how to lock down desktop for student users

I have 6 labs in my school. I use one login for these computer. it is setup as a roaming profile.

I am currently setting up OU's for each lab. This way I can map printers, and install specific programs.

The problem I am running into is when I push out programs through GPO, because of the profile that has been made a MAN profile, the option on the start menu and desktop disappear.

What I would like is a better way to lock down the desktop, so that the users cannot uninstall any programs or delete or change any of the preferences on the desktop. Basically I just want them to be able to use it, not change anything.

I know MAN profiles is one way to do it. But this is gonna get tedious remaining profiles after new programs are installed. To go through each and update the profile. I have to use different profiles, because of different programs on each lab computer. Hopefully this makes sense to someone.

Just to summarize

1. Lock down desktop, so users cannot uninstall anything nor change any of the desktop preferences.
2. A solution that doesn't involve roaming profiles.
3. A way to map printers depending on which OU the computer is located. If possible I would like to change the name of the printer, so the students understand better.

Thanks
Con366Asked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
ExTxCxCommented:
All of what you described can be accomplished using Group Policy.  Since you already have the OU structure in place, create additional ous for computer accounts. domain>LAB1>computers>accounts.

This will allow you to have differing policies (or the same) for each grade/lab.  Here is a link to an article that may help.

http://articles.techrepublic.com.com/5100-10878_11-1059493.html 
0
 
Con366Author Commented:
So if I push a program through GPO, and I have a GPo set to not save on exit. Will it not save the new programs on the start menu?
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
SysExpertCommented:
MS has an option that will do this.
SteadyState or similar.

I'll check
 
I hope this helps !
0
 
Con366Author Commented:
this will work, but there's gotta be a GPO that locks the desktop. Save on exit doesn't stop from being able to move icons, delete them, etc
0
 
Con366Author Commented:
Even if I use steady state, and choose the option to lock the profile to prevent changes. i am still wondering if I push apps through GPO will it save properly.

This would also require me to re image all these machines. And with no central control of steady state. It would require me to go to every machine, when i make a change to the profile.

0
 
Con366Author Commented:
Even if I use steady state, and choose the option to lock the profile to prevent changes. i am still wondering if I push apps through GPO will it save properly.

This would also require me to re image all these machines. And with no central control of steady state. It would require me to go to every machine, when i make a change to the profile.

0
 
Con366Author Commented:
Though everyone quit responding to this question. i will award the points
0
All Courses

From novice to tech pro — start learning today.