boomam

Thanks. Doesnt look like theres a command to set it so no shortcuts are installed, although changing the command to: msiexec /i adminpak.msi ADDLOCAL=FeADTools /qn Will hide the install process.

I take that that the: msiexec /i adminpak.msi ADDLOCAL=FeADTools /qb command can be run as a startup script in a GPO? Plus, what does the command switch "/qb" do. I'd like to find a list of command switches for that, but cant. As i'd like to find the switches to make the install happen silently, and to add no shortcuts. That 'staff' guide you created, in your first post, by any chance do you have the original template for that lying around in a format i can edit? Im too lazy to create one myself. Thanks for all the help btw. Its been much appriciated. .

Sorted it, everything does appear, but nothing but properties & password actually work. Which is fine byme. Just need to roll out MMC to every computer with just the snap-ins installing on each system, and not displaying shortcuts...

Sorted that, redid the mmc on my XP workstation. Now the problem is that all the menu options under right click work. How do i disable them all, apart from passwords?

Ive worked it all out, and saved it in a MMC called 'Pupil Password Management' But it wont open, for anyone, unless its run on the server. Microsoft Management Console MMC cannot copen the file XXXXXXX\Pupil Password Management v1.msc. This may be because the file does not exist, is not an MMC console, or was created by a later version of MMC. This may also be because you do not have sufficient access rights to the file.

So i need to create commands and task views for every OU for the pupils!?

That little custom MMC program looks ideal. Im trying to follow that guide, but its still showing me the entire AD in my custom MMC..

Thats what i would do. But just focusing on the test user, its still allowing read/write access to everything else, even though in the delegation wizard thing i selected only password changing. The way ive found to do what i want, is to remove inherit permissions from an OU, then remove the references to the test user, then re-add a deny full control. This removes that OU from the MMC when that user uses it. Im hesitant to do this to all but the pupil OUs for fear of messing something up. For example, do the permissions for delegation (in regards to OU security), affect anything else but MMC access to those parts? I dont want to spend 20mins denying the staff group access to everything in AD apart from the pupils OU, only to find that it messes up their ability to log on, print, access share, access programs, etc;

Ah ha! Ive managed to hide the OU by disabling the security permissions from inheriting from above. Then removing all references to the test user, then re-adding the deny permission. Im a little bit hesitant about applying the same technique to every folder in AD that i want to restrict though. Will it not cause problems?

Using the delegate control thing on one test user and two test OUs. Ive given the user password changing options on one OU, and using the advanced view in AD, changed the permissions on the other to deny everything. Yet the user can still do everything in both OUs!?

Ive looked at that, and some other google articles. All that appears to allow me to do is allow users to do things. Theres no deny/hide functions in there. I want staff to be only able to see the pupil OUs, and only be able to change passwords in it. Nothing else. Every other OU, and functions like move/new/etc; i want to remove access to.

What i want to do is restrict what parts of users and computers they can access, and what they can and cant do. For example, at the moment, they have full access to users and computers. So they can move things around, change passwords for anyone, etc; I want to restrict it so that they can only change passwords for users in certain OUs. So that things in other OUs, and other functions, are denyed to them.

Hi. Is there a way to restrict what parts of MMC users can access? I do have a GPO in place that stops people accessing things like DNS/DHCP/whatnot, but i still allow teachers access to the AD for users so they can edit passwords. Is there a way to make restrictions within that as well though? Thanks in advance all. .

Bump! Any ideas to this annoying problem? .

Interesting app, i didnt know it existed. . Did you notice any problems with this method in your time using it? Im thinking about enabling it. .

So this will allow me to change file locations without redeployment?

Thanks. Got the template and made a new GPO with it. .

Any chance you can post up the login script you use please? Thanks. .

Because often policys take ages to apply to workstations, and im fed up of waiting/rebooting systems 5+ times in a row. .

Hmm. Interesting, So DFS is basically a virtual filesystem, where i can change paths as nessessary, tranparenty to the rest of the network? Im wondering how it can get me around this problem though? I can setup the existing DC/File server as the DFS root, and add several folders on the NAS as par of the DFS, but the programs would just want to re-install wouldnt they? Therefore negating the need for me to use DFS in the first place. .

How much of a delay/slowdown are we talking?

Why should i have used DFS? It wasnt really an option to begin with, the NAS was a later addition, and whoever setup the DC before i started didnt have DFS installed/configured on it.

Im finding that often machines need multiple reboots to pickup apps i have set to deploy via GPO. And often the same for settings. DC Diag reports show that the policys are propogating correctly however? I generally make network wide GP changes in a seperate GPO, but for the bigger changes, i generally document down the change and change it in the default policy.

Hi. About 3 months or so ago i started blasting apps out, where possible, via GPOs. The deployment share "\\server\gpsins" is on our main DC/file server. I want to move the apps to another server, a modified nas, so the paths would be "\\nas1\gpsins". Im happy going into each GPO and removing/re-adding the new paths to the programs, but what i want to know is: Will all the machines start installing the software again, or will it not bother as its previously installed? Thanks in advance all. .

Hi. I want to change the default intervals for a group policy refresh on our workstations to something a little faster. Ideally, so it'll run on every boot. Wheres best to change the intervals? the default domain policy, or create a new one just for it? Any advice/warnings about changing it also? Thanks in advance all. .