Windows Server 2003, permissions, username prompts, etc.

Question

Hello all,
I have a unique situation that I need a lot of help with. I work in a prison and teach an introduction to computers course with 20 lab computers and 1 file server. The lab computers are all running Windows XP Professional and the file server is running Windows
Server 2003.
The way these lab computers are setup is with DeepFreeze so that any changes the inmates make to the computer is wiped clean 100% when the machine gets rebooted (this is a must have as some of these guys are quite nefarious and like to cause mischief for
no reason). I'd like to be able to setup the computers so that they work like this:
- Each of the student lab computers are all part of the domain
- When they login, they login with the generic "Student" account which is "Student" username and "password" password. This account exists on the domain and has absolutely 0 privileges.
- Upon login, a logon.bat script pops up a dialog box asking them for their personal username and password which will then, based upon their entry, map a network drive to their own personal folder.
The reason they need to login with a generic account first is because that generic account has already been configured on the computer with certain rights as to what they can and can't access as well as certain shortcuts and other stuff. In addition, it
has the Windows XP theme disabled and loads the classic theme instead as well as various other tweaks such as not grouping all taskbar items, showing all folders in the "detail" layout, not popping up the "desktop cleanup wizard", etc,
etc. That one user profile is configured exactly the way it needs to be for them to be productive. If I have them all login to the machines with their own username/password, all of those fine details would be lost, especially considering DeepFreeze and the
fact that it wipes out any changes they make to the computer.
Is it possible to have them login with the generic account and then once they login, get a login prompt so that they can work with their own user folders?
At first I had it setup so that they all had the "users" folder mapped, however any student could make any change they wanted to other student's folders. I'm getting pretty tired of having to go in and restore files for students because some other
inmate decided they wanted to delete all of that student's work.
Thanks everyone, and hopefully I can get some help in this matter.

Answer 1

Hi,
Thanks for posting in Microsoft TechNet forums.
We can achieve the target by following the steps below:
1.Create a logon-stript file and named "logonsript.cmd".The content is:
if not exist "\\fileservername\sharefoldername\%username%" md "\\fileservername\sharefoldername\%username%"
if not exist h: net use h:
\\fileservername\sharefoldername\%username% /persistent:yes
Note:fileservername is the netbios name of your fileserver.All of Students' personal folders is in the sharefolder.
2.Assign the permissions to the sharefolder.
Cancel the option  of "Include inheritable permissions from this object's parent".
Remove the group "Users" in the security TAB.
Give "full control" permissions to the group "creator owner" and apply to:"Subfolders and files only".
3.Edit GPO
Open Group policy object editor.
User configration--Windows Settings--Script(Logon/Logoff),
Double-click "Logon" on the right,click "Show Files" buttom,copy "Logonsript.cmd" to this folder,close this page.
Then click"Add..." buttom,click "browse" and choose the script file in the folder which the script file was copyed to.
Click "confirm".
When a student use the domian account to log in,a personal folder will be created automatically with "logon name" in your fileserver ,the person folder will be mapped as a dirve "H" automatically. Everyone can only access his/her own folder.
If the issue still exists, please feel free to let me know.
Ted