Employees are going to ruin me. Please help.

[Guest]

I have a computer I want to dedicate solely to an electronic timeclock. It
has programs and documents on it that I want to keep and be able to access
under Administrator login, but when logged in under Minions, I want my
employees to ONLY have access to this time clock program. How do I block
access to everything but this one shortcut on the desktop?

Thanks,

Arlen

 

[John John]

That is not as easy as you might think. Do a search on the net for
"Securing Public Computers" or "Securing Library Computers" for an
insight into the steps needed to properly secure public computers. As
long as the terminal/workstation is logged on some smart ass will find a
way to cause problems or undermine your security setup. You will have
to setup a user group for the Time Clock users and work your policies
and "Try" to deny them most everything else. It might be easier to get
a Real Time Clock device and plug it into the workstation (peripheral).
Then you retrieve the Time Clock information from the workstation.
The employees have absolutely no need to have access to the computer,
their attendance is recorded at the time clock. Other than that some
Time/attendance programs might have the type of feature you are looking
for built in. You'll need to lock everything from the BIOS on up,
consider that a disgruntled employee can simply power off/start the
workstation with a DOS utilities boot disk and completely wipe the hard
drive(s) in mere seconds!

John

 

[George Hester]

Group Policy

 

[lforbes]

Hi,

I have a computer I want to dedicate solely to an electronic
timeclock. It has programs and documents on it that I want to keep and
be able to access under Administrator login, but when logged in under
Minions, I want my employees to ONLY have access to this time clock
program. How do I block access to everything but this one shortcut on
the desktop?

This is done quite simply but it depends on whether it is connected to
a Domain or a Workgroup and the OS on the machine.

A workgroup makes things more complicated. However, you can use Group
Policy with W2K and WinXP Pro (not home) locally. Here are the
directions:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q293655

In a Domain, you need to use the Group Policy Loopback Mode for it to
affect only the one computer.
1> Create an OU for this computer and move computer into it.
2> Create a Group Policy for this Computer.
3> In Computer Config-Admin Templates-System-Group Policy - Enable
Group Policy Loopback Mode - With the REPLACE option.
4> In User Config-Admin Templates - Lock everything down here
including Hide all items on desktop (otherwise their roaming profile
icons will show). Don’t restrict the common start menu or common
startup.

Go to the machine. Under All Users Profile create a folder in the
start menu and put the icon in it. Under the startup folder in the
same profile, create a shortcut to the above folder with the
"maximized" in the properties of the shortcut

What will happen when users login is the folder you created will open.

If you don’t want access to the internet, you need to remove security
settings or block IP of machine in Proxy server etc.

Cheers,

Lara