Disabling floppy and CDROM drives

Sorry for giving only half of the answer, but don't have a W2K machine near me at present:
It's a setting in group policy. Make sure this is applied per USER and not per MACHINE (it can be in both parts of the policy), and of course for the OU where the normal users are in and the admins are not.

You don't specify your server infra. If it's also W2K with ADS, Group Policy is no problem of course. If it's NT domains, GPolicy _can_ be applied but then as a file on the server and with more tricks. And of course, it can also be applied through Novell NDS (ZENWorks) regardless of your other server infra.

Hope this helps,

- The Netherlands

Yep, the above method is good.

But there are two other changes that must be made.

You must make the C: drive the initial boot device in the BIOS (to stop people from booting from the CD or floppy...

...and you must password protect the BIOS.

Of course, if the user is reeeeeally keen to get in, then they'll open up the machine and reset the CMOS.

There's not much you can do about that unless you physically lock up the machine but the risk is low so you could probably live with it.

Cheers,
Tim.

There are also physical locks with keys that you can purchase and lock the drives.

Or you can do as I have done in public libraries before.... which is: take off the cover of the computer and physically unplug the power from the cd-rom and floppy drive. Our computers weren't locked, but there'd be no way for users to get at the insides without a Librarian noticing. When I needed access, I'd reconnect the power.