HomeworkISA3
Year: 3
Name: CHHAY TRY
Class: Evening

I, enable administrator and power user on log on screen http://www.theeldergeek.com/missing_administrator_account.htm [Start] [Run] [Regedit]
Registry Key: HKEY_LOCALMACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Modify/Create the Value Data Type(s) and Value Name(s) as detailed below.
Data Type: DWORD// Value Name: Administrator
Setting for Value Data: [0 = Disabled / 1 = Enabled]
Exit Registry and Reboot

II, disable administrator change IP address:
The two policies I've enabled under User Configuration > Administrative Templates > Network >Network Connections
1. Prohibit access to properties of a LAN connection
2. Enable Windows 2000 Network Connections settings for Administrators

This GPO works on Windows XP Professional but not in Windows 7.

B. To prevent local administrators from turning Windows Firewall on or off http://technet.microsoft.com/en-us/library/cc775424%28WS.10%29.aspx Open the Group Policy Object Editor snap-in to edit the Group Policy object (GPO) that is used to manage Windows Firewall settings in your organization.

Open Computer Configuration, open Administrative Templates, open Network, open Network Connections, open Windows Firewall, and then open either Domain Profile or Standard Profile, depending on which profile you want to configure.

In the details pane, double-click Windows Firewall: Protect all network connections.

Do the following if you want to turn off Windows Firewall and prevent local administrators from turning on Windows Firewall:

In the Windows Firewall: Protect all network connections properties dialog box, on the Settings tab, click Disabled, and then click OK.

Do the following if you want to turn on Windows Firewall and prevent local administrators from turning off Windows Firewall:

In the Windows Firewall: Protect all network connections properties dialog box, on the Settings tab, click Enabled, and then click OK.

III, you want to configure this you can follow the steps given below: 1. Logon to the computer with administrator account. 2. Click on Start button. 3. At bottom of start menu in search box type gpedit.msc command and press enter key. 4. On Local Group Policy Editor snap-in under Computer Configuration expand Windows Settings and then expand Security Settings. 5. Expand Local Policies and click on Security Options. 6. From the right pane double click on Interactive logon: Do not require CTRL+ALT+DEL and on the opened Window select Enabled radio button. Enforce Users To Press Ctrl+Alt+Del
 7. Once done, click on Ok button and close Local Group Policy Editor snap-in. 8. Open Command Prompt and in command window type gpupdate /force to update here computer policy with latest configuration.
Close Command Prompt.

IV, disable usb from Server http://diaryproducts.net/about/operating_systems/windows/disable_usb_sticks In Active Directory Users and Computers, open an existing GPO or create a new one and open it. Use the security settings of that GPO to specify which computers it affects.

In that GPO, go to Computer Configuration – Windows Settings – Security Settings – File System and create a new entry (right-click File System and select Add File). Specify the location of USBSTOR.INF (usually SystemRoot%\Inf\USBSTOR.INF) Change the security settings of the new entry. The security settings that you specify here will be enforced on the USBSTOR.INF of every computer to which the GPO is applied. This process is not additive, which means that the previous security settings of USBSTOR.INF will be overwritten by the ones given in the GPO. It is therefore recommended to grant full control to SYSTEM and local administrators. But unlike in the default security settings of USBSTOR.INF, you should not grant any priviledges to Everybody. You do not need to explicitly deny access – just omit an entry for Everybody. Optionally, you can grant read access to a certain group. Members of this group will be able to use USB storage. Repeat the above two steps for USBSTOR.PNF. Download USBSTOR.ADM click this link http://diaryproducts.net/files/usbstore.adm

Back in the GPO, right-click Administrative Templates under Computer Configuration and select Add/Remove Templates. Click Add and browse to the location of USBSTOR.ADM. Close the dialog.

You should now have an additional entry called Services and Drivers in Administrative Templates. Click on it. If it is empty, select View from the menu and uncheck Show Policies Only. Click back on Services and Drivers in Administrative Templates. It should now show the USB Storage policy. Double click it, select Enabled and pick Disabled from the Startup Type drop down. Again, the policy must be enabled wheras Startup Type must be Disabled.

Close the dialog as well as the GPO and boot/reboot one of your workstations. Make sure no USB strorage device is connected to that computer. Log on with administrative privileges and check the permissions of USBSTOR.INF and USBSTOR.PNF. Check the value of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor\Start. It should be 4. It is also ok if the UsbStor key doesn't exist at all.

On the same workstation, log off and back on as a user that should not have access to USB storage. Connect a USB memory stick or a similar device. Nothing should happen. Remove the memory stick.

Log on as a user that should have access to USB storage and execute net start usbstor in a command shell or at Start – Run before connecting the memory stick. The memory stick should initialized and mapped to a drive letter. If USBSTOR fails to start, it's probably because this is the first time a memory stick is plugged into the workstation in which case USBSTOR is not yet installed. Nevertheless, the memory stick should be initialized and mapped correctly but you need to reboot in order to reapply the administrative template such that USBSTOR is disabled again. Alternatively, you can disable it manually by downloading and double clicking USBSTOR.REG as well as executing net stop usbstor.

Instruct the users with access to USB storage that they need to execute net start usbstor before they can connect a USB storage device.

V, To help you automate this type of operation, Windows XP comeswith a command-line utility called Shutdown.exe, which can restart your system.To make this happen automatically, you can configure it to run at a specifiedtime with the Scheduled Tasks tool. Here's how: 9. Go to Control Panel | Scheduled Tasks. 10. Double-click Add Scheduled Task to launch the ScheduledTask Wizard. 11. Click Next and then click theBrowse button. 12. Access the Windows\System32 folder, select Shutdown.exe,and click Open. 13. Follow the wizard through the next two screens to givethe task a name and choose a schedule. 14. Enter your user account name and password and click Next. 15. Select the Open Advanced Properties check box and clickFinish. 16. In the task's Properties dialog box, add the /rparameter to the end of the command line in the Run text box and click OK. (Besure to include a space between the last character in the command name and thefirst character in the parameter list.)
Enter your user account name and password and click OK.