Users locking a w/s 1

[Steve1962]

We are currently running Windows 2000 and XP w/s on windows 2000 servers.
What would be the best way to stop users locking the workstation using the familiar Ctrl/alt/del.?
I read an article which told you how to use registry editor to disable the feature, does this mean I would have to go to each workstation to do this, or can it be done globally at the server? (All 300 users use the same profile, if that helps).
Also, is there an option in the Group Policy that would do the same thing, as this would make it easier.
Thanks

 

[theoxyde]

Although I don't have the answer to you question, I would like to recommend that you rethink your reason for wanting to do this. Windows is already insecure as it is... do you really want just anybody to be able to walk up to a machine and start mucking around? I just find it hard to imagine that an organization with 300 PCs doesn't have a need for security.

 

[Steve1962]

I get your point, but the w/s are pretty well tied down. The users are 12 to 16 year olds in a school, and the teachers want the 'lock workstation' feature disabling, as the kids find it a great joke at the end of every lesson, to lock the stations... The next class either have to call us over (very large school) to unlock the station, or it has to be reset, making it frustrating for the teachers. As we have no intention of letting the teachers have admin rights, this seemed like the only other option.

 

[Davetoo]

There is a GPO for this. User Configuration\Administrative Templates\System\Logon/Logoff\Disable Lock Computer.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[theoxyde]

My imagination stands corrected.

 

[Steve1962]

Thanks for the answer lander. I checked the area you suggested in the Policy, and discovered that the 'disable lock workstation' feature has already been enabled! Must have been set by the previous sys admin. So, the next question is, any idea why the workstations can still be locked?? (Hair starting to fall out now!)

Thanks in advance.

 

[Davetoo]

The workstations have to be in the OU to which the GPO is applied.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[Steve1962]

Thanks lander. I have a GPO called 'pupil', which is assigned to 5 different OU's (5 different pupil yeargroups). I have a separate OU for the staff. If I drop the workstations into one of the pupil OU's, what effect would that have when staff log on?
Or would it be better to create a new OU, put the workstations into it, create a new GPO on the new OU, and just enable 'disable lock workstation' feature? Would that work?

Thanks, you are so patient!

 

[bhphoto]

regards to do this on the WS side you can add these in the logon script:

User Key: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PoliciesSystem]
System Key: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\PoliciesSystem]
Value Name: DisableLockWorkstation
Data Type: REG_DWORD (DWORD Value)
Value Data: (0 = disabled, 1 = enabled)

note, Exit your registry, you may need to restart or log out of Windows for the change to take effect.

JoelB