HELP users bypassing restrictions

Some users are bypassing restrictions set by unplugging the network cable
after logging in when the server is loading the settings and then plugging it
back in. As an example, when they have unplugged the network cable during
loading, they can lock the PC which they could not if they leave the cable
plugged in during login, this was one restriction set. It only affects some
settings, not all. Has anyone got any ideas on how to solve the problem
without having to superglue the network cables in.

Thanks

John

The solution is:

1. Users have Bosses
2. Bosses can fire or punish Users
3. Computers are not the Bosses.
4. Software isn't going to stop someone from pulling the cable.

If a company can not (or is unwilling) to control its employees then it will
never stay in business.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/IS...cessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/t...dance/2004.asp
http://www.microsoft.com/isaserver/t...dance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp
-----------------------------------------------------


"John" <(E-Mail Removed)> wrote in message
news:A029914A-280D-45E2-BBE3-(E-Mail Removed)...
> Some users are bypassing restrictions set by unplugging the network cable
> after logging in when the server is loading the settings and then plugging
it
> back in. As an example, when they have unplugged the network cable during
> loading, they can lock the PC which they could not if they leave the cable
> plugged in during login, this was one restriction set. It only affects
some
> settings, not all. Has anyone got any ideas on how to solve the problem
> without having to superglue the network cables in.
>
> Thanks
>
> John

Unfortunatley the users are students.

"Phillip Windell" wrote:

> The solution is:
>
> 1. Users have Bosses
> 2. Bosses can fire or punish Users
> 3. Computers are not the Bosses.
> 4. Software isn't going to stop someone from pulling the cable.
>
> If a company can not (or is unwilling) to control its employees then it will
> never stay in business.
>
> --
> Phillip Windell [MCP, MVP, CCNA]
> www.wandtv.com
> -----------------------------------------------------
> Understanding the ISA 2004 Access Rule Processing
> http://www.isaserver.org/articles/IS...cessRules.html
>
> Microsoft Internet Security & Acceleration Server: Guidance
> http://www.microsoft.com/isaserver/t...dance/2004.asp
> http://www.microsoft.com/isaserver/t...dance/2000.asp
>
> Microsoft Internet Security & Acceleration Server: Partners
> http://www.microsoft.com/isaserver/partners/default.asp
> -----------------------------------------------------
>
>
> "John" <(E-Mail Removed)> wrote in message
> news:A029914A-280D-45E2-BBE3-(E-Mail Removed)...
> > Some users are bypassing restrictions set by unplugging the network cable
> > after logging in when the server is loading the settings and then plugging
> it
> > back in. As an example, when they have unplugged the network cable during
> > loading, they can lock the PC which they could not if they leave the cable
> > plugged in during login, this was one restriction set. It only affects
> some
> > settings, not all. Has anyone got any ideas on how to solve the problem
> > without having to superglue the network cables in.
> >
> > Thanks
> >
> > John
>
>
>

If the teachers can't control the students there isn't anything you can do
about it.
"Technology" isn't going to be the solution.

.....unless you can build a computerized "spanking machine" I'm afraid ;-)

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/IS...cessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/t...dance/2004.asp
http://www.microsoft.com/isaserver/t...dance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp
-----------------------------------------------------



"John" <(E-Mail Removed)> wrote in message
news:3FEB4889-AD65-488D-8F7D-(E-Mail Removed)...
> Unfortunatley the users are students.
>
> "Phillip Windell" wrote:
>
> > The solution is:
> >
> > 1. Users have Bosses
> > 2. Bosses can fire or punish Users
> > 3. Computers are not the Bosses.
> > 4. Software isn't going to stop someone from pulling the cable.
> >
> > If a company can not (or is unwilling) to control its employees then it
will
> > never stay in business.
> >
> > --
> > Phillip Windell [MCP, MVP, CCNA]
> > www.wandtv.com
> > -----------------------------------------------------
> > Understanding the ISA 2004 Access Rule Processing
> > http://www.isaserver.org/articles/IS...cessRules.html
> >
> > Microsoft Internet Security & Acceleration Server: Guidance
> > http://www.microsoft.com/isaserver/t...dance/2004.asp
> > http://www.microsoft.com/isaserver/t...dance/2000.asp
> >
> > Microsoft Internet Security & Acceleration Server: Partners
> > http://www.microsoft.com/isaserver/partners/default.asp
> > -----------------------------------------------------
> >
> >
> > "John" <(E-Mail Removed)> wrote in message
> > news:A029914A-280D-45E2-BBE3-(E-Mail Removed)...
> > > Some users are bypassing restrictions set by unplugging the network
cable
> > > after logging in when the server is loading the settings and then
plugging
> > it
> > > back in. As an example, when they have unplugged the network cable
during
> > > loading, they can lock the PC which they could not if they leave the
cable
> > > plugged in during login, this was one restriction set. It only
affects
> > some
> > > settings, not all. Has anyone got any ideas on how to solve the
problem
> > > without having to superglue the network cables in.
> > >
> > > Thanks
> > >
> > > John
> >
> >
> >

Thanks for your reply, you should patent the idea of a computerised spanking
machine every school in England would want one.

"Phillip Windell" wrote:

> If the teachers can't control the students there isn't anything you can do
> about it.
> "Technology" isn't going to be the solution.
>
> .....unless you can build a computerized "spanking machine" I'm afraid ;-)
>
> --
> Phillip Windell [MCP, MVP, CCNA]
> www.wandtv.com
> -----------------------------------------------------
> Understanding the ISA 2004 Access Rule Processing
> http://www.isaserver.org/articles/IS...cessRules.html
>
> Microsoft Internet Security & Acceleration Server: Guidance
> http://www.microsoft.com/isaserver/t...dance/2004.asp
> http://www.microsoft.com/isaserver/t...dance/2000.asp
>
> Microsoft Internet Security & Acceleration Server: Partners
> http://www.microsoft.com/isaserver/partners/default.asp
> -----------------------------------------------------
>
>
>
> "John" <(E-Mail Removed)> wrote in message
> news:3FEB4889-AD65-488D-8F7D-(E-Mail Removed)...
> > Unfortunatley the users are students.
> >
> > "Phillip Windell" wrote:
> >
> > > The solution is:
> > >
> > > 1. Users have Bosses
> > > 2. Bosses can fire or punish Users
> > > 3. Computers are not the Bosses.
> > > 4. Software isn't going to stop someone from pulling the cable.
> > >
> > > If a company can not (or is unwilling) to control its employees then it
> will
> > > never stay in business.
> > >
> > > --
> > > Phillip Windell [MCP, MVP, CCNA]
> > > www.wandtv.com
> > > -----------------------------------------------------
> > > Understanding the ISA 2004 Access Rule Processing
> > > http://www.isaserver.org/articles/IS...cessRules.html
> > >
> > > Microsoft Internet Security & Acceleration Server: Guidance
> > > http://www.microsoft.com/isaserver/t...dance/2004.asp
> > > http://www.microsoft.com/isaserver/t...dance/2000.asp
> > >
> > > Microsoft Internet Security & Acceleration Server: Partners
> > > http://www.microsoft.com/isaserver/partners/default.asp
> > > -----------------------------------------------------
> > >
> > >
> > > "John" <(E-Mail Removed)> wrote in message
> > > news:A029914A-280D-45E2-BBE3-(E-Mail Removed)...
> > > > Some users are bypassing restrictions set by unplugging the network
> cable
> > > > after logging in when the server is loading the settings and then
> plugging
> > > it
> > > > back in. As an example, when they have unplugged the network cable
> during
> > > > loading, they can lock the PC which they could not if they leave the
> cable
> > > > plugged in during login, this was one restriction set. It only
> affects
> > > some
> > > > settings, not all. Has anyone got any ideas on how to solve the
> problem
> > > > without having to superglue the network cables in.
> > > >
> > > > Thanks
> > > >
> > > > John
> > >
> > >
> > >
>
>
>

Can you provide more examples?

And about your example: locking the PC?! You said that normally students
cannot lock the PC but if they unplug during workstation start-up, then they
could lock it. May you explain more?

"John" <(E-Mail Removed)> wrote in message
newsEB0A763-727F-42DC-9693-(E-Mail Removed)...
> Thanks for your reply, you should patent the idea of a computerised
> spanking
> machine every school in England would want one.
>
> "Phillip Windell" wrote:
>
>> If the teachers can't control the students there isn't anything you can
>> do
>> about it.
>> "Technology" isn't going to be the solution.
>>
>> .....unless you can build a computerized "spanking machine" I'm afraid
>> ;-)
>>
>> --
>> Phillip Windell [MCP, MVP, CCNA]
>> www.wandtv.com
>> -----------------------------------------------------
>> Understanding the ISA 2004 Access Rule Processing
>> http://www.isaserver.org/articles/IS...cessRules.html
>>
>> Microsoft Internet Security & Acceleration Server: Guidance
>> http://www.microsoft.com/isaserver/t...dance/2004.asp
>> http://www.microsoft.com/isaserver/t...dance/2000.asp
>>
>> Microsoft Internet Security & Acceleration Server: Partners
>> http://www.microsoft.com/isaserver/partners/default.asp
>> -----------------------------------------------------
>>
>>
>>
>> "John" <(E-Mail Removed)> wrote in message
>> news:3FEB4889-AD65-488D-8F7D-(E-Mail Removed)...
>> > Unfortunatley the users are students.
>> >
>> > "Phillip Windell" wrote:
>> >
>> > > The solution is:
>> > >
>> > > 1. Users have Bosses
>> > > 2. Bosses can fire or punish Users
>> > > 3. Computers are not the Bosses.
>> > > 4. Software isn't going to stop someone from pulling the cable.
>> > >
>> > > If a company can not (or is unwilling) to control its employees then
>> > > it
>> will
>> > > never stay in business.
>> > >
>> > > --
>> > > Phillip Windell [MCP, MVP, CCNA]
>> > > www.wandtv.com
>> > > -----------------------------------------------------
>> > > Understanding the ISA 2004 Access Rule Processing
>> > > http://www.isaserver.org/articles/IS...cessRules.html
>> > >
>> > > Microsoft Internet Security & Acceleration Server: Guidance
>> > > http://www.microsoft.com/isaserver/t...dance/2004.asp
>> > > http://www.microsoft.com/isaserver/t...dance/2000.asp
>> > >
>> > > Microsoft Internet Security & Acceleration Server: Partners
>> > > http://www.microsoft.com/isaserver/partners/default.asp
>> > > -----------------------------------------------------
>> > >
>> > >
>> > > "John" <(E-Mail Removed)> wrote in message
>> > > news:A029914A-280D-45E2-BBE3-(E-Mail Removed)...
>> > > > Some users are bypassing restrictions set by unplugging the network
>> cable
>> > > > after logging in when the server is loading the settings and then
>> plugging
>> > > it
>> > > > back in. As an example, when they have unplugged the network cable
>> during
>> > > > loading, they can lock the PC which they could not if they leave
>> > > > the
>> cable
>> > > > plugged in during login, this was one restriction set. It only
>> affects
>> > > some
>> > > > settings, not all. Has anyone got any ideas on how to solve the
>> problem
>> > > > without having to superglue the network cables in.
>> > > >
>> > > > Thanks
>> > > >
>> > > > John
>> > >
>> > >
>> > >
>>
>>
>>

The students are set certain privlidges for their accounts, if they unplug
the network cable just after they have entered their username and password
and during the start up of their account,some of the privlidges which are
restricted are no longer applicable to that user. Another restiction that
becomes active is that all internet traffic goes through a filter on another
server and students can only access the sites put on. When they have
performed the above, they can go onto any site they please.

"(E-Mail Removed)" wrote:

> Can you provide more examples?
>
> And about your example: locking the PC?! You said that normally students
> cannot lock the PC but if they unplug during workstation start-up, then they
> could lock it. May you explain more?
>
> "John" <(E-Mail Removed)> wrote in message
> newsEB0A763-727F-42DC-9693-(E-Mail Removed)...
> > Thanks for your reply, you should patent the idea of a computerised
> > spanking
> > machine every school in England would want one.
> >
> > "Phillip Windell" wrote:
> >
> >> If the teachers can't control the students there isn't anything you can
> >> do
> >> about it.
> >> "Technology" isn't going to be the solution.
> >>
> >> .....unless you can build a computerized "spanking machine" I'm afraid
> >> ;-)
> >>
> >> --
> >> Phillip Windell [MCP, MVP, CCNA]
> >> www.wandtv.com
> >> -----------------------------------------------------
> >> Understanding the ISA 2004 Access Rule Processing
> >> http://www.isaserver.org/articles/IS...cessRules.html
> >>
> >> Microsoft Internet Security & Acceleration Server: Guidance
> >> http://www.microsoft.com/isaserver/t...dance/2004.asp
> >> http://www.microsoft.com/isaserver/t...dance/2000.asp
> >>
> >> Microsoft Internet Security & Acceleration Server: Partners
> >> http://www.microsoft.com/isaserver/partners/default.asp
> >> -----------------------------------------------------
> >>
> >>
> >>
> >> "John" <(E-Mail Removed)> wrote in message
> >> news:3FEB4889-AD65-488D-8F7D-(E-Mail Removed)...
> >> > Unfortunatley the users are students.
> >> >
> >> > "Phillip Windell" wrote:
> >> >
> >> > > The solution is:
> >> > >
> >> > > 1. Users have Bosses
> >> > > 2. Bosses can fire or punish Users
> >> > > 3. Computers are not the Bosses.
> >> > > 4. Software isn't going to stop someone from pulling the cable.
> >> > >
> >> > > If a company can not (or is unwilling) to control its employees then
> >> > > it
> >> will
> >> > > never stay in business.
> >> > >
> >> > > --
> >> > > Phillip Windell [MCP, MVP, CCNA]
> >> > > www.wandtv.com
> >> > > -----------------------------------------------------
> >> > > Understanding the ISA 2004 Access Rule Processing
> >> > > http://www.isaserver.org/articles/IS...cessRules.html
> >> > >
> >> > > Microsoft Internet Security & Acceleration Server: Guidance
> >> > > http://www.microsoft.com/isaserver/t...dance/2004.asp
> >> > > http://www.microsoft.com/isaserver/t...dance/2000.asp
> >> > >
> >> > > Microsoft Internet Security & Acceleration Server: Partners
> >> > > http://www.microsoft.com/isaserver/partners/default.asp
> >> > > -----------------------------------------------------
> >> > >
> >> > >
> >> > > "John" <(E-Mail Removed)> wrote in message
> >> > > news:A029914A-280D-45E2-BBE3-(E-Mail Removed)...
> >> > > > Some users are bypassing restrictions set by unplugging the network
> >> cable
> >> > > > after logging in when the server is loading the settings and then
> >> plugging
> >> > > it
> >> > > > back in. As an example, when they have unplugged the network cable
> >> during
> >> > > > loading, they can lock the PC which they could not if they leave
> >> > > > the
> >> cable
> >> > > > plugged in during login, this was one restriction set. It only
> >> affects
> >> > > some
> >> > > > settings, not all. Has anyone got any ideas on how to solve the
> >> problem
> >> > > > without having to superglue the network cables in.
> >> > > >
> >> > > > Thanks
> >> > > >
> >> > > > John
> >> > >
> >> > >
> >> > >
> >>
> >>
> >>
>
>
>

In group policy you may want to enable
Computer Configuration -> Administrative Templates -> System -> User
Profiles -> Wait for remote user profile
Computer Configuration -> Administrative Templates -> System -> Logon ->
Always wait for the network at computer startup and logon

From the policy description...

"By default, Windows XP does not wait for the network to be fully
initialized at startup and logon. Existing users are logged on using cached
credentials, which results in shorter logon times. Group Policy is applied
in the background once the network becomes available.

Note that because this is a background refresh, extensions such as Software
Installation and Folder Redirection take two logons to apply changes. To be
able to operate safely, these extensions require that no users be logged on.
Therefore, they must be processed in the foreground before users are
actively using the computer. In addition, changes that are made to the user
object, such as adding a roaming profile path, home directory, or user
object logon script, may take up to two logons to be detected.

If a user with a roaming profile, home directory, or user object logon
script logs on to a computer, Windows XP always waits for the network to be
initialized before logging the user on.

If a user has never logged on to this computer before, Windows XP always
waits for the network to be initialized."

Hope this helps.



"John" <(E-Mail Removed)> wrote in message
news:A029914A-280D-45E2-BBE3-(E-Mail Removed)...
> Some users are bypassing restrictions set by unplugging the network cable
> after logging in when the server is loading the settings and then plugging
> it
> back in. As an example, when they have unplugged the network cable during
> loading, they can lock the PC which they could not if they leave the cable
> plugged in during login, this was one restriction set. It only affects
> some
> settings, not all. Has anyone got any ideas on how to solve the problem
> without having to superglue the network cables in.
>
> Thanks
>
> John

Thanks, I'll give it a go.

"Brian Hoops" wrote:

> In group policy you may want to enable
> Computer Configuration -> Administrative Templates -> System -> User
> Profiles -> Wait for remote user profile
> Computer Configuration -> Administrative Templates -> System -> Logon ->
> Always wait for the network at computer startup and logon
>
> From the policy description...
>
> "By default, Windows XP does not wait for the network to be fully
> initialized at startup and logon. Existing users are logged on using cached
> credentials, which results in shorter logon times. Group Policy is applied
> in the background once the network becomes available.
>
> Note that because this is a background refresh, extensions such as Software
> Installation and Folder Redirection take two logons to apply changes. To be
> able to operate safely, these extensions require that no users be logged on.
> Therefore, they must be processed in the foreground before users are
> actively using the computer. In addition, changes that are made to the user
> object, such as adding a roaming profile path, home directory, or user
> object logon script, may take up to two logons to be detected.
>
> If a user with a roaming profile, home directory, or user object logon
> script logs on to a computer, Windows XP always waits for the network to be
> initialized before logging the user on.
>
> If a user has never logged on to this computer before, Windows XP always
> waits for the network to be initialized."
>
> Hope this helps.
>
>
>
> "John" <(E-Mail Removed)> wrote in message
> news:A029914A-280D-45E2-BBE3-(E-Mail Removed)...
> > Some users are bypassing restrictions set by unplugging the network cable
> > after logging in when the server is loading the settings and then plugging
> > it
> > back in. As an example, when they have unplugged the network cable during
> > loading, they can lock the PC which they could not if they leave the cable
> > plugged in during login, this was one restriction set. It only affects
> > some
> > settings, not all. Has anyone got any ideas on how to solve the problem
> > without having to superglue the network cables in.
> >
> > Thanks
> >
> > John
>
>
>

You may also change your build process to add some of the configurations to
the local security policy. This removes the reliance on the GPO being
pushed down.

--
Mark Gamache
Certified Security Solutions
http://www.css-security.com



"John" <(E-Mail Removed)> wrote in message
news:7672482C-A73E-4BD0-BD33-(E-Mail Removed)...
> Thanks, I'll give it a go.
>
> "Brian Hoops" wrote:
>
>> In group policy you may want to enable
>> Computer Configuration -> Administrative Templates -> System -> User
>> Profiles -> Wait for remote user profile
>> Computer Configuration -> Administrative Templates -> System ->
>> Logon ->
>> Always wait for the network at computer startup and logon
>>
>> From the policy description...
>>
>> "By default, Windows XP does not wait for the network to be fully
>> initialized at startup and logon. Existing users are logged on using
>> cached
>> credentials, which results in shorter logon times. Group Policy is
>> applied
>> in the background once the network becomes available.
>>
>> Note that because this is a background refresh, extensions such as
>> Software
>> Installation and Folder Redirection take two logons to apply changes. To
>> be
>> able to operate safely, these extensions require that no users be logged
>> on.
>> Therefore, they must be processed in the foreground before users are
>> actively using the computer. In addition, changes that are made to the
>> user
>> object, such as adding a roaming profile path, home directory, or user
>> object logon script, may take up to two logons to be detected.
>>
>> If a user with a roaming profile, home directory, or user object logon
>> script logs on to a computer, Windows XP always waits for the network to
>> be
>> initialized before logging the user on.
>>
>> If a user has never logged on to this computer before, Windows XP always
>> waits for the network to be initialized."
>>
>> Hope this helps.
>>
>>
>>
>> "John" <(E-Mail Removed)> wrote in message
>> news:A029914A-280D-45E2-BBE3-(E-Mail Removed)...
>> > Some users are bypassing restrictions set by unplugging the network
>> > cable
>> > after logging in when the server is loading the settings and then
>> > plugging
>> > it
>> > back in. As an example, when they have unplugged the network cable
>> > during
>> > loading, they can lock the PC which they could not if they leave the
>> > cable
>> > plugged in during login, this was one restriction set. It only affects
>> > some
>> > settings, not all. Has anyone got any ideas on how to solve the
>> > problem
>> > without having to superglue the network cables in.
>> >
>> > Thanks
>> >
>> > John
>>
>>
>>