locked
Account Lockout - User Restriction - Active No Matter What? RRS feed

  • Question

  • I have used this tool ever since the Bill and Melinda Gates foundation made it or released it. 

     

    My problem with SS is this..   in setting the user restrictions (all those check boxes), they take effect instantly no matter what.  The previous version allowed me to make specific changes, however they did NOT take effect until I checked - LOCK PROFILE.  However, in this new version, the LOCK PROFILE check box is not checked yet the profile is locked down.  Why?  Also, this is a pain because any changes I have to make/customize to the profile - means I will have to turn off all customization and make my changes, then go back and recheck everything I want/do not want again.  Very time consuming and tedious.

     

    Why does the LOCK PROFILE not do what it says?  Why is the profile restricted immediately when I start checking boxes and not when I enable the "MASTER" lock?

     

    Would really like an answer to this.

    Monday, August 6, 2007 9:33 PM

Answers

  • Hi SpurtSpanker,

     

    In Shared Computer Toolkit (SCT), restrictions won’t take effect until you click the Apply button. In Windows SteadyState (WSS), the restrictions take effect when you click the OK button.

     

    The Lock Profile feature in SCT and WSS are identical: Lock profile removes users' changes to the user profile. Cache files, global history, and environment settings are cleared or restored to the default state. Thus, it has nothing to do with other restrictions’ apply. WSS restrictions can be applied no matter whether the account is locked. Even the user account is locked, we can still adjust restrictions from WSS.

     

    I understand that it will take some time to customize a user profile. Actually, to help customers set up a restricted account efficiently, WSS has included most of required restrictions which can be configured easily. If you have other requirements which are not included in WSS, you can set the profile as “No Restriction” first. When other changes are made from the inside of the account, you can select another restriction level and then customize the restrictions. At last, we can lock the user profile or enable WDP to keep the changes from modifying.

     

    You can also post your wishes on WSS here. I believe with customers’ valuable feedback and our product team’s hard work, more powerful features will be added to this product.

     

    Best Regards,

     

    Wednesday, August 8, 2007 3:09 AM

All replies

  • Hi SpurtSpanker,

     

    In Shared Computer Toolkit (SCT), restrictions won’t take effect until you click the Apply button. In Windows SteadyState (WSS), the restrictions take effect when you click the OK button.

     

    The Lock Profile feature in SCT and WSS are identical: Lock profile removes users' changes to the user profile. Cache files, global history, and environment settings are cleared or restored to the default state. Thus, it has nothing to do with other restrictions’ apply. WSS restrictions can be applied no matter whether the account is locked. Even the user account is locked, we can still adjust restrictions from WSS.

     

    I understand that it will take some time to customize a user profile. Actually, to help customers set up a restricted account efficiently, WSS has included most of required restrictions which can be configured easily. If you have other requirements which are not included in WSS, you can set the profile as “No Restriction” first. When other changes are made from the inside of the account, you can select another restriction level and then customize the restrictions. At last, we can lock the user profile or enable WDP to keep the changes from modifying.

     

    You can also post your wishes on WSS here. I believe with customers’ valuable feedback and our product team’s hard work, more powerful features will be added to this product.

     

    Best Regards,

     

    Wednesday, August 8, 2007 3:09 AM
  •  Shawn Shao - MSFT wrote:

    Hi SpurtSpanker,

     

    In Shared Computer Toolkit (SCT), restrictions won’t take effect until you click the Apply button. In Windows SteadyState (WSS), the restrictions take effect when you click the OK button.

     

    The Lock Profile feature in SCT and WSS are identical: Lock profile removes users' changes to the user profile. Cache files, global history, and environment settings are cleared or restored to the default state. Thus, it has nothing to do with other restrictions’ apply. WSS restrictions can be applied no matter whether the account is locked. Even the user account is locked, we can still adjust restrictions from WSS.

     

    I understand that it will take some time to customize a user profile. Actually, to help customers set up a restricted account efficiently, WSS has included most of required restrictions which can be configured easily. If you have other requirements which are not included in WSS, you can set the profile as “No Restriction” first. When other changes are made from the inside of the account, you can select another restriction level and then customize the restrictions. At last, we can lock the user profile or enable WDP to keep the changes from modifying.

     

    You can also post your wishes on WSS here. I believe with customers’ valuable feedback and our product team’s hard work, more powerful features will be added to this product.

     

    Best Regards,

     

     

    SCT and WSS lock feature are NOT the same.  In SCT, I check or uncheck the options I want however, they do NOT become active until I click on LOCK PROFILE and then apply them.  If I want to make a change to that profile, I UNLOCK it, log on and make my changes as if there is no protection.

     

    With WSS - I can NOT do the same thing.  I must get everything setup in the profile the way I want it then and only then can I apply the check or uncheck options.  Once I do that, the options take effect immediately.  There is a LOCK PROFILE option, but it DOES NOT work the same way as SCT. 

     

    Now, with WSS, in order for me to make any changes to the profile, I have to remove all restrictions and make my changes.  In order to put the restrictions back on, I have to go in an manually check or uncheck all the options all over again.  I have to do this ANY TIME I want to make a change to the profile.  There is no master on or off like SCT had.

     

    In SCT I was able to turn everything off, but my customizations stayed.  So I just flicked the switch (LOCK profile) and it turned the features back active again.

     

     

     

    There is something wrong with WSS because it does not do this at all.

    Monday, August 13, 2007 6:20 PM
  • Hi SpurtSpanker,

     

    I fully understand the inconvenience to turn off all restrictions, customize the user profile, and then apply all restrictions again. I will forward the feedback to our product group to check if they can make some changes to simplify the process.

     

    From your description, it seems that on your computer with SCT installed, other restrictions will not apply until you lock the user profile. Please understand that this is an unexpected behavior. Actually, other restrictions can also apply when the user account is unlocked.

     

    We can perform the following steps to test the issue:

     

    1. Install SCT. (If you have SteadyState installed, please temporarily uninstall it first)

    2. Create a new user TestSCT. Log on it to create user profile.

    3. Log off TestSCT. Log on with an administrator account.

    4. Open SCT, and select TestSCT account. Selected “Lock this profile” and “Recommended Restrictions for Shared Accounts” check boxes. Click Apply and log off.

    5. Log onto TestSCT. Restrictions should have been applied.

    6. Log to administrator again. Uncheck the “Lock this profile” option and click Apply.

    7. Log onto TestSCT again to verify the changes (such as Start menu & Windows Explorer etc.)

     

    Regards,

     

     

    Tuesday, August 14, 2007 9:42 AM
  •  

    That would be correct.  At least, that is how it was working for me
    Tuesday, August 14, 2007 10:35 PM
  • Have you tried the steps to make to test? Thus, we can determine how it works now.

     

    Regards,

    Wednesday, August 15, 2007 9:54 AM
  •  Shawn Shao - MSFT wrote:

    Have you tried the steps to make to test? Thus, we can determine how it works now.

     

    Regards,

     

    I will try later today.  I am slated to pickup a machine for setup and deploy of about 30 new machines.  So, I will test it there and see what the outcome is.  If a resolution can not be had with this and my other issue (another thread) then I will have to use the the original "Profile Security Tool" from the Bill and Melinda Gates foundation.  SCT and WSS have too many problems right now. 

    Wednesday, August 15, 2007 12:27 PM
  • Hi SpurtSpanker,

                  

    Thank you for your efforts in working closely with us. I understand that you encountered some problems in using SCT and SteadyState. As SCT and SteadyState provide many new features that are unavailable in the original profile security tool, if possible, we still suggest using the new version. If you need any further assistance, please post in the forum. We can work on the issue together.

     

    Best Regards,

    Thursday, August 16, 2007 6:49 AM