Goatboy

Applying policies doesn't really take that long, and a GPO will be much more manageable. So while it doesn't hurt to have those settings in the mandatory profile (esp. if your users are good at bypassing group policy by yanking the network cable) you should still apply them in group policy.

Bit gutting to see the key you've been so precious about for years pop up as a google suggestion when you type the first couple of letters. :/ We push our sysprep.inf in the $oem$\$1\.. folders on Windows DS so updating our image isn't a problem, but current installs are a likely PITA.

Make that here: Download

We've often toyed with the idea of locking the drives through software but always been put off by the available tools. But paper-clips aside, it's still worth doing. Well, having spent a good hundred quid replacing drives in recent weeks I finally plonked myself in front of Visual Studio this morning and have a command-line solution for this now - thought I'd share it as I recall coming to this thread searching for answers last week. App, msi and source are here: (edit: nope, post below...) It's simple to run, just 'cdtray.exe lock d' or 'cdtray.exe unlock d' - where D is your optical drive letter. It'll execute silently unless you pass it daft arguments. Not sure yet if we're going to run it as a startup item for students, or lock it first on startup and unlock it for staff at login... Amazing what you can accomplish with Google and a vague recollection of picking up a book on Amiga C ten years ago!