Students are creating text document from the desktop, putting command.com in the first line of the file and saving the file as a batch file, .bat extension. Then their running it and getting to teacher files. I'm running a Windows Server 2003 Domain with XP clients. I need to 1) stop students from running the command line 2) stop the command line from running when a batch file is started 3) map shared printers for the students, and 4) map 1 shared network drive. Here's what I've done (with alot help from searching the knowledgebase at this site).
1) Under studentusers OU - I enabled "Prevent access to the command prompt" under User Config --> Administrative Templates --> System. The toggle for "Disable the command prompt processing also?" I have set to "Yes".
This fixes the problem with the command prompt AND the batch file on the desktop. The command prompt cannot be run either way. This takes care of the first 2 problems I'm having. But by not allowing a batch file to run I had no printers or shared drives being mapped for the students to use, because I was use a batch file with netuse to map the drives. So....
2) Under studentcomputers OU I went to Computer Configuration --> Windows Settings --> Scripts --> Startup. I added 2 scripts, 1 that maps network printers once a user logs in, and another one that maps one shared network drive. I then went into the properties of the individual user and deleted the logon_script on the "User Profile" page. This forces the 2 scripts to run at logon under computer config and should set everything up for the user - my problem it is not.
The printers show up, but if a teacher needed access to her printer, the teacher printers won't show up. Following is a vbscript that works for adding the student printers.
Set net = CreateObject("WScript.Network")
'Set default printer based on first 3 letters of computer name
Select Case left(net.ComputerName,3)
Script 2 - net use command I use for adding the drives in a batch file.
net use s: \\cchsfp1\shared
I also need this to work or switch it to a vbscript so it works when a student logs on. Teachers will log onto the same machine and their drives and printers need to be completely different.