Securing it for the classrooms

[BigDaddy]

ATM our classroom consists of 8 PCs. They all have WXP installed and the QUEST account used for students to login.

But even at QUEST account users are still able to FUBAR with WinXP! They are allowed to install software and thus bring in lots of viruses...

This is what I would like to achieve.

FIrst I would set up the system the way I want to using the ADMINISTRATOR account!

And then create an account which would prohibit users installing software, changing the desktop background or start menu...

How would I go about securing windows?

ps. ATM am testing this at home thru VMWARE. So any reccomendations would be great

[Ctrl-X]

Check out the Shared Computer Toolkit for Windows XP.

[LLXX]

It's a "GUEST" account, not a "QUEST" account

You might want to take a look at state-restoration programs like DeepFreeze, basically they preserve the original state so the users can do whatever they want with the machine, but after one reboot all changes made are gone and the original state is reloaded. Viruses, malware, etc. all removed automatically.

Edited September 15, 2006 by LLXX

[Takeshi]

1. "Limited" user account CANNOT

install programs

make system-wide changes

...

2. prohibit users from installing software: software restrictions policy

3. prohibit users from changing the desktop background or start menu: GP

[CoffeeFiend]

Another vote for DeepFreeze. I don't like the app a whole lot, but for such PCs that people end up screwing up all the time (classrooms, internet cafes, problematic users, etc)., it works quite well. They won't be able to permanently change any config, viruses just can't do a thing, etc. One reboot and problem solved. It's decently priced too.

[Ctrl-X]

I don't know DeepFreeze, but the Shared Computer Toolkit does the same and is even more decently priced (free)

[fleamailman]

Anyone got link to 'shared computer toolket', also what happens if a student leaves a usb key or extenal harddrive in the comp on reboot, nothing I hope.

[Ctrl-X]

The link is in my first reply (post #2).

[uid0]

what happens if a student leaves a usb key or extenal harddrive in the comp on reboot, nothing I hope.

You'll have to lock down the boot order in the bios, and password protect it.

[breadandbubbles]

just google the "shared computer toolkit" to find it? its on the microsoft website.

i use the toolkit at home, and its great, but its definately not what you need.

the toolkit only puts ristrictions on the user, it does not protect the computer. you can control every aspect of the user experience, but spyware will still stick, and viruses will still happen.

Deep Freeze is the way to go. ive never been on a classroom computer wityhout it having been installed on it. Im on campus right now, and this computer has deep freeze.

deep freeze literally freezes the state of the computer, so you can make the computer EXACTLY the way you'd like it, and then you simply freeze it. when users log on, they can do pretty much everything they want, unless you restrict it using the toolkit. but that parts up to you. once the computer restarts, its exactly the way it was, and thats how it will remain except for the people who know the administrative password (you).

its not free, but its not too bad. for educational purposes, its probably around 10 - 15 bucks (american) per PC.

personally, id apply the toolkit first, without being too restrictive, since anything they do will go away with reboot, and then freeze it.

for Faronic's Deep Freeze, click here:

http://www.faronics.com/index.asp

for Microsofts Shared Computer Toolkit, click here:

http://www.microsoft.com/windowsxp/sharedaccess/default.mspx

hope this helps!

[Ctrl-X]

i use the toolkit at home, and its great, but its definately not what you need.

the toolkit only puts ristrictions on the user, it does not protect the computer. you can control every aspect of the user experience, but spyware will still stick, and viruses will still happen.

Now I'm confused... According to the documentation, the Windows Disk Protection component of the Toolkit clears all disk changes when the system restarts. This would effectively remove all viruses, spyware and what not.

for Microsofts Shared Computer Toolkit, click here:

http://www.microsoft.com/windowsxp/sharedaccess/default.mspx

Like I said, the link was in my first reply... Maybe I shouldn't create "nice looking" links and stick to links that actually say http-etcetera

[LLXX]

Do be aware that if they're determined enough, even DeepFreeze and a passworded BIOS isn't going to stop them from doing what they want. I've done this several times with public computers... usually clearing the BIOS password or using one of the well-known master passwords to get it to boot from my USB drive so I can use my own environment.

[mmarable]

We use the Shared Computer Toolkit here at work. Yes, the Windows Disk Protection blocks anything from beting written to the system drive unless it is overriden.

It works well in a domain environment like ours but it's even better in workgroup setups.

It's free and it does the job well. It uses HTAs to make modifying the Registry to do things like block access to the Control Panel, or hiding/blocking access to the drives in Exploer, easy. If you're in a domain environment Microsoft has included a custom ADM so you can set everything via GPOs.

[Locutus of Borg]

Another vote for DeepFreeze. I don't like the app a whole lot, but for such PCs that people end up screwing up all the time (classrooms, internet cafes, problematic users, etc)., it works quite well. They won't be able to permanently change any config, viruses just can't do a thing, etc. One reboot and problem solved. It's decently priced too.

sorry for reviving old topic. i have to say something about deep freeze....

there are trojans which CAN infect computer, even if it is frozen, it infects all partitions and make autorun.inf in root directory of partition... when you need to install something, you must be very careful, the first moments you UnFreeze computer, and even accidentally open infected partition, system partition will be also infected...

[PC_LOAD_LETTER]

ok this has been discussed at least once in the 2 years that this topic layed dormant but but just to summarize, Deepfreeze IS NOT AND NEVER HAS BEEN AN ANTIVIRUS REPLACEMENT.

as for infecting a frozen machine, the only way for a file to stay on the machine after a reboot is for it to have a multiple drives/partitions and one or more has to be unfrozen at the time of infection.

also the shared PC toolkit is now know as windows SteadyState and is an awesome free alternative to Deepfreeze (though they have very different feature sets)