Windows Forum

Ask something
Discussion Locked

Group Policies

0 helpful
4 replies

by steven rosson 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

And yet ANOTHER installment in the "school network" series...

We have office computers, computer lab computers, student lounge computers, and teacher lounge computers. My goal is to set certain policies that will apply on different sets of computers which will give them their own settings. The problem is that we have four groups of users (students, teachers, office, and sysadmins) and four more of computers (students, teachers, office, and shared.) I am completely confused on how to create effective group policies for them. What I have done so far is created organizational units for them. There is a "Users" unit and a "Computers" unit, and each contains about four sub-units which then contain the given users or computers.

This seems to be a bit much ... there must be a simpler way to accomplish my goal without having to use eight separate group policies ... students should only be allowed to access STUDENT computers - not the ones in the teacher lounge or the office. Nobody except the office staff should be able to log into the office computers. But the office staff should also be log into the student computers (but not into the teacher computers.)

I would set the computer and user configuration for each user group, but the problem is that I want different computer configuration to apply when a certain user logs onto a different computer ... is this possible?

The other dilema was that I want certain aspects of the computer configuration to last permanently on allcomputers. For example, I ALWAYS want people to have to use CTRL+ALT+DEL when the login ... I NEVER want people to be able to shut down without logging in, and I'll be damned if I ever see that "Welcome to Windows" screen again. How can I set these up without them conflicting with the varying computer configurations of the users signing on different computers?

4 replies

by cg it

answering the last part is pretty cut and dried. Domain security setting will provide domain wide setting for users in requiring the CTL
+ALT+DEL and disabling the shutdown without loggin in. Desktop settings [mandatory profiles] can be taylored for groups of users or individual users[ mandatory being the same as roaming profiles]. Yes you can setup a roaming profile for a specific user who logs in on different computers and they will see their desktop just as if their loggin in on their own computer.

As far as setting up the different OU's and who's on first and where is what? It's always been a pain and will probably alway continue to be a pain [which is why IT techs have a job]. I will say this, I taylor group policy and user profiles [what a person can and can not do on the network and what a user sees and can not see, use and can not use on their desktop by individual user, regardless of what group their assigned to. It's detailed, time consuming, and a pain to maintain, butnetwork security comes first. I would rather deny someone access in error than grant someone access that maybe should have it.

by cg it

oops last part should read " than grant someone access that maybe should NOT have it". [eyes are going bad and arthritis is setting in]. further to set up additional domain security settings, logon to the domain controller as a admin. Open up admin tools from the control panel, then open domain security policies. click on local security policies, then on addtitional security settings. There you will find the CTL+ALT+DEL domain settings as well as disabling the shutdown without logging on locally setting. you can also set up floppy and CD useage restrictions where they also have to log on to use a floppy and CD [good idea].

This discussion is closed to new replies.