Logon Scripts and Permissions and Such

[spizotfl]

Hi, I am what you would call a Newb at scripting. I have managed to cobble together from many sources on the web a script that mostly works for me.
Here is what I am going for:
We have a school environment with about 25 pcs. Due to the learning software that they use, we can't lock down the pcs as much as I would like. I am trying to find a way to delete the crap that gets added to the desktop and restore the things that should be on the desktop. Getting rid of the stuff is relatively easy, but getting the proper things back is causing me problems. Right now I am trying to pull the icons out of a different profile and copy them to the proper location, but this doesn't work when running in the security context of the user. I tried setting it as the login script in the group policy, but same issue.
The question is: is there a way to get around this security restriction (assuming that is the issue at hand) short of making a folder with all of the shortcuts and giving the students permissions on that folder. I don't want to allow them to do anything more than they already can on these boxes, and the people at the site don't seem to understand that they need to keep an eye on the kids to prevent them from needing us to restore the boxes on a regular basis.
Thanks for any help,
Mike

"Maturity is a bitter disappointment for which no remedy exists, unless laughter can be said to remedy anything."
-Vonnegut

 

[spizotfl]

Oh yeh, the server is Server 2003 and the clients are XP SP2.

"Maturity is a bitter disappointment for which no remedy exists, unless laughter can be said to remedy anything."
-Vonnegut

 

[markdmac]

I would suggest you take one PC and lock it down tight. Then edit the program folder for the educational software and set NTFS permissions so the Users group has write rights to it. Next open Regedit and navigate to the reg keys for that software and assign Users group full control of the registry keys.

THis tends to work well for poorly written software. It lets the software think the user is an admin while preventing them from doing other admin tasks.

You might also want to look at using mandatory profiles. These would ensure your users only have the icons that you put in the mandatory profile.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[BillDoor]

At my firm, we have around 1000 users, and each one of them gets the same mandatory profile.

Obviously some software in only available on certain PCs, so for those, we hide the icons in the Start Menu and use the Logon Script to unhide them.

The same logon script also applies Current User Registry settings held on the user's H drive. (The logoff script exports the registry setting to the H drive, so that changes are saved).

It was a lot of work to setup, but it now works great, everyone has a standard desktop, so everyone can go to any PC and know whats what.