SuperHans

Increasingly it seems students are bringing in USB sticks which have applications which password protect or perform another innocent action to gain access to the data or come preloaded with software e.g. U3 sticks. However the issue is that running these sorts of files off the USB stick is restricted due to being of the .exe nature. At the moment I take the files off or on for the student on my machine. Is anyone else encountering this and how are you dealing with it?

Try running RSOP for the machine to make sure it is getting the right machine/user policy which is installing the MSI

yes instead of running it from the server run it from the local group policy, gpedit.msc

enable install new Hardware and disbale the need for drivers to be signed in GPO, do a search on here and I'm sure you will find out how to do this if you are not familiar with editing Group Policy Objects

Is it stopping all network activity for the computer or is it not importing proxy settings (if you are running a proxy?)

Thanks of all your suggestions. I looked at changing the registry but obviously different video cards meant this would be a pain. I Had already looked at resolution changing programs a while ago for something else and found Display Changer :: 12noonwhich had the benefits of not having to restart the machine after making the changes, and also being able to change the color depth independently of other settings such as resolution. You can also set it for certain programs to which is handy.

Is it possible to change the 'color quality' in display properties from a group policy object? I want to change from 16Bit to 32bit and back for some machines, but have come up blank trying to search for solutions. Even if this is not possible with GMPC can this be done with registry changes or other alternatives?

Had a few people ask me this so thought I might just post this short guide... This is all assuming you copy all the files from the CD to a network share ("Adobe CS3" in this case) from which you will deploy, obvious permissions apply. Firstly to create your xml go to start> run> "\\path to your adobe cs3 share\setup.exe" --record=1 Follow the install procedure as you want on all clients e.g. accept EULA, install path, products to install and product key. This will not install it but produce a .xml file in c:\program files\common files\adobe\installers\adobe creative suite 3 design premium.install.xml I copied this to a safe place, renamed it to just install.xml and placed a copy in the root of the adobe share first created. Then make a .bat file along the lines of "\\servername\share\Adobe CS3\setup.exe" --mode=silent --deploymentFile="\\servername\share\Adobe CS3\install.xml" --skipProcessCheck=1 Notice it produces a similar uninstall.xml which can be run in the same manner. Assuming all permissions are fine and you run this as an administrator to test if it installs, you should see some action on the hard drive/cpu for a while (~45mins in my case) while it installs. You can then run that as a logon script if all went well and you require that. Hope this helps everyone.

The lockout policy is something I have considered but was always met with grievances about being locked out when displaying power points and playing vids etc. Has anyone dealt with this? I understand your point about them wanting the convenience of leaving it open but I would put a short timeout period on drives to address this. Maybe I should look down a different route. But you are always going to get teachers (you know the type!) who won't change their ways no matter what...

I wasn't aware you could do this on networked drives. Although if so encryption wouldn't be necessary, just some sort of domain authentication would suffice.

Is it possible to have a setup that promts for a username and password everytime a mapped drive is accessed, even though the drive is already mapped from the logon script? Idealy on specific drives. This is in the interest of security, such as if a student accesses a teachers computer while not locked (when will they learn?!) and not in the room it would limit network access.

Are you using the updated .adm file for IE7?

Has it installed correctly? Check to see if the USBDLM service is present, and what it's status is. Try restarting the service if it is there.

I went and had another look, and the local security polices look like they are correct when I log in as an administrator, e.g. load/unload device drivers and the unsigned drivers to silently suceed, and everybody on the security settings. However when I log in as a student iI obvisouly can't check those settings are the same, although I can't see why they wouldn't be, but the problem still occurs...

There is already one applied to our workstations OU, and split into rooms, they all inherite from that but the same issue is still happening. We do have two DCs and I wondered if it was a problrem with replication but it has been a few days now!

Silly but check that they have permission to manage documents by right clicking and security tab.

I am really stuck with this. My predecessor kindly left no information about the group polices in place, and after re-imaging some machines with a new image I created I realised that the local polices were not set via GPOs. So I went in and edited the default domain GPO to allow domain\everyone and domain computers to load\unload drivers and silently succeed at unsigned drivers. This however did not work. I checked the permissions that these objects had which are read and apply. Logged on as a network administrator and ran gpupdate then gpresult and the results (which point to something not being right) are: N:\>gpresult Microsoft ® Windows ® XP Operating System Group Policy Result tool v2.0 Copyright © Microsoft Corp. 1981-2001 Created On 10/09/2008 at 12:37:31 COMPUTER SETTINGS ------------------ Applied Group Policy Objects ----------------------------- Default Domain Policy Stations Internet Proxy Configuration LOGON WARNING The following GPOs were not applied because they were filtered out ------------------------------------------------------------------- Local Group Policy Filtering: Not Applied (Empty) The computer is a part of the following security groups: -------------------------------------------------------- BUILTIN\Administrators Everyone SophosAdministrator SophosUser BUILTIN\Users NT AUTHORITY\NETWORK NT AUTHORITY\Authenticated Users IT-100$ Domain Computers USER SETTINGS -------------- Applied Group Policy Objects ----------------------------- Default Domain Policy Internet Proxy Configuration Supervisors Login Scripts The following GPOs were not applied because they were filtered out ------------------------------------------------------------------- Local Group Policy Filtering: Not Applied (Empty) The user is a part of the following security groups: ---------------------------------------------------- Domain Users Everyone SophosUser SophosAdministrator BUILTIN\Users BUILTIN\Administrators NT AUTHORITY\INTERACTIVE NT AUTHORITY\Authenticated Users LOCAL Staff Supervisors Ashcombe Internet Access Domain Admins Students Everybody The computer local security policy should be applying. It should work as the OU where the computers are not blocking inheritance of the default domain policy. The default domain policy is also enforced. Can anybody shed some light on this issue?!

I was tasked with this the other day, and it didn't take long using that guide from Adobe about deployment (which OverWorked has already posted). This basicly leaves you with a silent install script which can be run as a batch file using the correct switch to make it totally unattended. Only problem I encountered was to do with my user permission settings. If anybody needs the .bat or install.xml that i used to successfully install it let me know!