Custom User Profile Setup Request - pls help

[NoNameHere]

I would like your thoughts on the following custom user setup
scenario.

System: 1 Windows 2003 Standard Server (AD, File/Print, Exchange)
20 Dell PCs, with 20 more in the next year

The owner of the company is requesting the following type of setup for
his user account:

- a roaming profile
- all financial files on a shared drive
- if the owner's computer is idle for more than 2 minutes, log off the
owner
- password-based encryption system for all files on the share drive

The owner has 2 assistants. Each assistant has the owner's password,
for a bunch of legitimate reasons. So, the owner wants the files on
his share drive to be password-protected, with a password that only
the owner knows. That way, assistants can't access the shared drive,
but can access all other owner documents (medical records, owner
email, memos, etc...) without any restriction.

The owner also is very busy. He gets up from a PC on a moments notice
to go into surgery, or perform an examination. Thus, he wants his PC
to log off after 2 minutes of inactivity. This will ensure that
changes to his profile are saved quickly, so when the owner logs onto
another computer in a different office, his changes are all there.

Any thoughts on how to setup these requirements? My thoughts included
the following:

- setup roaming profile
- setup a single logon restriction on the owner's account
- custom logon script for owner that installs: custom font, a program
that will log off a computer after 2 minutes of inactivity, and a
program for password-based file-based encryption

 

[Matt Anderson]

I would like your thoughts on the following custom user setup
scenario.

System: 1 Windows 2003 Standard Server (AD, File/Print, Exchange)
20 Dell PCs, with 20 more in the next year

The owner of the company is requesting the following type of setup for
his user account:

- a roaming profile
- all financial files on a shared drive
- if the owner's computer is idle for more than 2 minutes, log off the
owner
- password-based encryption system for all files on the share drive

The owner has 2 assistants. Each assistant has the owner's password,
for a bunch of legitimate reasons. So, the owner wants the files on
his share drive to be password-protected, with a password that only
the owner knows. That way, assistants can't access the shared drive,
but can access all other owner documents (medical records, owner
email, memos, etc...) without any restriction.

The owner also is very busy. He gets up from a PC on a moments notice
to go into surgery, or perform an examination. Thus, he wants his PC
to log off after 2 minutes of inactivity. This will ensure that
changes to his profile are saved quickly, so when the owner logs onto
another computer in a different office, his changes are all there.

Any thoughts on how to setup these requirements? My thoughts included
the following:

- setup roaming profile
- setup a single logon restriction on the owner's account I don't think that's possible.
- custom logon script for owner that installs: custom font, a program
that will log off a computer after 2 minutes of inactivity, and a I don't think that's possible.
program for password-based file-based encryption

Matt
MCT, MCSE

 

[Dan]

You can have a GPO that will log off a user after X amount, but then you
would need to setup that GPO to mirror the MY documents folder and have him
store files his personal files in that..

Same concept applyed here, personal files are stored in my document which is
stored out on the server. GPO is set to cause a computer to either lock out
or logout take your pick.

As for installing fonts and what not, best to install it on all the
computers he will be on.

 

[jas0n]

The owner also is very busy.

The owner is also unreasonable!

Would he want the PC to log him off as he sits and reads a document on
screen!

Id guess there are security products out there that would help in this
scenario. Ones that either lock the screen (not quite what he wants) or
logs someone off when they walk away from their computer and are no
longer in the vacinity of some radio device attached to the PC but ive
never used them myself.