Re: Follow Up on this Thread- Nothing New

Posted by Scott on 2/28/08

More | Report Post

Our district is using Win Server 2003 Enterprise, and MS
Exchange, and we also have MOODLE.

All our workstations are using Deep Freeze, except for Office
Personnel and Board Office.

Jr. High and HS Students have their own login and pass, so
that they can have private server space. K-6 use a generic
logon, ie: school / school

Our district is a WAN with 5 sites.

Our latest fight with net abuse has been this, and I will
take you step by step through the abuse process so that you
may grasp what the student is doing:

1. Microsoft has unprotected executable files in their
Network Admin that can be run by programs brought into the
WAN by CDR, or Flash Drive.

2. If you are using Active Directory, all a student needs to
do, is log into the network, and then unplug the network
cable.

3. When the student logs off, that network profile is
CACHED, and after a period of time it will permit the user to
log in locally as an administrator.

4. After this time period has passed, and the user gets a
local administrative pass, they can then bypass any policy
you have set on your network, and even make it possible to
use that workstation remotely.

---------------------------
What we have done in our network, is to disable the "LOG
OFF" option, in the menu.
This forces students to either restart, or shut down. This
eliminates the possibility of a 'cached local profile' and
stops the process.

If you would like more information on this topic, please
write.
sdurflinger@cinci.rr.com

On 2/15/08, Scott wrote:
> Hello,
> I am a tech in a large Wide Area Network in Ohio, where we
> have 6 site buildings, and our own data phone system.
>
> While we rely upon our own Ohio School ISP provider for
> most of our filtering, we realize that our young adults are
> SMARTER THAN THEIR GRADES REFLECT. Isn't that a sad
> statement?
>
> By running security policies and mandatory profiles in
> Windows 2003 Server Enterprise, we are able to minimize the
> level of internet 'hacking'.
> User data is stored on the network server, where "My
> Documents" is linked to a network share via .VBS script.
> We also use a software called "Deep Freeze", which locks
> the hard drives in a permanent state. Upon reboot,
> anything on the C:\ drive is instantly returned to the
> original state. To date, I don't know of any way to hack
> this program.
> Our latest problem has been kids getting local
> administrative privileges by physically disconnecting the
> network cable, after having logged in. This problem has
> been fixed by disabling "Log Off" using security policies.
> (it forces them to shut down or restart)
>
> The next big hurdle, is the abuse of "proxy bypass"
> websites, that allow students to browse an unblocked
> website, that ports them via a window, to sites that would
> normally be blocked by our ISP proxy filter.
>
> Any hints on conquering this Proxy Bypass problem would be
> most appreciated!!!
> Scott

Posts on this thread, including this one

• Tips from a Tech in a Large WAN in Ohio, 2/15/08, by Scott.
• Re: Follow Up on this Thread- Nothing New, 2/28/08, by Scott.