Allow staff to unlock workstations logged in as a student

[FN-GM]

Hi,

 

Students are starting too locked there workstations and wonder off. This makes the next person who wants to use the computer either, A: unplug the machine or B: call us to unlock it. Stopping students locking workstations isn’t an option.

 

Is there a way to allow staff to unlock only student accounts? I cannot find how to grant standard users to unlock workstations I have had a look around delegate control but can’t find what I am looking for.

 

We are in a Server 2003 domain environment. Can anyone help me with this please?

 

Thanks

Edited May 18, 2008 by FN-Greatermanchester

[Edu-IT]

Would it not makes sense to prevent students from locking their workstations altogether?

[FN-GM]

Please read my original post

 

Stopping students locking workstations isn’t an option.

[Edu-IT]

Please read my original post

Think you may have added that while I was replying. It certainly wasn't there when I replied otherwise I wouldn't have suggested it would I? ;-)

[Michael]

If a machine is locked as a pupil and a member of staff enters their username and password, this should prompt you to logoff the user; however, any unsaved work will be lost.

[FN-GM]

Think you may have added that while I was replying. It certainly wasn't there when I replied otherwise I wouldn't have suggested it would I? ;-)

 

It was there from the beginning you can ask another forum member I am talking to on MSN. I only edited the post to bold that point you missed. If you look at the time it was edited, you will find it was edited a 4 mins after your post.

 

If a machine is locked as a pupil and a member of staff enters their username and password, this should prompt you to logoff the user; however, any unsaved work will be lost.

 

Yer that is a problem, but they normally get unplugged or we log them anyway so it will be no different to what we currently do.

[localzuk]

If a machine is locked as a pupil and a member of staff enters their username and password, this should prompt you to logoff the user; however, any unsaved work will be lost.

 

I think he wants a way of doing that. Staff accounts in most schools are not administrators...

 

Would adding them to the local administrator group on the machines do what you want? Although it does open up a security hole then.

[FN-GM]

I did think that but its not an option really.

 

Thanks for the comments

[Geoff]

How about using the 'logoff' screensaver to logoff pupils who have left their machines logged in?

[FN-GM]

Would that work if they have locked the machine?

[john]

As ever Google provides the solution - Any user can unlock now with this custom GINA That seems to offer you what you need but check the legality of it

[FN-GM]

I did find that but im looking for a more Microsoft way. I’m sure there is way of doing it. If all else fails i will try that.

[Geoff]

Would that work if they have locked the machine?

 

Yes, it will.

[FN-GM]

Ok that will be good then, one snag is leaving them locked when they have a double lesson with dinner between them. If there is no other way i would use that method.

 

Surely there is a way to allow standard users to unlock workstations using Windows.

[Geoff]

The only other thing you could try would be:

 

Computer Configuration->Windows Settings->Security Settings->Local Policies->Security Options->Shutdown: Allow system to be shutdown without having to log on."

 

But that doesn't really get you what you wanted.

[FN-GM]

No that won't work. that will just enable the shutdown button on the logon screen.

 

Thanks anyway

[cookie_monster]

Surely there is a way to allow standard users to unlock workstations using Windows

 

No that's the problem with using a business OS in education i suppose if it was that easy for non admins then it would be a security concern.

 

 

You say stopping students locking is not an option, why? If you don't mind me asking.

[FN-GM]

Due the number of students wrecking others work. Students will often need to leave there computer. They say it’s a pain to log them off (I can’t blame them really) and will just leave them. We did originally have it set so they can’t lock them but due to popular demand from teachers, students and mainly SLT we allowed this.

 

To be honest its not to much of an issue us unlocking the workstations. Just would be more convenient for staff to be able to unlock them right away and more convenient for us not having to do it.

[cookie_monster]

We had the same issue but in the end it was easier to tell them to save and logoff (depends on how long it takes to logon where you are).

 

What about picking areas e.g. 6th form and using loopback to add staff users to the admins group, not ideal but it limits the security issue.

[srochford]

Can you isolate the group of kids who are leaving their machines locked when they shouldn't (I'm guessing that you need some students to lock their machines but others are doing it out of badness or stupidity).

 

If so, you could have a group policy which applies to that group of users and prevents them from locking the machine. I'd guess the problem with this is that it happens only after the event and it doesn't stop "bad" pupils from locking the machines of "good" pupils etc.

 

the other thing I can think of is a web page which would allow a teacher to enter a machine name (or pick it from a list). The web page would use admin level credentials to connect to the machine and log it off.

[mrforgetful]

Can you not just tell the staff to keep the power button held in? I know I know, not good.

[rob_f]

If you delegate the permission for staff to change passwords: Change their password, make a note on their account, and when they come to get their password reset let them know why it was changed and tell them not to do it in the future!?

[Michael]

Well reading through this thread I can see there being three options:

 

1. Although you said it wasn't an option, disallow users from locking their workstation altogether but just a screensaver (easiest option). Pupils should get in the routine of logging off.

 

2. Add the teacher group only to the local administrators group, however as I already mentioned anything unsaved is lost at logoff.

 

3. Take a look at delegating teachers control over administering pupil passwords. You could create a custom MMC snap-in although this is probably the most complex method.

 

Now although locking computers may be popular with pupils, I'm pretty sure the reason it's got out of control is you have loads of machines to unlock everyday (possibly). For the time and hassle involved option 1 would be the way to go, unless teachers are willing to have a go at option 3?

[conehead]

How about creating a specific account teachers can use for this purpose?

[bizzel]

How about creating a specific account teachers can use for this purpose?

 

Sounds like a good plan so long as the password is kept secret.