locked
Restrict computer to single user RRS feed

  • Question

  • Hello!  I am new to theSteadyState forum but I am hoping it can do this for me.  I am the IT support person for an alterante school and I have a request for a student to have a laptop with which to take notes.  We are using a WIndows Server 2003 environment.  It has to be networked so that this student can have access to his network documents.  I set up a user accout for the student to use on the laptop that restricts everything except Word and the printer.  Unfortunately, there is nothing stopping him from logging on to the laptop with his regular account.  I would like to restrict it so that only this one student accout (and the administrator, of course) can log on to the computer.  As a helpful byproduct, this woud also discourage anyone from stealing the laptop.  Can SteadyState do this?  Thanks

     

    Adam

    Wednesday, April 2, 2008 9:57 PM

Answers

  •  

    Hi Adam,

     

    Thanks for posting here!

     

    From the post, I'd like to confirm if you would like to disable the student's local administrator account to log on the laptop and only permits his restricted domain account. If this is the case, I consider we can also use SteadyState to restrict his local administrator account to use the computer, or we can change the account to power user/User group.

     

    If I have misunderstand you, please feel free to correct me. Thank you.

     

    Best regards,

    Monday, April 7, 2008 5:22 AM

All replies

  •  

    Hi Adam,

     

    Thanks for posting here!

     

    From the post, I'd like to confirm if you would like to disable the student's local administrator account to log on the laptop and only permits his restricted domain account. If this is the case, I consider we can also use SteadyState to restrict his local administrator account to use the computer, or we can change the account to power user/User group.

     

    If I have misunderstand you, please feel free to correct me. Thank you.

     

    Best regards,

    Monday, April 7, 2008 5:22 AM
  •  

    Sean-

     

    Thanks for the response.  Yes, I would like to restrict the laptop so that one student can log on to it with his restricted network account, and no other account (except maybe the local and network admistrator accounts) can get get on at all.  Can you give me a head start on how to make this happen with SteadyState?

     

    Thanks again

     

    Adam

    Monday, April 7, 2008 2:51 PM
  •  

    Hi Adam,

     

    Thanks for updating.

     

    Adam, I suggest we perform the following steps to restrict local Administrator account on the laptop.

     

    1.       Log on as the Windows SteadyState administrator.

    2.       Click Start, point to All Programs and then point to Windows SteadyState,

    3.       On the Windows SteadyState main dialog box, under User Settings, click the shared administrative user profile you created.

    4.       On the General tab, under General Settings, select the Lock profile to prevent the user from making permanent changes box.

    5.       On the Windows Restrictions tab, select the High restrictions option. Under Start Menu Restrictions in the list, you may want to leave all of the restrictions selected; clearing any of the restrictions may create a security risk for the shared computer. However, for individual nonstandard applications you can turn off some of these restrictions.

    6.       In the Hide Drives section, select the drives you want to hide from the restricted administrative user.

     

    For security on the shared computer, you may want to configure the following restrictions to limit a restricted administrator’s access to system files and program folders:

     

    ·                    On the Windows Restrictions tab, under General Restrictions in the list, select the Disable Notepad and WordPad check box. This will prohibit the restricted administrator user account from modifying critical scripts and batch files to bypass security.

    ·                    On the Windows Restrictions tab, under Start Menu Restrictions, select the Prevent programs in the All Users folder from appearing check box and the Remove the Help and Support icon check box. This will prevent programs from appearing on the Start menu when the restricted administrative user is logged on.

    ·                    On the Feature Restrictions tab, click the Microsoft Office Restrictions check box. This will prohibit the restricted administrator from running Microsoft Office programs that are unrelated to nonstandard applications that they are running.

     

    In this way, if the user uses the local (restricted) Administrator log on the computer, he is not able to change system settings. Let's see if this meets your need.

     

    Best regards,

    Tuesday, April 8, 2008 8:32 AM