Help with setting up internet corner in school

[BigDaddy]

I am setting an internet corner in our school which will contain 4 identical computers.They will have 2 user accounts without any priviligies. The only difference between these 2 accounts will be the resolution. Since some of our students are handicapped.

And this is what I would need to do:

1. On every reboot the C partition should be restored. Thinking DEEPFREZE???

2. I will clone the WinXP computers with ACRONIS TRUE IMAGE. As I understand there is a program I must first run that will take care of issues such as MAC address and a unique PC number. Which program is this?

My primary concern about this PCs will be security. Since these PCs will not be monitored and students will have free access on them they must be 100% secure and they must not be allowed to turn off Antivirus, install any software, ...

So any other infos/help from U will be greatly appreciated.

Regards, Tomi

[Jeremy]

Doesn't the school have an Administrator that could take care of all that for you? Anyway, yes DeepFreeze would be the best option to make sure no changes can be made on the systems. HDD cloning could be done with Acronis or Ghost, though I've heard better things about Acronis and personally use this myself.

MAC address and "unique PC number" is called IP address. Upon plugging them into the router or switch or whatever you use at the school, they would attempt to obtain an IP address from the ISP.

As for security, if the OS is XP Professional then you can use the Group Policy Editor (gpedit.msc) to limit their access. Only allow them access to My Documents, remove Run and Control Panel from the Start Menu, disable Task Manager and Right-Click on the Desktop. Only allow launching of the shortcuts and only able to view specified websites/content.

There are already enough security measures built-in to XP so you don't need extra software to work with, many people think you do and it's unfortunate because many people spend a lot of money for programs that say they do this and that when all you need is a reliable source to help you learn the OS itself.

[nmX.Memnoch]

I have to throw out a recommendation for SiteKiosk. We've had a public access machine setup at work for about 2 years now running SiteKiosk. There hasn't been one single issue, security or otherwise, with that machine.

[BigDaddy]

Doesn't the school have an Administrator that could take care of all that for you?

Actually our so called administrator know very little about PCs. So I usually help him out. I do not even know how he got the job. But now he is old and waiting to go to pension...

MAC address and "unique PC number" is called IP address. Upon plugging them into the router or switch or whatever you use at the school, they would attempt to obtain an IP address from the ISP.

That I know, but I have heard that the is a program that I must launch prior to cloning the machine because there is a unique address written in WinXP and this would do havoc if I would put the clone to another PC. THe program I believe is called SYSPREP or something similar.

As for security, if the OS is XP Professional then you can use the Group Policy Editor (gpedit.msc) to limit their access. Only allow them access to My Documents, remove Run and Control Panel from the Start Menu, disable Task Manager and Right-Click on the Desktop. Only allow launching of the shortcuts and only able to view specified websites/content.

Where in GPEDIT.MSC are those settings?

There are already enough security measures built-in to XP so you don't need extra software to work with, many people think you do and it's unfortunate because many people spend a lot of money for programs that say they do this and that when all you need is a reliable source to help you learn the OS itself.

I2 don't want any extra third party stuff.

[Jeremy]

That I know, but I have heard that the is a program that I must launch prior to cloning the machine because there is a unique address written in WinXP and this would do havoc if I would put the clone to another PC. THe program I believe is called SYSPREP or something similar.

If all your PCs have the exact same hardware, then I don't believe it will be a problem. As far as I know, even SysPrep can't bend that rule.

Where in GPEDIT.MSC are those settings?

I'm not up to par on all those security settings myself but that's how they have it setup at my workplace and I've seen our Administrator in action. When he's working you just see all kinds of access permission boxes fly by because he's so used to doing it.

Either way, this file should show you more info.

[BigDaddy]

I read the file U have given me but I am still no closer to finding a solution.

I've created a new user account and assigned it the GUEST group.

1.This user is still able to uninstall programs thru ADD/REMOVE in Control Panel . How do I disable this?

2.When this user lunches Windows Explorer I wish the C and D partitions were hidden so he would only have access to My Documents and removable drives (cdroms, usb keys...), how do I do this?

3.How do I disable Task Manager and Right-Click on the Desktop, disable lunching control panel, or changing the start menu items, disable changing the resolution and adjusting the volume... Where do I set these setting?

Thank U in advance

[nmX.Memnoch]

That I know, but I have heard that the is a program that I must launch prior to cloning the machine because there is a unique address written in WinXP and this would do havoc if I would put the clone to another PC. THe program I believe is called SYSPREP or something similar.

If all your PCs have the exact same hardware, then I don't believe it will be a problem. As far as I know, even SysPrep can't bend that rule.

The problem is the machine SID. If you clone a bunch of machines and don't run SysPrep then they all have the same SID...this is a Bad Thing in a Domain/AD environment.

I know you don't want any 3rd party apps...but again, I strongly recommend taking a look at SiteKiosk. Grab the trial version and check it out.

[BigDaddy]

Found this prog:

Shared Computer Toolkit

I believe this will be of great help. Trying it now.

I know you don't want any 3rd party apps...but again, I strongly recommend taking a look at SiteKiosk. Grab the trial version and check it out.

Our school WILL NOT pay for any thrid party programs and piracy we will not do.

And also I believe WinXP is capable of the things I've written but I just don't know how to set them.

Edited March 15, 2007 by BigDaddy

[BigDaddy]

Shared Computer Toolkit works quite good but Windows Disk Protection won't work.

I opened a thread about it here:

http://www.msfn.org/board/index.php?showtopic=94631

Hopefully a solution will be found soon

[Idontwantspam]

As for restricting them (but not yourself!) you might want to check out this and this. The spreadsheet available at the second link lets you set a LOT of settings, and you don't even need XP Pro - it works on XP MCE, Win2k and even on XP Home I think some of the time. I just finished setting up an account on my computer for when it needs to be used by other not-so-trustworthy people. You can make it very hard for them to do much of anything - change their display properties, use Run, change the password, etc. Definitely good to check out, though you'll need some registry editing knowledge, and mine is somewhat limited. Another important thing for you to tell us is if you're on a domain or not. If these are stand-alone computers, things may be different.

[trickytwista]

excellent question and topic as i too is interested as i have just setup a couple of accounts for my 2 kids on my main pc for their online homework and im able to see within their accounts my main backup hard drive and i want it so its not viewable or accessable so they cannot delete or cause issues on my OS (xp pro). any of you guys that could be helpful is much appreciated asi certainly dont want to have to go buy extra software to do the job if xp is already capable of doing it already. i just want them to be able to be online but not to be able to install anything from the internet if thats at all impossible? thanks lads...gaz

[Idontwantspam]

Well, first of all, make sure they have "Limited" accounts. You probably knew that already, but just in case... XP has a bad habit of making users Administrators by default. How old are your kids? I would lock things up differently for a 4 year old than a 14 year old. You know, you can (I think??) set it so that they can only run certain approved programs. This would prevent them from running any installers, or computer games, or anything else not on the list, for that matter. Also, have them use Firefox instead of IE, if that's what they're using. IE is more likely to have security issues, and it crashes more, too. Unfortunately, it is harder to control the security settings for Firefox without them revoking those changes. Seems to me you could just use the security tab on the properties dialog to prevent them from accessing certain folders on the computer. Of course as limited users they won't be able to do much of anything to SYSTEM32, WINDOWS, Documents and Settings\anyOtherUser, Program Files, etc without getting a big ol' "Access Denied" box. Just a tip, don't make things too strict. It's soooo annoying when some control freak goes and locks things up so tight that you can't do ANYTHING. For example, don't go and disable the Task Manager, you need that to kill applications that crash. If they're any older than about 12, then they'll probably find a way to do what they want anyways, at least to an extent. Oh, and regardless, you should take away their ability to edit the registry. You don't want them screwing up the computer or changing settings, either on purpose or by accident.

[BigDaddy]

The internet corner is a huge success. The computers are working without any administration and everybody has access to them. It's been 4days now and not a single problem has happened on those computers.

MS Shared Computer Toolkit really does do a good job. I highly recommend it.

Edited March 23, 2007 by BigDaddy

[dwarfer]

Our school WILL NOT pay for any thrid party programs and piracy we will not do.

If you ever want to flawlessly set something like this up you will have to pay to bring someone in to do it for you. Also Impero is an excellent program to use in a school network.

[BigDaddy]

Our school WILL NOT pay for any thrid party programs and piracy we will not do.

If you ever want to flawlessly set something like this up you will have to pay to bring someone in to do it for you. Also Impero is an excellent program to use in a school network.

This program is everything that an admin could wish for. Tnx 4 bringing it to my attention.

But for our needs in school the Microsoft Shared Toolkit does a great job.