Stop ALL Profiles from saving on Win2K Workstation

[fujiphoneguy]

Hi All,
I want to set up a lab computer to stop ALL profiles from saving locally...We don't use roaming profiles here (and don't want to; mix of personal and School-Owned machines), but I don't want each user that sits down to have his/her settings saved....all users should use the default profile (and things should be locked down using group policy.) I have played around with the GPO settings, but can't seem to get everyone to use the same profile without them being able to change it. Anyone?

 

[mlesniak]

You did not say whether you are using a networked pc or a stand alone one.
You could possibly try using a mandatory profile but this will still allow users to change the settings; it just doesn't save them. So every time that user logs in again the settings should revert back to the mandatory profile.
I don't know if that is good enough for you.
To create a mandatory profile rename the NTUSER.DAT to
%USERNAME%\NTUSER.MAN.

 

[fujiphoneguy]

Thanks for the info. We are in a networked environment. I think I looked into using mandatory profiles, but the problem is, I don't want the mandatory profiles to be stored in users' domain accounts, I only want to enforce the profile or policy on specific machines. We are a college, and students have their own machines in their dorm rooms that should not be subject to any kind of restriction.

 

[dvornik]

Just don't let them log on as themselves. Make all PCs logon automatically on the same "computerlab" account with a mandatory profile. If you dont use roaming profiles I don't see what the problem would be.

We also use a harddrive protection device in our lab called "centurian guard" that resets the C: drive to default on reboot so there are no changes whatsoever.

 

[fujiphoneguy]

Thanks dvornik,
We need to have users log on with their own Usernames....our Students have their personal H:\ drive (personal network storage) only they have access to, as well as other network drives that different groups of people have access to (based on Username.) We have used Fortress' CleanSlate in the past on Win98 Workstations in labs, but have had many issues with this software. We were going to try to get away from a third party software product and stay native Windows, but I have yet to find the right combination of security that will allow us to do this...

 

[dvornik]

OK, that's a different situation.

What we do is make them FTP to the drive from the lab (just one shortcut really) and logon with username/password to the drive. And they get directly into their folder with appropriate rights. My boss set it up so I don't know the details right now, can post it tomorrow if you are interested.


Centurian guard worth it's weight in gold as far as I am concerned. It's a hardware device that has a phisical key and prevents all changes to selected drives. We've used it for over 2 years in all our labs.

 

[fujiphoneguy]

Yes, any information on how that works would be great. Do you have a website I can check out for more info on the Centurian Guard?

 

[dvornik]

http://www.centuriontech.com/centurionguard.htm

I don't work for them. I work for Pratt Manhattan. We are happy with it, but you have to keep in mind - NO changes can be made to protected drives. So certain software that does require changes (c-dilla for instance in 3ds max) will need to be reconfigured appropriately.

 

[wolluf]

fujiphoneguy,

How many machines/users are we talking about? Another approach could be to set all the users on each machine to use the same mandatory profile.

So, set up said profile on one machine and copy it to all the others.

Asuming all machines need this setting for same users, set up a batch file with a net user entry for each user, eg:-

net user <username> /profilepath:&quot;C:\Documents and Settings\Default&quot;

Run batch file on each machine (if you've a lot, try using psexec - part of pstools, freeware from

http://www.sysinternals.com

- to start jobs on all machines from one).

 

[dvornik]

OK, what we do is run an FTP server on the file server.
Then just make a shortcut to ftp://guest@servername/ or something to that extent and name it &quot;Student Files&quot; or whatever. Guest doesn't have access so they get username and password prompt instead. When they log in they are directly in their home folder. Works for macs too, cause it's just FTP.