Safeguarding a PC from the student population!

bazpaul

Hey all security experts! I need advice!!!

I have had experiences in the past of the damage that can be done to computers when shared among friends and especially students with all there downloading, web surfing habits and eagerness to install unnecessary crap!!

Thus i have recently acquired a new laptop and theres not a sniff of me allowing any computer-tards to mess it up! So im gonna setup two accounts on windows, ADMIN and COMPUTER_TARDS. To save any rows im probably gonna call the computer_tard account the GUEST account. So here is so of my questions?

I have been using the group policy editor to restrict access to lots of stuff, drives, ctrl panel...etc However i am a bit of a tard myself and cannot find the difference between the ADMIN account and GUEST account when using gpedit.

1: In gpedit under UserCon..\AdminTemp... when you change access to programs and mess around with windows components, how do i only specify these changes for the guest account?? Basically I do want to change anythin in the GP editor for the ADMIN account but wanna change everything for the guest account!

2: When using the ADMN account one can set security access to any folder by right clicking and going to security tab. Is this the best way to restrict acess to certain folders?? Basically i dont want anyone to save to c:\ drive or anywhere on PC at all except for there MyDocuments folder.

3. I also might want to restrict access to people changing the start menu, or basically any settings on the start bar abd desktop. Can this be done?

4. I'm also seeking advice about protecting users from visiting unreliable (xxx, spyware, adware) sites! Because basically you tell people that they'll f*ck ur computer if they visit these sites, but no-one cares until your computer is virus ridden and unusable! I was thinkin of installing something like NetNanny. Is this a good website blocker? can anyone suggest any better? Also i suppose you can restrict the GUEST account from making any changes in NetNanny while the admin can change everything!

5. Finally, is this the best way to go about protecting ur computer? i was thinkin of doin away with the guest account and just creating another user, but restricting that using gpedit.msc


All i want is for the GUEST user to use the internet + some office programs + some games + be able to save to their MyDocuments folder. Everything else i want to restrict!!!

Any help, or helpful websites would be greatly appreciated. I couldnt find much sites in the way of 'User Policy'

cheers in advance

monkey tennis

It's a huge amount of work to try to lock down a Windows installation while still leaving a reasonable amount of functionality. I think you would have a far easier time if you installed something like Ubuntu and only let other people use this.

Capt'n Midnight

As I posted in the other thread you started on this topic ( best to wait until no answers before cross posting ) they have physical access to a windows machine, so they can own it anytime they want. They are students so they will know someone with a password reset disk.