locked
Setup multiple users for a school RRS feed

  • Question

  • Hello everybody,

    I would need some advice to set up Windows Steady State for a school where all the students have their own account on the network.
    Actually, for each computer, there are two ways to log in. First one using the computer account and the second one using an account on the network. How can I set up WSS for this type of account knowing that there are more than 250 individual accounts. The students can work on the computer using their own account. Hope everybody can understand.
    Thank you for your help.
    Mike Lihault
    Tuesday, January 13, 2009 8:33 PM

Answers

  •  

    Hi Mike, do you mean those students' accounts are in a domain environment? I would like to inform you that Windows SteadyState cannot detect domain users in its UI which means domain users do not appear in User Settings in SteadyState.

    Thursday, January 15, 2009 6:54 AM

All replies

  •  

    Hi Mike, do you mean those students' accounts are in a domain environment? I would like to inform you that Windows SteadyState cannot detect domain users in its UI which means domain users do not appear in User Settings in SteadyState.

    Thursday, January 15, 2009 6:54 AM
  • Hello Sean Zhu,

     

    Thanks for your reply. Yes, the accounts are in a domain called SLIS. Each students and teachers have their own accounts and they can access a computer with their own login and password.

    You are telling me that there are no means to block the access to the main drive with Windows Steady State. I tried with gpedit.msc and it works well except that sometimes I, as the administrator, get blocked too.

    Do you know another way ?

    Thanks again.

    Regards,

    Manatahiti

     

    Tuesday, January 20, 2009 12:46 AM
  •  

    Hi Mike, thanks for the update. Do you mean you want to make the share folders on each computer available and those users can find them in Network share? If this is the case, you can uncheck the restrictions on Set Computer Restrictions and see the result.

    Tuesday, January 20, 2009 7:25 AM
  • Hi Sean,
    In reality, students and teachers have only one way of accessing a computer and it is through their domain login and password. Moreover, they each have an account on the domain to save their documents.
    Now, I would like to lock the computer's hard drive to avoid any modification and Windows Steadystate was very good at this. I used it for a computer room that did not have any outside connexion (network or internet or domain) and it works fine. The whole problem is the domain. Can you tell me if it is going to work with Windows Steadystate ?
    Thanks again for your time.
    Regards,
    Mike
    Tuesday, January 20, 2009 10:53 PM
  •  

    Yes, Windows SteadyState can be used under domain environment. You can see the following paragraph in SteadyState handbook:

     

    The Active Directory® directory service offers significant benefits for shared computers on a network. Active Directory gives network users controlled access to resources anywhere on the network by using a single set of credentials. It also provides network administrators with an intuitive, hierarchical view of the network, and a single point of administration for all network objects.

    Active Directory provides an environment for centrally managing user accounts that require access to network resources.  In this environment, users must log on with the same credentials on multiple computers, as many educational institutions require. For these reasons, Windows SteadyState has been designed to work as favorably in domain environments as it does for workgroup computers.

    Please note that most of the settings and restrictions available in Windows SteadyState are also available through the Group Policy template (SCTSettings.adm) provided with Windows SteadyState. When considering the installation of Windows SteadyState on shared computers that are connected to a domain network, Group Policy is more effective than using Windows SteadyState for restricting multiple user accounts across numerous computers on a domain network.

     

    For detailed information, please download and check the handbook via:

     

    http://www.microsoft.com/downloads/details.aspx?FamilyId=F829BB8B-C7A9-426B-A7A4-2B504A6238D2&displaylang=en

     

    Hope this helps!

    Wednesday, January 21, 2009 1:42 AM
  • Thank you Sean,

    I will check this next week. Hope it works fine then I have to make an image of it for 12 other computers.
    Thanks again.
    Mike
    Friday, January 23, 2009 11:49 PM
  • Hello Sean,

     

    I started to work on one of the twelve computers I have to install with Windows Steadystate but I am encountering another problem.

    On each of those computers, there are several ways to login :

    * either as "Students" using the computer

    * either as "manager" still using the computer

     * either as "manager" using the domain

    * either as different users using the domain

    I read the handbook in French and I decided go ahead using what is written in page 72 : create one profil for several users. The problem is that if I install Windows Steadystate using the manager profil on the computer it will not appear when I use the manage on the domain and vice versa. Do I have to install Windows Steadystate twice ?

    Please help me and tell me what to do.

    Many thanks.

    Regards,

    Mike

    Tuesday, February 3, 2009 9:07 PM
  • Hello Sean,

     

    I started to work on one of the twelve computers I have to install with Windows Steadystate but I am encountering another problem.

    On each of those computers, there are several ways to login :

    * either as "Students" using the computer

    * either as "manager" still using the computer

     * either as "manager" using the domain

    * either as different users using the domain

    I read the handbook in French and I decided go ahead using what is written in page 72 : create one profil for several users. The problem is that if I install Windows Steadystate using the manager profil on the computer it will not appear when I use the manage on the domain and vice versa. Do I have to install Windows Steadystate twice ?

    Please help me and tell me what to do.

    Many thanks.

    Regards,

    Mike

    Wednesday, February 4, 2009 6:51 PM
  •  

    Hi Mike, you can create a shortcut of Windows Steadystate on the user's desktop and add this account to local administrator group.


    Sean Zhu - MSFT
    Thursday, February 5, 2009 7:26 AM
  • Hi Sean,

    I really appreciate your help. Thanks a lot.
    I was finally able to get the shorcut but there is one problem. How can I set different parameters for users on the domain and simple computer users ? I tried to copy the parameters of one user to the default user applied to all users (as said on page 75 and 76) but this solution is not good because some of our software do not work on network computers. Therefore I have to install them on the "stand alone" computer. I hope you understand because it is pretty hard to translate technical words from French to English. For instance, Loghorest is a hostelry software. The students have to log in as simple stand alone user "Students" to use it. Therefore they can not share files. On the contrary, Open Office is a software which works well on network computers and the students can share files on the domain using their own account log in. I would like to apply the same restrictions to the single "students" account and to all the domain accounts.

    After I finish this mail, I will try to get the handbook in english so we will be on the same level. I hope you can still help me on this.

    Thanks very much.

    Mike

    Friday, February 6, 2009 6:59 PM
  •  

    Thanks for the update, Mike. I’d like to inform you that Windows SteadyState does not detect domain users in its "User Settings". If you want to apply restrictions on domain users, you can try SCTsettings.adm. You can check the following paragraph on handbook:

     

    Creating Group Policy Restrictions with SCTSettings.adm

    Windows SteadyState includes a Group Policy template called SCTSettings.adm in the ADM folder commonly located in C:\Program Files\Windows SteadyState. This template reproduces most of the settings included in Windows SteadyState Feature Restrictions tab of the User Settings dialog box, and can be used to deploy restrictions to users who are members of an Active Directory domain.

    Group Policy for a domain can be configured either with the Group Policy Management Console, an add-in tool available for download from Microsoft, or by using the Group Policy Editor built into Active Directory Users and Computers. By adding the SCTSettings.adm template into these tools, you gain access to account restrictions and settings that are appropriate for user accounts on shared computers.

    The SCTSettings.adm Group Policy template included with Windows SteadyState also includes the capability to set idle and mandatory logoff timers, if Windows SteadyState is installed on your computers.

    It is important that you apply these settings only to specific user accounts, so as not to restrict legitimate administrative user accounts on any computers.

     

    For detailed information and steps, you can check page 63 on the handbook.


    Sean Zhu - MSFT
    Monday, February 9, 2009 6:41 AM
  • Hello Sean,

    I am getting to it but I still have one more question.
    I was able to get to the SCTSettings.adm templates and modify them but I got blocked after. In the handbook, it is said that it is important to apply these settings only to specific user account. How can I do that ? How can I specify that these setting are only for domain users?
    With these settings, can I block the installation of new program (software) and can I get the computer to cancel all modifications when users log off ?
    Thanks again for your help. The handbook explains things but it is not very clear.
    Regards,
    Mike
    Monday, February 9, 2009 9:53 PM
  • Hi Mike, we recommend that you create an OU that stores the shared user accounts in your environment, and that you apply the SCTSettings.adm template to the User Configuration portion of a Group Policy Object linked to this dedicated OU. As this is also related to AD domain knowledge, you can check the following article:

     

    Create a new organizational unit: Active Directory

    http://technet.microsoft.com/en-us/library/cc785077.aspx

     

    For other AD related issues, you can also post in the following forum:

    http://social.technet.microsoft.com/Forums/en-US/winserverDS/threads/   

     

    If you want to block installation of programs and cancel modifications when users log off, you still need to install Windows SteadyState on clients. This function does not include in SCTSettings.adm.


    Sean Zhu - MSFT
    Tuesday, February 10, 2009 7:16 AM