Security: Ways Around Group Policy

[mcourtman]

Hi there,

On the network where I work I have a problem to do with Group Policy. If a user enters their username & password and hit enter and then quickly unplug the network lead, they can log on without Group Policy being applied. They can then put the network lead back in and get all the benefits of being on the network with very little security applied.

I have set the "Always wait for the network at computer startup and logon" setting to Enabled, like other articles have suggested but this does nothing.

Now, if the user account has a roaming profile you can set the "Log User Off if Roaming Profile Fails" to Enabled and THIS DOES WORK!

Problem is: I'm trying to get rid of having Roaming Profiles, so I'm back to square one.

I know you can set it so the Group Policy is refreshed every so often, but this is not secure enough for me. I need a solution that works as soon as the user is logged on.

Anyone have anyother ideas?

Many thanks!

Matt, UK

 

[djtech2k]

You could setup a logon/startup script on the machine so it checks for connectivity and will logoff if it does not detect a connection. You could also have the script force GPO running as well.

 

[mcourtman]

Thanks for your post.

I know it's a bit cheeky to ask, but how could I write a script to check for connective and then log the user off?

Thanks,

Matt, UK

 

[tfg13]

Why not have a written policy prohibiting such actions, with consequences that would deter disconnecting from the network?

How about setting the switch/router to shut off ports if link is lost?

How do you currently know these actions are taking place?