Group Policy Practices

[DMWCSD]

I am pretty new to Group Policies, and was wondering if anyone could give me a little insight as to how I would use group policies to lock down a machine so that the users could, for example, not save data to any location other than their My Documents folder.

If you could also supply any information regarding a best practices type of scenario. I work for a school district, and the students often attempt to do some crazy things to these machines. I would like to be able to stop them from changing anything. It looks as though we may purchase Deep Freeze, but if it can be done through group policies it would save us a lot of money that we really do not have to spend.

Thanks for all of your help.

 

[markdmac]

You can do a lot with Group Policies, but when it comes to saving files locally you will also need to lock down the NTFS.

My suggestion would be to use Group Policy to lock down IE and Control Panel functions. Prevent the students from installing software etc.

I'd further suggest that you use XCACLS to lock down the file system. The nice thing about XCACLS is that you can script it, so work on one machine methodically and you can duplicate it on other machines in seconds.

I hope you find this post helpful.

Regards,

Mark