Computer Write Access

I am dealing with a school right now that I got hired to come in and help with some computer issues...they are having a lot of problems with students installing software and downloading things from the internet and writing them to the HDD.

They are running Windows XP Professional. I thought of denying write access locally to the entire C: Drive, but they are using roaming profiles which means that the download of their profile from the server to C:/documents and settings would be denied. If I used a group policy for the student users, the same would happen. Write access to Documents and Settings is denied.

Also, I thought of denying access to write on the C drive and then allowing just the documents and settings folder, but the DENY is inherited in all sub directories and cannot be changed for certain directories.

Any ideas of something I can do? Has anyone dealt with simular issues?


Thanks.

 

all i can tell you is what my school did to countermine our efforts at installing games/etc on the local drives of the school PC's.

that was to allocate the Write permission only to a downloaded directory allocated to each student by student number and labelled drive H:\

afaik, this drive was stored on the server and each of the networked PC's had the Read permission to that drive.

those students accounts were Guest Type, and on reboot the PC deleted anything that was written to the C drive that was not a system or Windows File. in other words locally one could isntall something but on reboot it would have vanished.

i cannot pretend to know anything about how they set that up, and my experience is very limited in this type of thing, but i hope that something i have said sparked an idea in you.

sorry i cant be more help.

 

Well, when they log onto the computer their profiles right now, download to the documents and settings folder ...

Thanks for your comments, it's a start....

anyone else have any ideas?

 

I'm running the older Microsoft Shared ComputerToolkit on a 6 machine network in a dropin center--works well, but setup was a bit labor intensive.

MS has a new version called SteadyState--might be worth a look.

 

Does this work with roaming profiles ?