Lockdown Client 1

[kelfuego]

I have a network that has been established for the use of our customers. I have locked the workstations down using a group policy and a mandatory profile which has been working pretty well up until recently. Apparently some of our more resourceful clients have figured out that if they pull the ethernet cable, boot the system and login on the cached profile then reconnect the wire they can bypass the policies being handed down by my server.

My question to you all is this--- How would i go about setting up the clients to not allow a logon, unless the domain is present?


Kelly Johnson MCP
Central City Concern

 

[porkchopexpress]

Off the top of my head what about these two settings.

Wait for remote user profile

http://www.microsoft.com/resources/...on/Windows/2000/server/reskit/en-us/gp/18.asp

Log users off when roaming profile fails

http://www.microsoft.com/resources/...on/Windows/2000/server/reskit/en-us/gp/21.asp

 

[porkchopexpress]

Ah think i've found it, if you set this to 0 then the clients won't cache credentials so they can't logon without a DC.

http://www.microsoft.com/technet/pr...elp/35958fa8-2e47-4cf9-9f11-5095e5b5525e.mspx

 

[kelfuego]

Thank you for your help---both of these are good solutions to the problem.

Kelly Johnson MCP
Central City Concern

 

[porkchopexpress]

No problem.

I might use this at a couple of sites my self.

 

[kelfuego]

Your second option appears to be more beneficial because of the error message that will be displayed. I could use the first, but if one of my associates is onsite and doesn't know or remember to expect to be logged off should something occur with the server it could cause confusion.

Anyway thank you again this will work perfectly for me.

Kelly Johnson MCP
Central City Concern