Docs and Settings on Pro Domain Controlled Computers

[Zylstra]

At my school, I am technically a network administrator, but, in order to avoid breaking anything, I never do network side things... still, heres one thing that has been a bit of a problem:

About, oh, 200 usernames or so... and a lot of people who download things they shouldent. Is it possible to have the computers just automatically delete all local user profiles except for "Administrator" and "All Users"?

All our computers are running either Windows 2000 or XP. Server version is 2003.

Also, is it possible to prevent users from opening certain programs on computers? Were getting a lot of problems of students downloading a program called "MP3 Rocket", and it would be nice if it were possible to, in a sense, "block" processes.

[Geek-9pm]

You can have different user types in Windows. Also, you can set up the router to block some download sites.

And that can be done on the PCs using the 'hosts' file.

That might be the way to go if you know the names of the sites.
Look here:
http://www.computerhope.com/search.htm?cx=003411668307610607965%3Ah4yba8pbdco&cof=FORID%3A9%3BNB%3A1&q=hosts+file&sa=Search#1188

Read the one about the HOSTS file.

[Zylstra]

We use Sonic Wall, I'll see about blocking the site.
Its a very good firewall, I must say.

MP3 rocket, in itself, wont slow down the computers, though it contains ads when run, however, people often download viruses, spyware, and aware along with their music...

[BC_Programmer]

not to mention they are likely downloading music illegally which can put you in a bit of a spot.

If I recall, my old high school, and elementary school both gave each student a network share, and additionally all operations on the network were audited. Strangely even with this heavy auditing I was still able to download many things I probably should not have been able too.


One possibility, aside from blocking the download site, is to setup a direct association with the programs exe file- for example, right now it would use execute "%1 %*" or the executable itself- instead, add a key to HKEY_CLASSES_ROOT that is the name of the program to block, change the default value in Shell\Open\Command to be "", or, optionally it could reference a program that displays a messagebox saying the program has been blocked, but you never want to give them too much information- that's when they get crafty

[Geek-9pm]

...but you never want to give them too much information
- that's when they get crafty

Now we know, BC. You are a Microsoft spy.

[BC_Programmer]

My secret has been revealed! Now I must kill you all 

[Zylstra]

Okay, so, what about deleting Documents and Settings local profile folders, except Administrator and All Users?

As for MP3 Rocket, I think blocking the web address will be fine... We can do a search on student folders for the program file, and just delete it...
Someone tried to install an entire 3D game on the network drive once... need to track that down and delete it too...

The reason for clearing out Documents and Settings is probably something that already occurred to you all:
A lot of people heavily browse the internet, which not only adds up in temporary files, but, in downloaded files and images as well, and people save larger documents to the computers themselves as well. None of these files need to be kept, and the computers seem to run faster when they are not present.

[BC_Programmer]

Actually, I just remembered what my old school use.


Deep freeze.

the students could format the drive- reboot- and all was well again. I found it impressive. except for those times I rendered my 3d-animations to the C: drive and W2k crashed....

[Zylstra]

Would that be a free program?
Relatively easy?

That would be nice, but, if say, I installed SP3, and restarted, and SP3 was gone, that could be a problem...

[BC_Programmer]

Would that be a free program?
Relatively easy?

That would be nice, but, if say, I installed SP3, and restarted, and SP3 was gone, that could be a problem...

I'm not sure if it's free.. I don't think so.


but it would be ideal if it was- as per the sp3 issue when performing admin tasks such as ghosting or installing service packs you "thaw" the machine. then when you freeze it again it stays in the same state no matter what.


I did find this:

http://blogs.techrepublic.com.com/window-on-windows/?p=505&tag=nl.e064


looks interesting...

[Zylstra]

Huh...

I think I know exactly how it works, since Windows 7 has that option on non-admin accounts,

Specified accounts can be configured to just delete settings and changes on logout, it immediately goes back to what it was before the login.

I'll give that information to our tech guy for him to mull over...

[patio]

Take a look at Sanboxie...there is a Free version but you have to hunt for it.

[Zylstra]

Take a look at Sanboxie...there is a Free version but you have to hunt for it.

Thats free for schools, then?

One possibility, aside from blocking the download site, is to setup a direct association with the programs exe file- for example, right now it would use execute "%1 %*" or the executable itself- instead, add a key to HKEY_CLASSES_ROOT that is the name of the program to block, change the default value in Shell\Open\Command to be "", or, optionally it could reference a program that displays a messagebox saying the program has been blocked, but you never want to give them too much information- that's when they get crafty

So, what and where would I put that in the registry?

[BC_Programmer]

HKEY_CLASSES_ROOT, create a key that is the same name as the executable to wish to prevent from running.

you'll end up creating a key:


HKEY_CLASSES_ROOT\mp3rocket.exe\shell\open\command


make the default value of this the command line you really want executed when this program is double-clicked. I would simply go with a blank association, but you could also log this activity for auditing purposes, if desired.


By creating a REG file you should be able to merge this with the registry of each PC. And of course you can add different executable files to the list.