Topic: e-smith server and windows xp gpo's

[Michael]

Hi guys,
After having setup my first e-smith based server for a local school (excellent system btw, very cool. Very easy to setup and use too!), I'm trying to configure a few of the client computers, all windows xp pro, with gpo (group policy objects), and I know this may not be the perfect place to ask, but hey, if you never ask, you'll never know...
How can I setup security for all the clients so that if a pupil logs in, it locks everything down (no control panel, no messing with wallpaper), and if a teacher logs in limited control (to be decided) and total control for admin. Any ideas ? I've looked at the policy editor in windows, but it seems to just effect the whole system, rather then individual users or groups of users.

Also, is there anyway to create a "Template" user ? So that if in the future I had more pupil accounts, they would all copy there initial setup from this template automatically ?

Thankyou for your help and time guys,
Michael

[Jim Hale]

Recheck Poledit - we use it at the hospital so that regular users are locked down and IS can get in and do whatever we need to.

There IS a way to setup users accounts. If you have a default for the users and then individual accounts for the teachers, you shouldn't have any problems.

[Matt Q]

Hi Michael,

Here's my input: I know if you login to Windows as user JoeSchmoe, then run poledit, and set is as required, that will save those settings for JoeSchmoe. Then if you login as Teacher and run poledit, and set as required, it will save those settings for Teacher, and so on. I set this up on my PC at home, its quite nice to stop people breaking your PCs, but with enough determination they can still access Control Panel (as we used to do at College, tut, tut!).

I can't help you on the templates though. I'm sure there is a way, but I don't know about it without using Windows Server...

Matt

[Michael]

Hi Jim, Matt,
Thanks for the input - I knew you could use poledit to change the users rights/permissions etc.. but it doesn't seem to have any particular way of setting them for each user. The problem is that the e-smith server is the PDC, and I want to be able to set policys to be updated from there, because I have 16 machines (at first) to setup g-d knows how many users to setup. I would like some method of setting up restrictions based on a users group (restricted users, power users, administrators - the basic windows levels). But as far as I can see, you can't do this in e-smith server, because you need an actual windows server. Any ideas how to over come this ?

thanks
Michael

[Aaron]

Michael wrote:

> to setup. I would like some method of setting up restrictions
> based on a users group (restricted users, power users,
> administrators - the basic windows levels). But as far as I
> can see, you can't do this in e-smith server, because you
> need an actual windows server. Any ideas how to over come
> this ?

Michael, there is a HOWTO by Greg Zartman that includes setting the default UserGroup (Power, Admin, Guest, etc) when NT/XP machines log into the samba domain that you may find useful.

[Nathaniel Brown]

If you want to know all about how to user poedit etc. Look up Samba PDC poedit:

Here's Some links to Samba's Documentation:

http://us1.samba.org/samba/ftp/docs/htmldocs/samba-pdc-howto.html#AEN231
http://us1.samba.org/samba/ftp/docs/htmldocs/samba-pdc-faq.html#AEN180

[Ed]

Hi Aaron,

Do you happen to have a reference to where I can find this
"HOWTO by Greg Zartman "  I was not able to find it using the links in the forum.  Links are old...

Thanks,
Ed

[chris snow]

I'm trying to the same/similar thing.  I want individual accounts for each user, students and teachers (so everyone can save their work privately to their home directory).

Is this only possible with samba 3?

Anyone found Greg's howto?