stylemessiah

The libraries i am a member of just do Deepfreeze and have no other lockdowns usually, so youre not alone. Think ive only ever seen one in years that disabled access to the hard drive and user shell folders, and only allowed USB keys for storage..... I have a few PC's Win7 64bit set up in a common room at one of the places i volunteer, a retirement home. It allows semi lockdown (via GPO for the big stuff like hardware removal etc, but not hard drive access restrictions) access for those who have an account. In addition, i have a guest user account (not the inbuilt one, i might add) for guests or for users who dont yet have an account set up for them, and it uses a mandatory profile with a lot more GPO restrictions. The guest account doesnt allow: * changing of settings - due to mandatory profile * access to the C: drive - via GPO * creation of folders/files in the guest users root profile folder (i.e. c:\users\hhguest\) - via GPO * Saving or creation of files and folders to the user shell folders (Desktop/Downloads/Music/Pictures/Videos) So these are the GPO's i used: Do you administer the PC's via AD? or locally (on the actual PC)? If locally, like i do with these machines, i do the following, if you do it via AD, adjust accordingly for a user group: 1) Run MMC 2) From the file menu, click Add/Remove Snap In 3) On the left, click on Group Policy Object and then click Add 4) On the Group Policy Wizard that appears, assuming you dont want to apply this to all users of the computer (and you dont), click Browse 5) On the next screen select the Users tab 6) Select the username of the account youre wanting to restrict 7) Click OK and then Finish and then OK 8) You will now be back in the MMC console with Local Computer\Username You Selected Policy under Console Root 9) Expand the Local Computer\Username tree 10) Expand User Configuration 11) Expand Administrative Templates 12) Click on Windows Explorer 13) Set the following: Hide These Specified Drives In My Computer Set to Enabled and from the drop down list below select: C Drive Only Prevent Access To Drives From My Computer Set to Enabled and from the drop down list below select: C Drive Only Prevent User Adding Files To The Root Of Their Users Files Folder Set to Enabled Leave MMC open for the next part.... That does the job of hiding C: and they wont be able to create folders or files in their profile root folder, which works in with the next part, the logon/logoff scripts Logon/Logoff Scripts: Download the Logon Logoff scripts and Xcacls: [ATTACH]17469[/ATTACH] Note: The cmd files use environment variables, not hard coded usernames, so they will work for any user where they are set as logon/logoff scripts via GPO (i.e. you dont have to edit them) 1) Extract the files to an easy to browse to location I have included a cut down version of the warning message the guest users get on our machines at logon, feel free to edit. You can run it by a simple double click to test it, and edit it in notepad/wordpad. Its a simple thing to edit 2) Back in MMC, go to Windows Settings (above Administrative Templates) 3) Expand Windows Settings 4) Click on Scripts (Logon/Logoff) 5) Double click on Logon 6) On the Logon Properties window that appears, click on Show files at bottom left (this will take you to the correct SID for that user and to their script folder) 7) Copy setreadonly.cmd (from the zip) to the Logon folder. Also copy guestwarning.vbs to the logon folder if you want to include the warning message at logon. 8) Copy removereadonly.cmd (from the zip) to the Logon folder 9) Close the explorer window 10) Still on the Logon Properties window (or double click on Logon to bring it back), click Add and browse to and select Logon\setreadonly.cmd. click OK The included guestwarning.vbs script also belongs in the logon script window, repeat the Add, browse action to add the guestwarning.vbs script if you wish to use it You should now, if you selected the guestwarning.vbs script has 2 scripts showing 11) Click Ok 12) Double click on Logoff , click Add and browse to and select Logon\removereadonly.cmd. click OK 13) Click OK 14) Close MMC, and when prompted to save changes, i suggest you save it with an obvious name (i.e. guest user group policy) on your desktop, should you need to edit it later. 15) Copy the xcacls.exe form the zip to c:\windows\system32 I used xcacls.eexe as it was the closeset acl changing tool i had to hand. The scripts are i believe transferable/compatible with icacls etc. Thats it C: will be hidden, and they wont be able to create folders or files in their profile root folder, or save files to their user shell folders (Desktop/Documents/Music/Pictures/Video) as these are set read-only at logon. At least on a local mandatory profile, the read-only shell folders need to be reset to writeable at logoff (hence the removereadonly.cmd script at logoff) otherwise the next logon into the mandatory profile fails. I do not know whether this applies to a roaming mandatory profile, but i will assume so, so have left it in the above instructions. Logon to the account and test This should, i think, cover most, if not all, your requirements They will have no choice but to use a USB key As for Chrome, never installed that personal data stealing tool, but i did find this for you: http://social.technet.microsoft.com/Forums/eu/winserverGP/thread/a7abcfea-8819-4680-9010-d2604a59c9bd Its again a GPO fix, it references a domain GPO, but the GPO paths are transferable to a local GPO so can be found in the mmc console i referred to in my local mmc steps above if you are using non-AD GPOs. Any questions, let me know. I use a local mandatory profile, which requires a bit of fooling around to set up, and this is only for info on my particular setup: Create user account (i.e) hhguest Login to hhguest Logout of hhguest Create new folder under c:\users\..i.e. c:\users\mandguest.v2 Copy default profile to c:\users\mandguest.v2 Set guest profile path to c:\users\mandguest (minus the .v2) Login to guest (now redirected to c:\users\mandguest.v2) Logout of guest Login to guest (now redirected to c:\users\mandguest.v2) customise apps, links etc Logout of guest Login to admin account Go into c:\users\manguest\user.dat to user.man So at this point the mandatory profile is set up. Any changes are lost in the c:\users\manduser.v2 profile folder as expected, but as a side effect, i assume because of the local nature of the profile, Windows still remembers the link to c:\users\hhguest, so the changes (i noticed downloads and desktop new text documents from my testing of the mandatory profile) end up in the c:\users\hhguest folders (i.e. c:\users\hhguest\desktop and c:\users\hhguest\downloads) So even though the profile resets, if people download or create documents and they are not visible to the next guest user, they will build up over time in c:\users\hhguest, so i make the user shell folders (Desktop/Downloads/Pictures/Music/Videos) in c:\users\hhguest read only via a log on script with xcacls, and then writeable again at log off via a log off script - needs to be reset as otherwise the next login will find the mandatory profile locked and unable to load End result, nothing is saved....

There is no way to do this via permissions on a folderfile or drive...once you give anyone READ access to a folder/file/drive, reading is actually coping. One of these days we may get a server OS that includes such functionality....but until then.... What id do, and its a quick solution and i believe the best and only 100% effective method, is disable their access to local drives via GPO (including USB), if they need to copy files from a share or home folder (which hopefully has a filescreen policy applied to it) to a usb key, they request it and staff does it. You said it was only a small group that needs access. As a side effect of this, i will bet you get less requests than you had file copies, because as with any file copying lockdown ive ever seen, people are less likely to come and ask you copy a file than when they could do it themselves. People are not motivated to come and ask when they have less than good motives for needing a file. Sometimes its just better to go a manual route rather than looking at a way to automate a solution that still leaves the user with more access than they should have. In this day and age giving people carte blanche access with a USB drive is just asking them to abuse your system. Its not much better to give them access of a specifically limited kind and ignore the overall security implications, its kind of the reverse of poking holes through a firewall...what youre trying to do is put the holes in place and ignore the firewall completely. Im not aware of a free way to do this without creating a lot more work for yourself than the simple GPO method.... While software like Prevent: http://www.thewindowsclub.com/prevent-cut-paste-copy-delete-re-naming-of-files-folders soudn good, they do NOT stop dragging and dropping of files and folders If youre determined to explore a software method, then the only thing im aware of that *might* do it is Active Directory Rights Management: Server 2008: http://technet.microsoft.com/en-us/library/cc771627.aspx Server 2012: http://technet.microsoft.com/en-au/library/hh831364.aspx

Bizarre indeeed, ill put that one away for future reference !

Wow, your first paragraph would have had me doing my usual routine for stuck updates/failed updates/corrupt update catalogue Stop Windows Update service Delete C:\Windows\SoftwareDistribution folder Restart Windows Update service Would never have guessed it would be memory related. would have expected other signs of it being a memory issue!

Well sometimes you dont look at the OP posting date, and follow other misguided people who make the mistake first :)

The words NAS and school give me The Fear. I used to remotely admin 43 school servers with NAS's...after the first two failures (when will people stop thinking of NAS's as bulletproof, just as they do RAID), we managed to get across the concept of having a redundant backup of the NAS, and a nightly sync Of course we didnt have 500Gb of data, that will keep from me sleeping soundly tonight, just thinking about the scenario you described To give you some horror back, when i joined this company who had the support contract for the schools, it didnt take me long to see i was going to considered a genius there... It took me just provisioning my first server and following their guide. One of the steps was to open up a script and replace the static hostname (location based) and replace it with the static hsotname of the site i was provisioning for. These people had never heard apparently of environment variables Needless to say i rewrote the scripts and the guides...and automated a lot of manual steps and saved a LOT of time

i suspect youre going to get a lot of personal opinions on this one Symantec: for me the last really usable product Symantec made was Ghost 8...everything since will have you chained to a management console doing a lot of maintenance Acronis: when it works, its fine. especially for restoring an image to dissimilar hardware. what worries any user of acronis products is that the company will issue an update, because inevitably, over the years, when theyve targeted one bug and conquered it, theyve introduced one (sometimes more) new bugs. ive got a standard image that will only restore with the exact version of acronis ti it was created with, even one update along and it wont restore successfully.... Paragon: never got round to even testing it, so no help from me there. It depends on whether you want recovery and backup covered in one product, or by one vendor For me i would seperate backup (of data) from recovery and imaging Ive used Clonezilla an FOG, both open source and free, with some success for classroom, small business scenarios as far as imaging goes, and used various commercial backup software for data backup on the server. Clients usually go commercial fo rbackup software, as while they are happy to let me Clonezilla or FOG their desktops, they still dont trust open source for data backup...i keep trying...

The path you are seeing is stored in the registry in the installsource entry for Silverlight under the Uninstall key For example on my PC its under: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} The String Value Name: InstallSource The String Value Data: c:\8082716c8f22f3c2b3\ This path youre seeing is a temporary one that is removed after install. It seems for whatever reason that the update you are running wants to access the original package, for whatever reason. Of course it will never find this. I assume the Silverlight Update is actually a full package and not just a patch, as ive never seen a patch for it My first thought is to: Usual regedit warning applies, if you dont know what you are doing, seek help, deleting the wrong key/value can kill windows.... 1) uninstall Silverlight via the control panel. while youre in there, turn off automatic windows updates 2) open regedit and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and look for the subkey that houses the Silverlight info (i suspect that it is still remaining after uninstall, if not this guide can stop here:) ). It may be the same subkey as i see: {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} or it may be a random GUID...may take a bit of clicking, but it will be a GUID entry i.e.e {7e4a etc}. Clicking on each GUID will show the software name in the right hand pane. 3) delete the subkey (the GUID {7e4a etc} you just found that matches silverlight 4) reboot 5) download and manually install the latest silverlight binary 6) reboot 7) turn automatic windows updates back on and do a check for updates and see if this has resolved it Without knowing more about the .Net 4.0 update...is it a hotfix or full package? i couldnt guess, but probably a similar process to above. Lol, if you think thats bad, try only having remote access (2 states away in australia - its big down here) to a 2008 server that refuses to install SP1, and having a dodgy ADSL connection due to biblical floodwater getting into the lines. Most of the update failures ive fixed on a server have been by the method i used above, uninstall, regedit and manual hotfix/update. But when i hit the SP1 one, it was going to take to long to manually uninstall each pre SP1 hotfix/update and edit the registry for each one. In the end we drove down and rebuilt the thing! At the time i was remote admin'ing 43 servers remotely, and theres always one that wont play nice

Why not lock down all the settings at once I use public fox: https://addons.mozilla.org/en-US/firefox/addon/public-fox/?src=search This will allow you lock certain options, or lock access to options all together via password So you could set the options as you want, add this addon and then choose what to lock down, or lock down access to the options all together hope this helps

Sorry to revive this one, but.... Thanks, this was the only working way i found to get a local mandatory profile on Windows 7, without using AD. In the above guide, the only edit i would make is to substitute "Disconnect" for "Log Off" in the early stpes where it is mentioned, the author correctly uses "Log Off" later in the guide. Basically my need was to lock down one "guest" account and revert/discard and changes at logoff..i.e.e steadystate style...thanks MS for taking out the guest mode option in the final version of Windows 7! So my shared PC setup is for: * A static guest account that reverts/discards user changes at logoff - sorted due to above post. I'd tried a few different ways, the above was the winner! * A custom "default user" profile for normal user accounts - ability to save etc, usual GPO lockdown - sorted out using the info ive posted below in case it helps others. Copy user to default user profile issue on Vista/Windows 7...and solution I also found the other issue with Windows 7, not being able to copy over a "templated" user profile over the default user one. In this instance, i used DelProf (Free), from ForensiT Free Downloads It allows you to specify the customised profile at the command line, and it copies this over the default user profile, generalising it on the way... As has been mentioned here and elsewhere where IT people gather, the only supported MS way is to do it via xml and sysprep as MS says that there are sections fo the profile that arent generalised/cleaned during this copy....stupid MS, rather than fix this, make it harder... So ForensiT went and fixed this generalisation/chleaning during copy issue....so far in testing i havent found an issue....and it avoids the sysprep bs... Hope the tip about the special ForensiT DelProf helps