Security – Force screensaver lockout for multiple users on one Windows 7 PC

It's rare that a software package actually needs admin rights, but rather it's writing to an area of the registry or hard disk that admins normally have access to and other users do not. That might sound like nit-picking but its fundamental to nailing this issue.

You can use the process monitor edit: thanks grawity tools from Microsoft to monitor what the applications are doing, and allocate rights to those areas to the users. http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

You can then use Group Policies to apply security ACLs to both files and folders and parts of the registry. A common cause of this problem is the program writing to either/or it's installation folder in c:\program files, or its global settings on the machine registry under HKey Local Machine.

This is the exact use case for setting up a domain. I would HIGHLY recommend you do so. You'll be a much happier and saner admin when you do.

I take that back, since the students do own the laptops forcing them on the domain isn't such a good idea.

What I would do in your situation is this:

In the image setup a common admin UN/PW combo so that they all have a common admin account coming from the factory. Then, when you distribute the machines - and this is where it could get sticky as far as manpower - give a class on basic administration. Things like:

• How to change the admin password
• How to create your own limited account - and why it is a good reason to use that day to day
• How to setup file sharing
• How to access the school's student resources from the laptop
• Depending on the age of the students - where to get free development tools
  • Visual studio express
  • Eclipse

I would also talk to some of the more tech savvy students to see if they would be willing to volunteer time after school to help other students - basic tech support, re-image as needed, general help. Not only does that take some of the work load off you - but gives the students something to put on their resume / college applications if they choose to go into IT (or preferably go to college THEN into IT)

---

To address the control comment, just because they are on a domain doesn't mean you can't make the students group power users or local admins. In fact it would let you only set that on certain machines - so you could have a set they couldn't mess up.

---

For the user creation on login - you'd have to write some sort of hook into MSGINA i think - i've been out of education tech too long to know if that exists.

In any case, I would suggestion you look into something like deep freeze to prevent the machines from getting tooo messed up.