Solved

Computer Lockdown

Posted on 2011-03-19
9
454 Views
Last Modified: 2012-05-11
Computer on a DOMAIN (Windows Server 2003)
Computer has Windows 7 installed
Computer needs to be locked down, but some GPO's dont exist on DOMAIN
Computer would like to use LOCAL GPO's but our DOMAIN OU overrides local
Computer needs to have USER specific lockdown so when I logon as Domain Admin the LOCAL GPO isn't applied.

Thanks

Also is there a good policy kicking around somewhere will almost full lockdown used for just basic browsing kicking around?
0
Comment
Question by:kpltechgroup
  • 5
  • 4
9 Comments
 
LVL 3

Expert Comment

by:ServerGuyScott
ID: 35172280
You can mange windows 7 clients from a 2003 domain.

Great post on how to do it here: http://social.technet.microsoft.com/Forums/en-IE/winservermanager/thread/0bc09f58-983d-4e6f-8033-9ef59f8b8a9d 
0
 
LVL 5

Author Comment

by:kpltechgroup
ID: 35172283
I have access to the server but really dont want to mess anything up will this add the policies to the 2003 domain?
0
 
LVL 5

Author Comment

by:kpltechgroup
ID: 35172287
how do I populate the group policies over to windows 2003? Copy them from a windows 2008 R2 server??
0
Creating Instructional Tutorials  

For Any Use & On Any Platform

Contextual Guidance at the moment of need helps your employees/users adopt software o& achieve even the most complex tasks instantly. Boost knowledge retention, software adoption & employee engagement with easy solution.

 
LVL 3

Expert Comment

by:ServerGuyScott
ID: 35172294
Yes, that will allow you to mange everything from the domain (the best way to do it if you are talking about several windows 7 machines).

You best bet if you don't want to involve the domain controller is to make the users just regular users on the systems and set all of your "lock down" settings via the local security policy.

If you don't want site, domain, or OU policies to apply you'd have to block the GPO inheritance on the clients in Active Directory.
0
 
LVL 3

Expert Comment

by:ServerGuyScott
ID: 35172300
Windows 7 and Windows 2008 R2 supports enhancements that can be configured through Group Policy settings, and those settings are supported by domain controllers running Windows Server 2008 R2. To support these enhancements for an Active Directory service environment consisting of domain controllers running Windows Server 2003 or Windows Server 2003 R2, the Active Directory schema must be extended.
0
 
LVL 5

Author Comment

by:kpltechgroup
ID: 35172325
Why am I blocking GPO inheritance? would this affect the computers currently on the domain?
0
 
LVL 5

Author Comment

by:kpltechgroup
ID: 35172329
oh nevermind reread sounds good ok Ill try populating the windows 2k3 server

Ill post if i had and errors/questions
0
 
LVL 5

Author Comment

by:kpltechgroup
ID: 35172445
Ok so I've copied over the ADMX but dont know what to do next the scemas part.. ALSO will this do anything to my current GPO settings? i mean if i have a bunch of settings already configged for my xp machines will this affect them? How do I make active directory see the admx files?
0
 
LVL 3

Accepted Solution

by:
ServerGuyScott earned 500 total points
ID: 35172667
To extend the schmea review this info: http://technet.microsoft.com/en-us/library/cc773360%28WS.10%29.aspx 

As far as impact to older machines You'll then need to deploy the Client Side Extensions (from the link provided above) to all "older" systems, so that they are able to interpret some of the new schema. Extensions can be found here: http://support.microsoft.com/kb/943729 

0

Featured Post

Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you try to extract and to view the contents of a Microsoft Update Standalone Package (MSU) for Windows Vista, you cannot extract the files from the MSU. Here we are going to explain how to extract those hotfix details without using any third pa…
A quick guide on how to use Group Policy to create a custom power plan and set it active on Windows 7.
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
This Micro Tutorial will teach you the basics of configuring your computer to improve its speed. It will also teach you how to disable programs that are running in the background simultaneously. This will be demonstrated using Windows 7 operating…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question