JulesKr

Ok.

Yes, it is w2k3 and up. It works a lot better than sus or the current official version of wsus. But it still leaves you every now and then with clients who fail to install a update. It is not the fault of WSUS 3, but it would be nice if it would help you with information to resolve the issue. Sometimes the client feedback ends up in dev/null. That's a problem.... Jules

Not wanting to start a yes or no discussion, I think I read all the posts in this thread of the original thread starter, and it does cover his/her questions. Jules

A locked down linux system isn't hard to use. For sure there are ready images for internet cafe use, maybe even including timed access or stuff like that. I have never been in the position where I had to use an Kiosk setup, but if I had to these would be my first things to do. It will never get infected by a virus (accept for the ram drive that is...) It will allways fire up mean and lean (and yes, clean). They will never be able to install their software themself, and have the next user with the 'benefits'. You can't install keyloggers, accept for the hardware ones. It is just impossible to lock a Windows system down any other way, it wil just collect garbage (and slow down) or it is 'hacked' in minutes if not seconds. Jules

It isn't about blocking the drive, it is about preventing the customer to be able to do illegal things. A Windows boot CD with a little ramdrive without harddisk will prevent disk WRITE access. Locking down USB ports for file transfer (like drivelock does) will prevent them to be able to hook up their own diskspace. It wil still allow to hook up webcams and stuff like that. But, all of the above only helps in your own shop. There is no sure way to prevent access to remote storage facilities. They will still be able to share and distribute, it's just not physical on a disk in your shop. Jules

I encountered the same problem, the whole documents and settings directory of one user was inaccessible, kept on complaining about insufficient access rights. Never found out what happened during patching (that was the time it occured). I was only able to copy all the data to a fat32 disk when running knoppix (linux with tools running from cd). Then I wiped the disk, ran a fresh install and restored the data. Jules

Ok, I think that will do the job.

Ok, can you tell me how to do that? Is there a tool I can use to create an ADM? Jules

Or even better, run a Linux image and lock it down for free.

Why don't you run Windows from a CD image, retract the drive a little, put in a blank front and go. There is commercial ware to block USB drives (drivelock I believe) and your image stays OK, your functionality also. Jules

I would like to be able to change the default file/directory list sorting setting, preferably through and ADM file via gpo. Registry key as last resort is possible... How to do it? Jules

Yes, something like that, I would like having something to generate output like that.

You can try TrueCrypt (its freeware, make a (hidden) volume and store your passwords there, or use a GnuPG encryption if you won't use a SecureLogon tool like the one above this reply Jules

Just stay at the XP level, it works there, it probably won't in Vista. Ride out the first two years, then reconsider. Jules

Is there some documentation or posibility to generate a complete layout of your policy settings just by the policy structure? Jules