Denying Windows network access
Home > IT Answers > Microsoft Windows > Denying Windows network access
Windows Security ATE
160 pts.
0
Q:
Denying Windows network access
Windows XP, Windows Security, Network access
I run a computer lab in a high school. We have a multi-platform environment with 12 XP Pro machines, six Windows 2000 machines and eight Vista Home machines. We are experiencing problems with students accessing class folders and deleting files. All students log in as student. I need a strategy to prevent all student users from moving and or deleting files. They need to be able to add files to their grade level, folders.
ASKED: Feb 26 2008  3:58 PM GMT
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
RELATED QUESTIONS
0
Spadasoe
2360 pts.
0
A:
 RATE THIS ANSWER
+1
Click to Vote:
  •   1
  •  0
  • AddThis Social Bookmark Button
You would do this with NTFS permissions.

I would start off by creating a group that would contain all the students. Add the deny delete permission to this user to the folders and/or files that need to be more secured.


At the community college where I teach, we allow read only to shared resources and then set up a student share where students can upload/copy files to that does not allow deletion.
Last Answered: Feb 27 2008  4:23 PM GMT by Spadasoe   2360 pts.
Latest Contributors: Jlees   5320 pts.
  •   
0
0
RSS - Discussions Help
Discuss This Answer:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _



_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

JonHassell   55 pts.  |   Feb 29 2008  8:11PM GMT

The answer provided certainly works, but I would also add that it will be tough to keep all of the user accounts for students, teachers, and others that you create synchronized across all of your machines without an Active Directory domain, something you can get from Windows 2000 Server, Windows Server 2003, or the newly released Windows Server 2008. You’ll be forced to make any change on all of the machines, as they will not share account information among themselves.

You might be better off to look for an old machine and an unused, genuine copy of Windows 2000 Server and join all of the machines (except the Vista Home machines — Vista Home cannot join a domain) to the domain, and then create your groups and users on the domain controller.

 

Wrobinson   5610 pts.  |   Feb 29 2008  11:36PM GMT

What JonHassell stated is absolutely correct. You really need to implement a domain model because the level of administrative effort required to maintain more than 10 local computers really adds up. Doing so will allow administration and access to network resources to be centralized. You can also then better segregate groups and data; however, the eight Windows Vista Home computers would have to be upgraded or replaced.

 
0