RabbieBurns

i chose a random year 5 student that im doing my testing with. Its able to change the diplay name of this teacher and other info, but not modify groups etc

right I'm still not really got to the bottom of this. Ive blocked them out of MMC by the aforementioned method in GP. Ive also audited the group policies they are being applied and there isn't anything I an see that would give them that access in AD. Ive also tried this with a bunch of the different models of machines we have round school. It seems the AD tools is only installed on a small batch. So Ive got them set to re-image. But it doesn't address the issue of why they were able to modify AD the first place though.. edit: Further investigation - it seems it is only 1 teacher account that the students are able to modify the name, display name etc etc. Im obviously not able to test every account, but all the main ones they cant modify. Also, they cant change group membership which is good. Question no is why an they change this 1 teacher account? And also, I dont know why they can see AD at all, or is this just the way AD works that any user account can query AD (via 3rd party tools etc?)

I did a search on here and found a thread that said it was because I had already logged onto my laptop and already had a local profile. So I had to delete and recreate my local profile and it seems to have worked. Redirection works but offline files is getting access denied, ill need to investigate that part. But the fact it required a new profile makes it kind of impossible to roll this out to staff. But at least my documents are on the way to becoming nice and synced.

hmm in RSOP it shows: I am the owner of the network share folder in question. As for the GP itself, i have the setting 'Basic : Redirect everyones folder to the same location' and then the next part is set to 'redirect to the users home folder'

yeah i must admit Ive not seen or heard of any evidence of labs being on overnight so i have to assume its working. I will check the event-logs of one of the lab workstations tomorrow if I remember. AFAIK the release notes only make mention of issues of using the deployment tools. But ill check, someone PM or @ mention me to remind me please

ok my bad, sorry i guess copying and pasting over rdp doesnt work too great. So ive now ran it against a couple of random student users. It appears there is a 'strange group' which the Students group is a member of. When going into ADSIEdit and looking at this 'strange group', in the security tab under 'Authenticated Users', and 'SELF' there are a whole load of permissions set: Read, Send to, Read exchange info, read exchange personal info, read phone and mail options, Understanding ASIEdit a bit more than I did earlier, under Security of random students, there is an 'Everyone' which has the permission to change password. @micheal, unless thats been done through a policy and isnt showing up in AD groups, as @p858snake has suggested..

would this not show up when i look at 'members' when looknig at the domain admins group?

generally the internal network is for when you want the VMs to only have access to each other. I only have external network configured, and set the VMs to connect via external. I however also have a seperate connection between hosts on a dedicated 'heartbeat' network which is used for failover clustering with regards to live migration of virtual machines, should one host go down. Hyper-V: Using Hyper-V and Failover Clustering Download details: Step-by-Step Guide for Testing Hyper-V and Failover Clustering

Doesnt seem to work for me? D:\profiles\rabbieburns\Desktop>cscript check_user.vbs Microsoft (R) Windows Script Host Version 5.8 Copyright (C) Microsoft Corporation. All rights reserved. D:\profiles\rabbieburns\Desktop\check_user.vbs(14, 44) Microsoft VBScript compilation error: Expected end of statement

you need to configure both the internal and external networks on hyperV hosts/guests. Is your san connection via the brocade fiberchannel ? (I only ask as our san is fibrechannel connected and we use brocade switches) Within HyperV on the host, if you go to Virtual Network Manager, you can specify which network card you want and to connect to the External Network. If you then look in Network Connections on your hyperv host, you will see there is a network adapter called Local Area Connection X - Virtual Network. This is the one you configure with the IP to talk to the external network.

yes, a student was able to change a teacher account. Im looking at ADSIEdit but not sure what I should be looking for? Anyone able to point me in the right direction.

yes

was within the mmc with the ad snapin added

if its the one im thinking of its more than a chandelier: http://upload.wikimedia.org/wikipedia/commons/thumb/a/ab/Kostnice_Sedlec.JPG/400px-Kostnice_Sedlec.JPG

@Steve21 they are running local profiles here with documents and desktop redirected to their server (win7/8r2), how will restricting access to C: effect local profiles? @CyberNerd makes sense. where would I look about access to AD? The students are only members of a students group, domain users, and a graduating year group. How would I audit if they have anyone has any special permissions? They're obviously not domain admins or anything like that..

also, when i tested with a user account, they were able to modify AD, I changed the displayname of a teacher account..

These are just basic windows 7 enterprise installations. The AD pack hasnt been installed seperately.

all of the above are blcoked, but they still have access to the C: drive (which im trying to have blocked too... red tape...)

ok thats them locked out. Thanks heaps for that. Is there anything else I should be thinking of about policies for the students a major as this?

i mean, what do i put in the software restriction policies? where do i get the hash from?

how do i do that?

It has been brought to my attention today, that students can get to pretty much all the server admin stuff. They use the mmc.exe program, and then they are able to add snap-ins such as AD, DHCP, printers, pretty much everything. Im not sure how long this has been going on as Ive not long taken over this network, but how can I stop them from doing this???

we allow students to use their own laptops etc on our wireless, however we block all ports on these devices except for http and https They can access their live@edu accounts via the browser, and outlook will also work when it is set to connect via Http. Is there any way to use the Mail Client on a Ipad to connect to live@edu via http ?

@sted I just followed the howto guide from technet which seemed to only do redirection in one, and offline folders in the other? @SYNACK yes, ive done that but still not showing. Actually, when I click on Documents it doesn't seem to be redirecting to the server share at all, let alone syncing anything

right ive set this up according to this page Configuring New Offline Files Features for Windows 7 Computers Step-by-Step Guide but it seems to still not be working I have redirected the Documents folder to \\server\share\ and set it to use a different foldername for every user. I have then created a \\server\share\rabbieburns\documents folder and put some documents in there. I have also put some files and folders in the C:\users\rabbieburns\documents folder on my laptop But this offline files thing doesnt seem to be working? Is there something Im missing?? Cheers