HeyMerlin

Haven't used winstall LE so can't comment on it (looked at it briefly a year ago but not enough to say anything). Curious what issues you ran into with Emco? The only issue I ran into so far is deploying packages such as Eclipse which has extremely deep paths.

This is dredging up an old post and I'm sure you have found alternate solutions. However, if you are still looking for a slick way to deal with deploying software that only come with exe installers then you may want to check out Emco MSI Package Builder. I've been using this software for over a year now and very much recommend it. The license is decently priced (we have the enterpise version) and the software works well. I've deploy 30-40 packages with it, most with very little difficulty. This software basically monitors your installation process onto an existing machine and then packages it into a msi. I then use GPOs to deploy the msi. I have used this for everything from .exe installers to drag and drop installers (manually creating menu shortcuts, etc.). Generally I avoid startup scripts for installation except for packages that pretty much well demand it (I'm looking at you MS Office and Visual Studio).

I have followed up this thread with a blog post under my EduGeek profile outlining the final configuration that I used. With the length of the entry I figured the blog would be a better place as well as easier to find in the future.

A couple of weeks ago I posted a question regarding setting up one of my labs for an upcoming online final exam. A paraphrased summary of the question is below: Having now successfully configured the lab in question and hosted the exam I thought others may find the solution useful. First here is the general description of of our lab environment: Windows 7 clients joined to a Server 2008 R2 hosted domain on a relatively large campus. Network infrastructure under centralized control thereby making physical changes impossible. No practical way of physically isolating the lab in question. Windows domain under centralized control. Only permissions to manipulate department OUs, computer objects, security groups, and GPOs in the domain. The solution I used involves the creation of three GPOs in the AD; actually the first one below was previously in place. Normal Login restriction GPO. This is the preexisting GPO that used in our labs to limit which users are allowed to log into which lab machines. If you have not used this style of GPO before the catch is that the GPO tattoos the client machine. This means that disabling the GPO will not reverse the effects of it. If you need to change the allowed list of users you need to either change the GPO or disable it and use a second GPO to tattoo the client with the changed user list. In this scenario this GPO will be re-applied after the exam is over to allow all the regular uses access to the lab clients. This GPO is linked, enabled but not enforced in the appropriate OU before, during, and after the exam. It is not necessary to modify this GPO specifically for the exam. GPO details: Computer Configuration/Policies/Windows Settings/Local Policies/User Rights Assignment/Allow log on locally Add all users that you normally allow to access to the client machine. Do not forget to add BUILTIN\Administrators and NTAUTHORITY\SYSTEM. In my case this included AD Security Groups that are populated with our department's personnel and students along with a few local groups including one ExamAccounts group. Computer Configuration/Preferences/Control Panel Settings/Local Users and Groups/Group (Name: ExamAccounts) Action: update NOTE: you do not want to use Replace here as a new SID will be created each time the policy is applied. This will mean the group SID will differ from the SID allowed to logon above. Delete all member users: disabled Delete all member groups: disabled Stop processing items on this extension if an error occurs on this item: no Remove this item when it i no longer applied: yes [*]Exam user account GPO. This GPO creates/deletes the local user account to be used during the exam by the students. It can be enabled anytime previous to the exam but only disable it when you are sure that none of the exam files on each machine are no longer needed. Hopefully you have backed up all the files to a central location "just in case" right after the exam anyway. GPO details: Computer Configuration/Preferences/Control Panel Settings/Local Users and Groups/User (Name: exam) User name: exam User cannot change password: true Password never expires: true Account is disabled: true Account expires: never Stop processing items on this extension if an error occurs on this item: no Remove this item when it is no longer applied: yes [*]Computer Configuration/Preferences/Control Panel Settings/Local Users and Groups/Group (Name: ExamAccounts) Action: Update Group name: ExamAccounts Delete all member users: disabled Delete all member groups: disabled Add members: exam Stop processing items on this extension if an error occurs on this item: no Remove this item when it i no longer applied: yes [*]Exam environment GPO. This is the GPO that does all the heavy lifting and provides the actual exam environment. This includes enabling the exam account, restricting the allowed accounts, and setting up the firewall. This GPO must be set to enforced to ensure that its settings overrides any other GPO. Enable this GPO and reboot the machines just prior to the exam. Then after the exam, disable the GPO and reboot the machines for normal access. GPO details: Computer Configuration/Policies/Windows Settings/Local Policies/User Rights Assignment/Allow log on locally Add all users that are allow to access to the client machine during the exam. As above do not forget to add BUILTIN\Administrators and NTAUTHORITY\SYSTEM. BUILTIN\Administrators NTAUTHORITY\SYSTEM ExamAccounts (local group created above) [*]Computer Configuration/Policies/Windows Settings/Windows Firewall with Advanced Security/Domain Profile Settings Firewall state: on Inbound connections: block Outbound connections: block Apply local firewall rules: no Apply local connection security rules: no Display notifications: no [*]Computer Configuration/Policies/Windows Settings/Windows Firewall with Advanced Security/Inbound Rules Add the predefined rule "Core Networking" - Action: allow Remote Desktop - Action: allow, Scope: limited to particular machines or networks as desired Add exceptions for any other particular machines (remote scope set to the IP address) used to remotely administer the machines if needed. [*]Computer Configuration/Policies/Windows Settings/Windows Firewall with Advanced Security/Outbound Rules Add the predefined rule "Core Networking" - Action: allow The one exception to the "Action: allow" is for "Core Networking - Group Policy (NP-OUT)" which must be set to block. This prevents the exam participants from accessing any network drives. Accessing GPO files in the AD is still permitted by a specific targeted rule below. Add rules for specific servers such ad the AD DCs, CAS servers, Moodle server (for handing in exams), A/V update servers, etc. The one catch is that although you may have dc1.mydomain.edu through dc4.mydomain.edu you also have a machine called mydomain.edu which you will need to add in this list; this server hosts the actual GPO files for your domain. Typical settings: Enabled: true Program: any Action: allow Protocol, Local/Remote ports, Local scope, and ICMP settings: any Remote scope: IP address(es) of your server(s) [*]Computer Configuration/Policies/Administrative Templates/Network/Network Connections/Windows Firewall/Domain Profile These settings are here to override any similar settings in other GPOs. Windows Firewall: Allow inbound file and printer sharing exception: disabled Windows Firewall: Allow inbound Remote Desktop exceptions: Enabled - Limit scope as above Windows Firewall: Allow local port exceptions: disabled Windows Firewall: Allow local program exceptions: disabled Windows Firewall: Define inbound port exceptions: disabled Windows Firewall: Define inbound program exceptions: disabled Windows Firewall: Prohibit notifications: disabled Windows Firewall: Protect all network connections: enabled [*]Computer Configuration/Preferences/Control Panel Settings/Local Users and Groups/User (Name: exam) User name: exam User cannot change password: true Password never expires: true Account is disabled: false Account expires: never Stop processing items on this extension if an error occurs on this item: no Remove this item when it is no longer applied: no Apply once and do not reapply: no Using the above configuration I was able to have the remotely flip the lab into exam mode, and then back into regular mode simply by enabling and disabling GPO number 3 above. Once the course instructor confirmed that all exam files were collected and submitted disabling GPO number 2 above removed the local exam account and all files from the lab machines. I'd love to hear your comments and any suggestions for improvements on the above. In the case that you use the above information I'd appreciate hear how it went. Merlin.

Unfortunately on our campus I have no direct access to the networking equipment so injecting any sort of hardware/software solution to isolate the lab is impossible (University campus with 20K+ students). Not to mention that I know I have other machines outside the target lab on the same subnet/switch stack so separating them out would painful. Domain accounts are in much the same situation. The AD is administrated centrally. I have rights to add/edit/delete OUs, GPOs, computers, but not user objects. So adding domain accounts or changing existing domain user accounts is out. I can limit the login access to the students within the target class in the target lab however currently student accounts are subject to folder redirection and store all user folders on a file server. I need to restrict access to all user files for the exam so Local accounts seemed to be the easiest way. This way they have no access to anything in their profiles on the lab machines or on the file servers (either ones in our department or others on campus). I can use GPOs to create/enable/disable/delete local accounts easily enough. The local accounts are your basic non-privileged limited user account, very similar to what a standard domain user is. I'm certainly open to any and all suggestions of different/better ways to meet this sort of lab exam environment requirement. As most of you probably experience, the requirement for this came to my attention with next to no notice so I have had to put something together quickly if not elegantly. I'm hoping to improve the configuration after this set of exams is over so as to be better prepared for the next time.

Thanks for the reply. I have used GPOs to manage the Firewall settings previously however mostly for the usual things: exceptions for specific programs, exceptions for specific ports, etc. I had not tried fully controlling all outgoing and incoming connections. My initial look into it did not show a clear way of doing this with the Windows firewall as it is much more connections oriented rather than traffic oriented than iptables or ipfw. However, I now have a configuration up and running on my dev/test boxes that works. I plan to post the details to this thread when I'm back at work next in case others are looking for the same information.

Hi, I'm trying to figured out a way to configure Windows 7 firewall rules via GPO for the following environment: Local account only, no domain accounts (this is easy via GPO) Need access to one web server that serves the exam Need access to CAS, DNS, and AD machines Do not block traffic from specific machines used for administration. Block everything else. In Linux and Mac this is relatively easy using iptables and ipfw respectively: allow all out going traffic restrict incoming to be allowed from only specific IP addresses. I can not see a way to configure a rule to be applied to all incoming traffic and not just incoming connections (connections initiated from an external source). I considering the following configuration: Block all incoming connections unless matched by a rule Block all outgoing connections unless matched by a rule Add rules for the following: - Allow all DHCP (UDP, ports 67 & 68) - Allow all traffic to our DNS servers (I have a list of these) - Allow all traffic to our CAS servers (I have a list of these) - Allow all traffic to our AD servers (I have to get a list of these) - Allow all traffic to our exam server - Allow all traffic from our administration servers Does this sound reasonable? Is it possible with Windows 7 firewall? Has anybody done this? Note: I have read similar posting regarding ISA servers, network firewalls, etc. We are on a large campus and I do not have configuration access to our network equipment including proxies, content filters, etc. Hence why I'm trying just to use the Windows 7 firewall rules if possible. Cheers, Merlin.