting one up.

[srochford]

AD allows you to specify which machines a user can log on to but not ones they can't. It's pretty crude - it's really designed for when you have specific machine/user combinations you want to enforce.

 

What's special about the staff machines that you don't want pupils to use? If it's just that there are files they shouldn't get to then make sure the NTFS permissions allow "staff" to read/write as appropriate but don't allow "users" access.

 

If the machine naming convention allows you to pick out staff machines then use that to determine that they should be removed, otherwise you can check the OU and knock off students from a staff OU machine.

[Mr_T]

Hi

 

We run a 2003 / XP network with Ranger on to..

 

I want to restrict students from accessing staff PC's in the Classrooms

 

I tried Ranger React to restart a PC when a member of the student goup accesses the PC but this doesn't seem to work..

 

Is there something wrong and / or is there another system or way I can block the students,?

 

Try setting a time delay on the Ranger react task maybe 5-10 seconds and you should then find it works.

[Grommit]

It's just hat the students log on tho the Teacher Classroom PC's and play the music .. blow the amps and speakers..

 

Please when there is a cover the students mess around with the PC..

 

As well as students fiddling with the PC's.. if they know they can logon then they wont bother going to it..

[DMcCoy]

Want to know the easy way?

 

Group policy. Computer -> Security -> Local -> User Rights -> Deny log on Locally.

 

I add the students group to this on our admin machines. There is one for terminal services too.

 

Edit. I see this has already been suggested . It works well though.

[Grommit]

Want to know the easy way?

 

Group policy. Computer -> Security -> Local -> User Rights -> Deny log on Locally.

 

I add the students group to this on our admin machines. There is one for terminal services too.

 

Edit. I see this has already been suggested . It works well though.

 

Is this via a GPO in the AD or on each machine Locally ?

[Disease]

I have applied this, created an OU for teachers machines, and created a GP with nothing in it apart from those settings, and I am still able to login with a staff account. what have I missed

[timbo343]

Have you got any policies which are overwriting this setting which may be applying higher than OU level?

[Disease]

I have 2 policies above this one which are enforced, all IT rooms, and Teacher Machines, I have a tree like this:

 

Computers OU (GPO ALL IT Rooms) Local Security setting in here disabling Auditing of Object Access This policy is Enforced

|

-----> Teachers Machine (GPO Teachers Machines) No Settings in GPO at moment This policy is Enforced

|

----------> Pe_E-Reg (GPO PE E Reg) Contains the Disable Network Access and Local Logon This policy is Enforced

Edited September 28, 2010 by Disease

[timbo343]

Hmmm,,, that should work...

 

Here is how mine is applying:

 

Domain level: "Domain" Policy: Deny logon locally - Not defined

|

---> Computer Locations OU: "Enable windows Firewall" Policy : Deny logon locally - Not defined

|

--------> Staff Machines OU: "Deny Student Logon" Policy: Deny Logon Locally - Security group PUPILS is configured in here.

 

Where yours are enforced, mine arent...

 

This could be the problem.

 

Tim

[Disease]

Indeed I do want to deny staff, I am creating an E-Registration highly locked down account, so I don't want them logging on using their account, on 4 specific machines.

[Disease]

Resolved: It was working, the problem was with the laptop I was using to test, it's failing to contact the RPC server

 

 

Actually it works sometimes on wireless connections and all the time on hardwired. Frustrating

Edited September 28, 2010 by Disease