group policy setting in active directory

[yak]

This is the first time I have set up a student lab this
size...I need help!! Win 2K server and 30 client win 2k
pro machines. I need to control the student usage ie: no
changing screen properties, disallowing the control panel
and the list goes on.
I have connected the domain server, activated active
directory and now at the stage where all computers in lab
are visible to each other within the domain I have created
for the lab. But cannot access/open the client computer
from the server..problem number one.
Second issue, I have been able to set a group policy
limiting the student access to specific properties and
functions on each local computer while logged onto lab
domain. But the administrator account also follows the
limitations the student user has been assigned!! How can I
specifically limit the student user and not the
Administrator which is also clumped in as a user?

I hope this request does make sense ....

 

[ptwilliams]

Second issue, I have been able to set a group policy limiting the student
access to specific properties and functions on each local computer while
logged onto lab domain. But the administrator account also follows the
limitations the student user has been assigned!! How can I specifically
limit the student user and not the Administrator which is also clumped in
as a user?

You don't do it via local policies; you do it via GPO's. This way, you can
exclude the Administrator, or filter it so that it only applies to certain
groups.

Basically, create an OU, and add (move) all student accounts into this OU.
Now right-click on the OU, go to the Group Policy tab, and configure the
lock-down settings as you did in your local policies on here.

Now your students will be locked down, and no one else will be as the GPO
applies to authenticated users at the OU level, which basically means anyone
in that OU.

But cannot access/open the client computer from the server..problem number

one.

I'm not sure I follow this. Can you elaborate for us please??

--

Paul Williams
_________________________________________
http://www.msresource.net


Join us in our new forums!
http://forums.msresource.net
_________________________________________


This is the first time I have set up a student lab this
size...I need help!! Win 2K server and 30 client win 2k
pro machines. I need to control the student usage ie: no
changing screen properties, disallowing the control panel
and the list goes on.
I have connected the domain server, activated active
directory and now at the stage where all computers in lab
are visible to each other within the domain I have created
for the lab. But cannot access/open the client computer
from the server..problem number one.
Second issue, I have been able to set a group policy
limiting the student access to specific properties and
functions on each local computer while logged onto lab
domain. But the administrator account also follows the
limitations the student user has been assigned!! How can I
specifically limit the student user and not the
Administrator which is also clumped in as a user?

I hope this request does make sense ....