Login on with local settings

[E4xtraordinary]

Hi there,

I have on server running windows 2003 and several machine running XP. It is an RM community 3 network. I want to go away from it little by little as I find it totally rubish! When a user logon on the machines they receive all their security settings from the server, their startup menu from the server and have roaming profile enabled.

As I said I want to get rid of the roaming profile little by little as I cannot make the whole switch at once. I would like to setup a machine so that the user will be able to login and be validated by the server but use the server as a domain provider and file server only. I do not want any profiles to be downloaded on the local machine or security setting imported on the local machine. I am only interested to use the machine with the local settings that I will have setup independantly.

Is this possible,

I am open to any suggestion, once again thank you for your help.

Emmanuel

[ikonia]

whats an RM community 3 network?

[peterb]

Research Machines? I think they are still big in education...

[dave87]

Yup, Research Machines Community Connect 3 (or RMCC3 for short)

[E4xtraordinary]

Yeah, I work in a school, this RMCC3 is based on windows 2003 server and it is an interface that takes care of all the login and distribution of software and security policy on the network. It is very popular in education because they are supposedly so easy to manage. While at first it looks impressive, they have countless weaknesses, slow down the system and are almost impossible to work around. As long as you do what they expect its fine, after this sorry no can do!

This is why I am trying to setup a machine that can still login to the domain, redirect to the home directory but do no got all the security settings from the server, start menu and all.

If anyone has any idea,

Emmanuel

[E4xtraordinary]

This is driving me nuts!! I have been researching it all morning with no results... No-one knows of a way to setup a local machine to not inherit the server policy settings for this particular machine? I cannot believe it is not possible...

Any help always appreciated

Emmanuel

[javers]

At a very basic level you should be able to create a local login on the workstation which must have the same username / password as the users network login. You can then log in locally with this account and manually map their network drives to the server.

Jon

[GDVS]

I know nothing about anything RM specific but it sounds to me like group policies are being applied. On a standard 2k3 server I'd just fire up the GPMC but looking at the RM site I guess they have their own more simple interface.

It's still almost certainly group policies you're looking for though.

[Moby-Dick]

As above - I have a feeling if you wanted to run a "full" windows 2003 network , well you should have bought 2003.

If a client cannot see a domain controller when it logs on , it will use cached information and a local profile. I might be posisble to achive this by diconnecting network cables untill the machine has logged in , but I wouldn't reocmmend it.

Are you sure that roaming profiles are being used or are they just being generated on the fly by a combination of group policy and login scripts.

Are you the schools administrator ? I know there are a few schools IT chaps who post on hexus , maybe they'll have some hints and tips that might help.

Why do you want to abandon the domain model ( which is what you are doing - given that a domain is a collection of machines with a common group policy - something you've said you dont wish to use )

You might as well build a clarkconnect box and use that for authentication and file storage as you dont seem to want to use any of the windows functionality at all.

[GDVS]

You might as well build a clarkconnect box and use that for authentication and file storage as you dont seem to want to use any of the windows functionality at all.

What he said. I think in all honesty you need to read up on managing an AD domain, there's almost nothing you can't do centrally and managing setings locally is really the worst possible way to go about things.

I'm right with you on dumping roaming profiles though

[E4xtraordinary]

Thank you all for your comment, they are very interesting. I am the school administrator, but I haven't chosen to purchase RM CC3, would it have been my choice I would have gone for Windows 2003, rather than a full windows 2003 managed by RM software.

The reson I am asking this is because I want to get rid of the damn thing but for practical reason I cannot do it all in one go. I would like to have some machine for the moment more independant. I cannot create local profiles because I would have to create them for over a 1000 users on every machines, so I cannot see myself doing this for the next month or so...

Someone mentioned that it should all be link with GPO and AD. It was my initial hope, but I have been through AD and I could not locate one single active GPO. It seems RM uses AD to create users and link the machine to the domain and that is it! For the rest everything is embedded with a string of service and programms that only RM understand. I don't want spend ages to get to know this crap as I really cannot stand it and recommend it.

What I would like for now, and it doesn't seem straightforward, is to have some machine where the user will only use the server to be validated via AD. Hopefully as time go, I will be able to have all the machine out of RM but still connected to the server in a normal way so that I can start to use AD and windows 2003 as it should be. But at the moment I need to find a way to mix and match.

I don't think this post is going to give more information about how to help me, but it gives more insight in what I want to do.

Emmanuel

[E4xtraordinary]

Hi there,

I have done some homework and I have found new info about my problem.

It turns out I was wrong, I have finally identified the GPO. Each users have a string of GPO attached to their profile. I cannot modify these because they are still needed for the majority of the system.

However I would like to build machines which are linked to the domain (You guys are right there is no point in going away from the domain); but I do not want the user to be affected by their restrictive GPO when they loggin into the specific machines.

Is there any way to override their GPO, only for certain machines. If so I could start creating my own GPOs and have machine not affected by the RM CC3 system.

I have installed group policy management on the server and hope it will be usefull in this exercise.

Emmanuel

[TiG]

I hate to tell you but what you are trying to do is the exact reason RM is still in most school networks, they use propriatary stuff to capture a network and once you've been RM'd its difficult to get out. I can understand that you may not wanted to have bought the RM3 kit, but is it in the schools interest to get rid of it because you don't like it/ or its more hassle to manage?.

I'm not certain why roaming profiles are so bad?, in a school environment people don't sit at the same desk every day.

RM usually comes with support, (usually insisted on) - so while you can't stand it you may have to query the RM support people and get more indepth if you will stand any chance of gettings things changed.

You need to know your enemy before you can defeat him

TiG

[E4xtraordinary]

I hate to tell you but what you are trying to do is the exact reason RM is still in most school networks, they use propriatary stuff to capture a network and once you've been RM'd its difficult to get out. I can understand that you may not wanted to have bought the RM3 kit, but is it in the schools interest to get rid of it because you don't like it/ or its more hassle to manage?.TiG

Well it is my belief that RM is not benefitial to the school. Because as you said they use propriatary software, many applications are not compatible with the system. For example, not so long ago, a teacher wanted to see a flashplayer animation, but RM it wasn't installed on the system. Fine I said, I download it and assign it to the station. As it turns out this package cannot be created via the usual way, you have to get Rm to send you one. Other than wasting hour trying to make it work before being told that it can't, I have put the request to RM to send the disc (which thankfully is free) over a month ago and I am still waiting because it wasn't in stock.

This is not an isolated event, music teacher cannot have is £1000 super programme because RM hasn't given enough right to the pupils and it is not possible to change. And we pay thousand of pound a year for the privilege. My goal is to learn to do without it over the next few years so that when it comes to renew the system, we will be free to take something that will really benefit the school!

That is my point of view!

Emmanuel

[nichomach]

It's going to be VERY tricky; if the GPO is applied to the user rather than the machines, then it's either enabled or disabled for the user whatever machine they log on at if it's on the domain.

You say that you can't install this music teacher's program on specific computers; couldn't you assign those computers to an AD OU, define a GPO for them and use the software installation snapin to assign the program to those computers?

[E4xtraordinary]

You say that you can't install this music teacher's program on specific computers; couldn't you assign those computers to an AD OU, define a GPO for them and use the software installation snapin to assign the program to those computers?

This is what I will try next I guess, right now I am just looking to see if there is a way to go around the system I already have. It seems that the thing I want to do will indeed be very hard if not impossible.

My users are on one OU with their GPO, is it possible to create a GPO on the OU containing the computer I am interested in that overwritte the user GPO?

If not I guess I am going to give up on the idea until we are ready to reinstall the whole network aver a summer or something! But I won't probably be there by then!

E.