NTWS/SVR and School Lab Security

are you on 95 or NT or what??

Since you’re not interested in Microsoft’s white papers, I’ll provide you with a list of alternative websites to check out.

http://www.ntfaq.com

http://www.usyd.edu.au/su/is/dts/DTSwinNTProfiles.html

http://www.globetrotting.com/win95/index.htm

http://ocean.ucc.ie/utils/tutorials/NTpolicies.html

http://www.unosoft.com/software/securent/about.html

http://www.dundee.ac.uk/itservices/windows/admindoc/policies.htm

A couple of good books to help you with this can be found at:

http://www.amazon.com/exec/obidos/ASIN/1565922743/o/qid=964401538/sr=8-1/002-8054550-0588034

and

http://www.amazon.com/exec/obidos/ASIN/1565922514/ref=sim_books/002-8054550-0588034

Good luck and I hope this helps!

Check your Resource Kit and see if their is Custom Install wizard on it,see http://www.microsoft.com/office/ork
This resource kit will provide you with custom install of office programs and setup over the network

How about installing an NT terminal server? You can have what you said with some easy logon scripts but you have to know that this machine have to be a bulldog. For 8 users you need 256RAM (to move) and ... A good machine is 512M.

Hope I can help you with my following ideas:

It seems to me you needed a unified installation for every desktop. If you have standard hardware, you can do the following:
1. Setup a machine with the necessary software and use policy editor to configure the desktop to your requirements (cannot change desktop settings, cannot change display settings, etc)

2. Clone the standard installation to a CDROM and make it bootable with autoexec.bat to perform auto cloning to new standard hardware. You can try Norton Ghost.

3. Modify the user's account to get their roaming profile. Note that SP4 and above, when you use policy editor it allows you to specify which folder of the profile you want it to be local. So you can set the favorites on your server, and that will maintain only a single standard copy of bookmarks.

4. On the policy editor, you can make the system not to remember any changes the user does, and that will not cache any profiles on the PC.

If you do not have standard hardware, you w

check out http://is-it-true.org/nt/

for books http://is-it-true.org/nt/books/btips6.shtml

With NT you can choose to save profiles on server. Also, you can restrict access within NT to suit your needs. This way, logging in onto a NT workstation shows your own desktop and own favorites, but the administrator can configure it so that you can't alter them.

Use policies AND profiles...

You can do this easily by setting the permissions as we do here. Our PCs are read-only on the root of C: and most of the rest of the drive. We allow change permissions only when it is necessary to run the programs such as the Program Files directory and sub-directory. If they can't change the registry, they can make the changes.

Hi!

The most efficiently way to set this up is by using a mandatory profile!

Install NT and programs you need on one computer use policy editor as stated above and remove access to display settings registry, run command on start menu and so on.

Then save that profile and put it onto the DOMAIN CONTROLLER and call it .man, read MS white papers or get a NT Workstation MCP book which will address the subject with examples and all.

Since the profile is mandatory the user(s), will alwaysget that profile and it's only temporarily cached at local computer.

It will be deleted from local computer when user logout.

/Hasse

I'd use a combination of ZENWorks from Novell and Ghost to 'redo' machines in the lab quickly now and then. I've managed a training room / lab in this way without any problems.

http://www.novell.com/
http://www.symantec.com

1. Lockdown workstations - no installing of games/programs.
>>> This can be done using user policies (Windows NT policy editor)

2. Have the desktop look the way I want: Office toolbar, IE5, my comp, recycle bin, net neighborhood only.
>>> Mandatory profile will take care of this

3. NO personalized settings running on every logon
>>> Man. Profile will also take care of this

4. IE5 bookmarks same on every PC
5. No profiles cached on local PC
>>> These two are trickier; You'd probably need dupicate installs (drive images) of a drive set up with no caching and the correct book marks

Brian

You don't indicate what kind of a network you have. We have a NetWare
environment and we are quite successfully doing everything you enumerated and more (like pushing out software upgrades), using a product for NetWare
called ZEN Works. Zen Works also allows you to remotely take control of a user's desktop to resolve most user problems without leaving your office. Saves us a lot of money; could save you a lot of shoeleather, as well. Users in our environment enjoy a profile that travels the network with them. Whatever rights and privileges they have on the desktop in their office, they are delivered wherever they log in on the network.

Hope this helps.

Chris

I was having the same problems at our district. You did not say what systems you were running, so I will assume it is Win95 - Win98. The policies & profile editor will work for what you are having problems with but it is not an easy task. Have you thought about a third party program?
We fixed all of the problems you are having by installing a program call Fortress. You can lock down all of the things you are intrested in. Also there is no local cach.
If you are running any Mac's you can useMacManager. This will stop all of the problems you listed, but it will take a BIG H.D. to store the user prefrences. We have 30gb drives for every 200 users, and almost all of the space is used for preferences.

You may also want to try Win2000. It also offers many different options that you can choose from to limit the users. The administator has full athority over all other users. If you don't want to use 2000 then I would definitely try using NT. I don't think you can efficiently accomplish what you want to do with 95 or 98. I hope this helps!

There is a program called FullArmor by Micah Corp that works fairly well for this. We are also in a school environment and are now switching from FORTRES to this. It does deal with policy editor, but with a simpler interface. You can lockdown (noinstallations) have the desktop look the way you want it to, use only 1 profile for all users, which all CAN be kept on a NT server (under netlogon) or can be done by WS. I prefer this program over Fortres because there are MANY ways to crack Fortres. Since FullArmor uses the registry ONLY, it is harder to crack (none of our technicians have been able to crack it, if the settings are correct)
BW