<html>
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 10 (filtered)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;}
span.EmailStyle17
{color:black;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=blue>
<div class=Section1>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'>Hello,</span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'>As far as Deep Freeze I have used it for
long time now in different libraries, it’s very great product and easy to
use. There are 2 different versions available, standards and enterprise, I have
used both of them and defiantly recommend the enterprise edition, you will be
able to install it on your server and create an installation package which you
can configure to fit your purpose such as turn on computers at certain time through
WOL “Wake On Lan” which you can enable on the bios if your
computers support it, turn off the computers at a certain time, schedule your
update either through WSUS or locally in each machine, choose what drives to freeze
and what to leave thawed such as external hard drive “USB or Firewire”
then you will install this package on each computer. Also you can create a seed
instead of the installation package. On the other hand from the admin
console you will be able to restart any workstation at anytime or reboot it thawed
for any reason, send a text message and a whole punch of other things. If you
are going to install the workstations on a different subnet than where your
server is located then you need to go under miscellaneous then change the
default option from LAN to WAN/LAN then specify the IP for your sever.</span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'>The other part about Cassie , I never used
it, I used envision ware and SAM. But regardless of the situation I would NOT recommend
to create a different user per computer, this will be very hard to manage. Best
way is to create one user and configure GPO to control all the setting for that
user from your domain, that way you can lock or open any features at any point easily.</span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'>Thanks and hope that helps</span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font></p>
<div>
<p class=MsoNormal><em><b><i><font size=2 color=black face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:black;font-weight:bold'>Mohamed
A. Ragheb</span></font></i></b></em><em><b><i><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial;color:black;
font-weight:bold'> </span></font></i></b></em><b><i><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial;color:black;
font-weight:bold;font-style:italic'><br>
<em><i><font face=Arial><span style='font-family:Arial'>Technology Manager </span></font></i></em><br>
<em><i><font face=Arial><span style='font-family:Arial'>Wadsworth Public
Library </span></font></i></em><br>
<em><i><font face=Arial><span style='font-family:Arial'>132 Broad Street </span></font></i></em><br>
<em><i><font face=Arial><span style='font-family:Arial'>Wadsworth, OH
44281-1897 </span></font></i></em><br>
<em><i><font face=Arial><span style='font-family:Arial'>Phone: 330-335-2600 </span></font></i></em><br>
<em><i><font face=Arial><span style='font-family:Arial'>Fax: 330-334-6605 </span></font></i></em><br>
<em><i><font face=Arial><span style='font-family:Arial'>http://www.wadsworthlibrary.com</span></font></i></em></span></font></i></b><strong><b><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:black'> </span></font></b></strong></p>
</div>
<p class=MsoNormal style='margin-left:.5in'><font size=2 face=Tahoma><span
style='font-size:10.0pt;font-family:Tahoma'>-----Original Message-----<br>
<b><span style='font-weight:bold'>From:</span></b> oplintech-bounces@oplin.org
[mailto:oplintech-bounces@oplin.org] <b><span style='font-weight:bold'>On
Behalf Of </span></b>John Librarian<br>
<b><span style='font-weight:bold'>Sent:</span></b> Tuesday, January 27, 2009
9:42 AM<br>
<b><span style='font-weight:bold'>To:</span></b> </span></font><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>oplintech@oplin.org</span></font><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>;
SYSLIB-L@listserv.buffalo.edu<br>
<b><span style='font-weight:bold'>Subject:</span></b> [OPLINTECH] Moving to
less-locked-down public computers with DeepFreeze</span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'> </span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial;color:black'>Right
now our public computers are locked down so that you can't install anything,
can't run anything that's not on our run-only list, etc. This of course
is in order to keep each computer from getting messed up for subsequent
patrons, and to protect other machines on the network. Of course, there
are times when the computers won't do something a patron wants to do, like
using a web site that requires its own special software to be installed or
running a program from a CD-ROM for school. </span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial;color:black'>So,
we're going to try switching to a less-locked-down setup. We're going to
use Deep Freeze to restore computers when they reboot, and we're going to use
CASSIE to reboot between patrons. (Both of these programs are new to us.)
I would appreciate any suggestions for further measures to take to keep
things secure and running nicely. Our environment: We have 34 public PC's
which we're replacing with new ones (with Windows XP); we have an
Active-Directory-enabled Windows domain with one DC, runningServer 2003. </span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial;color:black'>My ideas
are to have one user account per computer (with permissions only to that
computer) as a local power user, to put these computers on a separate subnet
and if possible a VLAN, and to make sure our Windows server is locked down as
much as possible. I could put them on a separate segment of the firewall,
but I understand that you can't manage a Windows domain through a firewall (or
any other kind of router) and it seems like it would be useful to manage these
computers on our existing domain. I don't yet know how we can keep users
from turning off CASSIE after they log in; I'm not sure if keeping them from
running taskmgr.exe will do it; if nothing else I suppose we can have a script
run every minute or 5 minutes, check for the CASSIE process, and reboot if it's
not running (I think I can make this invisible to the user using a VBS instead
of just a BAT file). </span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial;color:black'>Thanks
for any help you can give me, even if it's just thoughts, or reasons you think
this is a bad idea. If you reply privately I won't forward your info to
anyone - I know you might not want to talk publicly about your security.</span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial;color:black'> <a
href="mailto:johnqlibrarian@gmail.com" target="_blank"><font color="#2a5db0"><span
style='color:#2A5DB0'>johnqlibrarian@gmail.com</span></font></a></span></font></p>
</div>
</body>
</html>