How to restrict group of workstations

Question

Zenworks 3.2 sp2 & WinXP Novell Client 4.9sp2
User policy for Staff/Faculty accounts gives them DLU accounts wiht the
Admininstrator's rights - the main reason is the fact that they use PCs
mainly in the offices. Volatile User Cache is set to 366 days on office PCs.
Students get Limited DLU accounts and public PCs have Workstation
Manager configured to non-volatile accounts (Cache is unchecked).
Unfortunately some faculties treat public lab PCs as their own and they
install whatever they desire on the lab PCs (why not ? since they have
all the rights, right?)
I wonder if I could somehow restrict staff/faculty access on those
workstations through policies.
TIA
Andrzej

Answer 1

Well, I'm afraid there is no better solution. As long as they are
"Administrators" on the public PCs they WILL mess them up. There is very
little you can do about that (such as disabling Start->Run, regedit,
setup.exe, etc.) and it will have limited effect.
Deyan
Andrzej Zalewski wrote:
> Deyan
> I thought about it, but we have too many staff memeber sharing PCs,
> besides my boss wants to have everything as general as possible, no
> manual intervention on a deployed pc, regardless office or public lab.
> Andrzej
>
> Deyan Stoykov wrote:
>
>> Andrzej,
>> Create a local account for each faculty/staff user on his/her personal
>> PC in the office, member of the Administrators group and matching
>> his/her NDS username and password. After that reconfigure the DLU
>> policy so that they will not have administrative rights. Then they
>> will be members of Administrators on their personal PCs in their
>> offices and members of Users everywhere else. This makes most sense to
>> me.
>>
>> HTH
>> Deyan
>>
>> Andrzej Zalewski wrote:
>>
>>> Zenworks 3.2 sp2 & WinXP Novell Client 4.9sp2
>>> User policy for Staff/Faculty accounts gives them DLU accounts wiht
>>> the Admininstrator's rights - the main reason is the fact that they
>>> use PCs mainly in the offices. Volatile User Cache is set to 366 days
>>> on office PCs.
>>>
>>> Students get Limited DLU accounts and public PCs have Workstation
>>> Manager configured to non-volatile accounts (Cache is unchecked).
>>>
>>> Unfortunately some faculties treat public lab PCs as their own and
>>> they install whatever they desire on the lab PCs (why not ? since
>>> they have all the rights, right?)
>>>
>>> I wonder if I could somehow restrict staff/faculty access on those
>>> workstations through policies.
>>> TIA
>>> Andrzej