Windows 2000 Professional Workstation Security 1

[rock7x7]

Warning- I am a newbie to network security but couldn't find a good thread here to answer my questions. Background:
We're running a designated, 8 SCSI DVD Drive, server tower with 8 workstations- I read in one of the threads win 2k non-server is ok since we're under the 10 client max (which actually did answer a question I had). Anyway, since the users are your normal, average, "barely out of high school aged", students they get curious or ornary upon occasion so we have found we have a need to lock them out of just about everything- properties for the desktop, start-up, shut-down, changing log-on/log-off/passwards, screen-savers... absolutely anything having to do with files, esp system stuff- you get the picture, right? Anyway, there are only 2 programs they need to be able to run and print from- otherwise we want them locked out so I don't have to run down there every 5 minutes to fix annoying (and potentially worse) things they have done just "messing around". Any help would be greatly appreciated! Here goes:
1- Can you get good security without installing W2k Advanced Pro SERVER on your server? This is a small LAN with no inet or attatchment to any other network- and I really don't want the added expense of buying w2k APS if I can help it.
2- After loading w2k Pro on all the workstations do you have to configure each client w/s seperately for everything you want to lock the user out of, by logging onto each station, or can/should this be done from the server? And would you log on as a user or administrator to do this?
3- Is the security I want to do possible using the NON server 2000 or do I need to go to the server version to get it?
3- Any really easy, step-by-step books you recommend?
Thanks in advance-
rock7x7

 

[FilthPig]

1 - You can get prety good security with win2k pro. Using Local Policies you can lock down your workstations pretty tightly. W2k Advanced Pro Server is not a product I've ever heard of. There's 2k Pro, 2k Server, 2k Advanced Server, and 2k Data Center Server.

2 - You will have to configure each client machine individually. Were you to install 2k server and have an active directory domain, you could do this all centrally using Group Policies.

3 - It's possible to use Local Policy settings to achieve these goals. However, as I stated above, you'll have to create these settings on each workstation individually. On such a small lan, it may very well be worth spending the time to save the money.

3a - Mastering Windows 2000 Professional or Mastering Windows 2000 Server - both by Mark Minasi, depending on which route you take. The books are very comprehensive, and can be understood by the beginner, but go into enough depth to be useful to the veteran too. Marc Creviere

 

[jovoian]

those 2 a great books to read.. if u are only using 10 or less wkst then just use all win2k pro, no need for server yet, except for network service like wins, dns etc...

1. do not give out the local admin accounts and passwords, 2. create either individual user accounts ( better for auditing) or use 1 user for all others to logon to.

3. in admin tools - local security policy .. use this tool to remove the shutdown- run menu and other access, also set up the auditing of the machine and others you want

4. for all drives-files or folders, remove the every group fom it and add appropriate grps and persons ie admin local and grp for full control, and the folders that they can access with RW permissions for the regular users local grp, for each workstation

and then browse thru those books to see what else you want to improve

 

[kjmattson]

2- Instead of configuring each workstation individually, configure one workstation exactly like you want it including policies and applications. Then get yourself a copy of some disk duplication software like Norton Ghost to copy the configuration to the other computers. Kevin Mattson
MCP