Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to setup between 5 - 10 computers to start with for a charity organization which can't offord to be running a dedicated server that maintains group policies for a growing number of staff. Is there a way I can manage policies of each computer without having to physically change the local security policies. The computers run a combination of Windows XP, Vista and 7.

share|improve this question
1  
You might consider making a registry file of all the settings you want, and sharing it on the network. You can either manually import that file on each machine, or have it import it on startup (if you can share it on a reliable place on the network). Trouble is, if you make any significant changes, it may require a reboot before they take effect. –  Brad May 31 '11 at 20:42
    
@Brad - Would it work across version of Windows or would I have to create separate registry files for each one of them e.g. Windows XP, Vista, etc? –  PeanutsMonkey May 31 '11 at 21:05
    
What kind of policies are you looking to deploy? –  Mark Henderson May 31 '11 at 21:56
    
@Mark Henderson - Some of the policies would be having the ability to install updates although they are not administrators, not having access to certain drives, etc –  PeanutsMonkey Jun 1 '11 at 2:53
add comment

6 Answers 6

up vote 3 down vote accepted

I would weigh the initial cost of setting up 10 computers one time with minimal administrative work vs. the management of a domain. For example, two domain controllers would be advisable for redundancy/reliability's sake and their configuration can take a fair bit of time. This contributes to a greater financial cost and might contribute to a greater cost in man-hours. It also adds to the complexity of your network, which will more than likely make more work for you down the line without much tangible benefit.

On the other hand, working with 10 machines local policies is comparatively cut and dry. I doubt you will be micromanaging security policies in your day to day activities. Updates can be troublesome, but properly applied once you've tested them. AV/malware/intrustion utilities can also be annoying with some minimal administration.

If you're planning for growth and you want a domain, Microsoft's BizSpark gives you access to a good portion of the MSDN downloads for free, for one year. This includes past and present versions of Windows Server and Windows OS. All you need to be is a small-ish company for use with a few loose requirements. I'm sure charities would fit without a problem.

share|improve this answer
    
Thanks. Will propose Bizspark as a solution. –  PeanutsMonkey Jun 1 '11 at 2:56
1  
@Peanuts - before you do go with bizspark though, Microsoft have really, really good licensing for non-profits that are potentially even better than the BizSpark program. I would definately contact a Microsoft reseller about it. –  Mark Henderson Jun 1 '11 at 3:23
add comment

Microsoft offer a special licensing program for charities, the discounts are quite big and for just running an AD you can use two old PC's with a couple of gigs of ram.

See for details

share|improve this answer
    
I agree, you don't need a big honkin server to run Active Directory for ten users. –  Nate May 31 '11 at 21:00
    
Thanks. They have effectively spent their budget on getting new computers and licenses for the staff hence not leaving much to spend on other areas of IT. Is there a software I can say run on my laptop that would allow me to connect to all the computers on the network and define the policies for each of the users? –  PeanutsMonkey May 31 '11 at 21:04
add comment

You might want to try TechSoup. If your organization qualifies you could probably get a copy of Window Server 2008 R2 for less than $100 dollars. I believe you'll get about 50 seat licenses with it as well. And as previously pointed out, you don't need heroic hardware to run Active Directory in your situation. You can even run other server roles without significant trouble.

If you are actually in a situation that requires Active Directory, you will find that every substitute falls far short.

share|improve this answer
    
Thanks. I have heard of TechSoup so might suggest that an an option. By the way, I had posted another comment regarding domain names you had helped me answer. Would appreciate it if you could have a look at it. –  PeanutsMonkey Jun 1 '11 at 2:55
add comment

Samba 4 can run as a Domain Controller that is compatible with Microsoft's Active Directory.

https://wiki.samba.org/index.php/Samba_AD_management_from_windows

https://wiki.samba.org/index.php/Samba_AD_DC_HOWTO

share|improve this answer
    
Welcome to Server Fault! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  slm Aug 23 '13 at 8:41
add comment

One at a time, with a lot of mistakes.

share|improve this answer
add comment

I'm an IT manager for a small business. I don't have much of a budget so I do the best I can with what I have. As an open-source advocate, if I can reliably and robustly solve a problem with free and open source software, I do it. I've found something that works well enough without Active Directory. Here is how I do it:

FOG Project

FOG is an open source solution for disk imaging. (ex: Create a disk image of a virtual machine, sysprep and deploy that one image to ten computers.) FOG can also remotely install snap-ins. A snap-in can be any executable file. If I want to change something group policy related on one or more machines, I would create a registry file with the group policy registry values that need updated. I create batch scripts to call regedit /s on the .reg files and update the registry.

7-zip & 7-zip SFX maker

SFX maker creates me nice .exe files that can be configured to silently extract the contents and run an arbitrary program. In the example above I use SFX maker to pack the .cmd and .reg files into an .exe which can then be uploaded to fog and deployed as a snapin.

Misc. enterprise IT deployment tools

For installing new programs on all workstations, I first look for enterprise IT deployment tools for the software in question. For example, Google Chrome provides Chrome for Business which has a pre-configurable, easily deployable and optionally silent installer. Many printer manufacturers also have tools to help you deploy their printer drivers. HP and Brother have nice tools for this. You just have to find the right printer driver for your OS, then use their tools to create a silent installer which can be used as a FOG snapin.

AutoIT

Lots of software developers don't make deployment tools, even some big name titles like Quickbooks. Active Directory can't help you here. In cases where every computer needs it, it's sometimes easier to bake the software into your disk image, then deploy the disk image with all commonly used applications. For everything else, there's AutoIT. While it can be extremely time consuming to do so, you can write AutoIT scripts to automate software installations, either by detecting windows and simulating mouse and keystrokes or by duplicating the file and registry changes installers would normally do.

TightVNC

Every computer I manage has a TightVNC server. Basically remote desktop. When the workstation isn't in use, I can connect to a workstation and manually change settings as if I were sitting in front of the machine.

Feet

For small changes that don't need changing on every machine, feet come in very handy to transport me to the computer in question and fiddle with it. Bonus here is that I can get some exercise to make up for my otherwise sedentary lifestyle :P. While this isn't a good solution for managing a large amount of computers, it is good for making small changes to a small number of computers. (for everything else, there's AutoIT, remember?)

Conclusion

FOG is really the backbone of this whole process. FOG lets me assign machines to groups, which can be assigned specific disk images and snapins that are suited to those groups. Groups can be "room1", "room2" etc. with specific printer snapins deployed where needed. This process probably doesn't scale very well, isn't without it's flaws, but in my case where I manage around 20 computers, it works pretty well.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.