ICT lab solution

[epulone]

I am working in a school we have 2 ICT labs used from students with their own AD accounts to login. The students have some limitations in fact for security reason they are not able to access to the drive C (to avoid damage).

I would like as primary requirement handle these ICT students giving for one side the full access to C (that is giving al lot of problem) and for the other side have a system that allow me to easy protect and recover the functionality of each pcs in case they mess up somethings.

I would like also Centralize the applications, I mean install programs or update the antivirus directly in one machine ( instead now I am doing one by one). Also ensure the Active Directory log of the students.
The idea is give full access to C and simultaneously have a solution that solves any possible damage to system and centralize the maintenance of the software that they are using.

SOLUTION

I expose below two solutions that came to my mind:

1) I thought to use a system that every time the machines are switched on the operating system is loaded (on the ram) from an image stored on a network server. In doing so any damage/ mess up processed during the exercises are canceled when the machine restart. In this mode I do not even need antivirus (which is giving me a lot of problems with some programs, eg with python >> recently avast delete certain file execution - not even say that he has found a threat -). In this configuration, i think, the problem is keep to update the OS and Antivirus. Also install or uninstall programs on the image.
Do you think will be possible create something like that?


2) I thought also to a terminal server or known as remote desktop. There are alternatives to Microsoft? In this regard I would like to ask some questions. In this configuration, update the antivirus or windows would be simple because I should only act on one machine the TS but I would not be able to limit the manipulations of C or eventually virus attacks which would compromise the entire server.

Are there effective solution to use for my needs??

Thanks

 

[Tony1044]

I can help a little here somewhat, I feel.

Firstly - doesn't matter what alternative you use for Remote Desktop Services (RDS - the name of Terminal Services since Server 2008) as you will need a Remote Desktop CAL (RDCAL) for each machine or user connecting (in your case, per machine would make more sense).

That, though, doesn't get around the requirement to give users access to the C: drive and in fact causes extra complexity - I have never, in 20 years, given ordinary users any kind of write access to the C: drive in a Terminal Server, RDS, Citrix, etc server. Never.

Now it strikes me that you might be a candidate for VDI.

I will caveat this upfront by telling you that I am not a huge fan of it, but it does have it's use cases and yours is one of them.

Something like Citrix XenDesktop would be ideal. Your workstations become dumb terminals and connect to a Windows 7/8.x/10 desktop including a C: drive.

The beauty of VDI though, is you can set it such that when they log off the virtual workstation reboots back to the gold image - any changes made during the user session are gone.

What's more all of them boot from the one master image.

Now...it's not a panacea by any stretch. It takes considerable thought and effort and it does require a rather beefy backend - especially around storage and IOPS.

Another alternative I've seen used in schools is something like Deepfreeze - http://www.faronics.com/en-uk/products/deep-freeze/enterprise/ - this is basically a snapshot mechanism that allows you to restore to a point in time.

In terms of installing your applications one by one - that's...legacy.

Look at SCCM - you can push out installers by many mechanisms.

Or App-V.

You get some serious educational discounts from Microsoft and Citrix so they are worth investigating.

But you need expert advice (I'm free from May 2nd and have contracted to educational providers so I get the landscape ) and that won't be cheap either but - and forgive me for being blunt here - your lack of expertise will cause you more problems than you fix.

 

[epulone]

Thank you very much Tony for all your advice.

You are right I have not enough experience to start without an help.

I found very interesting Deepfreeze. I think at the moment it is the good alternative. I have installed the enterprise version to test it with 10 pcs.

I can't use SCCM so the only way for me to push installation with deepfreeze is use a batch file to save it in the task option and deploy this configuration to all pcs.

Could you help me to create the right batch file ?

Thanks