Computer lockdown policy

[e-class]

Hi

 

Am building a brand new domain and was wondering how much everyone locks down their PCs.

Anyone willing to share their AD group policy settings for me to use as a starting point?

 

Thanks

[phreak]

I used to use the Ranger lockdown policy as a template. A few things you might consider.

 

Disable control panel, disable right click on desktop, disable command prompt.

 

Ideally you want to give the users only the access they need to do what they need to do so for instance students would be restricted users. No install rights.

Also, roaming profiles are a good idea purely because then they don't need any write access to the local machine as they save any work to their folder on the network, plus it's easier for backing up purposes.

 

Sorry as I haven't had to do one of these in a while so can't remember everything, but hopefully that gives you a starting point.

[zlorimer]

Least rights possible

[biz]

Roaming profiles are a good idea.

 

For staff we restrict access to Add/Remove Programs, disable right click on the Start menu, turn off the Run button and not much else - what's the point?

[alttab]

i would say folder redirection with offline files is a better idea these days than roaming profiles.

 

admin rights for staff is probably not necessary these days, staff may throw their arms up - but overall AUP policies apply to them just as much as to those

who you'd expect to lock down. I found it to have been a bugbear when nasties like confiker were still loitering around a network, all the work done to try and keep machines up to date undone by not having complexity requirements for domain passwords AND giving users with common passwords local admin rights. So why bother unless you desperately need those badly written scripts and apps that upset the applecart.