Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

At work there are over 30 PC, some of them are Windows Vista Home and Windows 7 Home.

I just realized Windows Server is not worth it because it require to connect "Domain" on the clients PC. Windows Home does not support that and it will be very expensive buy licences for Professional or Business windows.

I am looking for alternative to Windows Server, something basic that I can block the desktop, some software, USB devices, and limit access to the websites.

Thanks!

share|improve this question

migrated from superuser.com Jul 1 '11 at 22:52

This question came from our site for computer enthusiasts and power users.

    
What are your plans for the server, what are you going top use it for? Just file serving? –  Moab Jul 1 '11 at 19:29
    
@Moab: It looks like he wants some group policy stuff done as well. –  paradroid Jul 1 '11 at 20:13
    
Actually, this can ALL be done through group policy. USB (Admin template), Desktp(Windows template), and website (IE template). –  surfasb Jul 1 '11 at 20:55
    
Home editions of Windows do not support Group Policy Objects. –  nhinkle Jul 1 '11 at 22:43
2  
Im gonna get flammed but you should consider using linux for that if money is an issue. –  OneOfOne Jul 2 '11 at 7:34

5 Answers 5

up vote 7 down vote accepted

Oddly enough, everything you are asking to do is part of the reason why PCs SHOULD join a domain. Since you can do pretty much everything you ask for with the OS. But I digress. You can do this all manually without joining a domain by logging onto each computer and first changing the Local Admin password.

Use the Group Policy editor to change the current settings on the computer. Go to the next computer. Rinse and repeat for 30 computers . . .

An alternative is to look at Windows Small Business Server. It is still a chunk of change, but I ask that you rethink your decision. Keep in mind if you lock down these computers, you'll have to pretty much login to EACH computer to update a single component, like Flash. Otherwise, every time your users log in, they'll be presented with the Flash update dialog, then try to update, and they have to cancel cause they don't have admin rights. And that will continue EVERY TIME THEY LOG IN, until you get around to their machine . . .

edit: Humm, I did think of a faster way. Save the registry edits that Group Policy editor does and merge them into each computer. Dangerous yes. But free!!!!!!!!!

share|improve this answer
    
Windows Small Business Server doesn't require connect to "Domain"? Can you provide a link about that... Regarding to Group Policy editor to change setting on each much is very time consuming - is there a way just one click on every PC? –  user79590 Jul 1 '11 at 19:25
    
I should reword that. I think it would be very helpful to explain why NOT connecting to a domain is a part of your specifications in the first place. Cause everything you want to do is a cake walk when the computers ARE connected to a domain. It takes some serious work and magic otherwise. Microsoft didn't hire an entire Server Division just to write a piece of software that reproduces functionality that just ANYONE can do. –  surfasb Jul 1 '11 at 19:41
1  
@Shinrai: For work, I just translate business requirements into IT specs by providing the equivalent IT solution that will fit their vision. I leave it up to the project managers to calculate the man hours. HAHA! –  surfasb Jul 1 '11 at 20:53
1  
Fair enough @surfasb. But in this case I think scaring the guy is exactly what we need to do, because frankly, it'll cost his company more long term to pay him to figure out some crazy home-brewed solution than it would for them to just buy Windows 7 licenses. Which I think was pretty much the point of your answer :) See also, my answer below. –  nhinkle Jul 1 '11 at 23:30
1  
+1 for having alizee as your avatar - great minds think alike! :P –  alexfreiria Jul 2 '11 at 3:05

There are a few routes you could take. Ultimately, having a centrally managed system using Active Directory is going to be far easier for you than trying to jerry-rig the functionality built-in to Professional versions of Windows, but there are options:

Option 1: Buying Windows 7 Professional

  • BizSpark: If your company is a start-up, you are eligible for the Microsoft BizSpark program, which gives companies access to a wide variety of Microsoft software for extremely reduced prices. You could obtain both Windows 7 Professional and Windows Server licenses through this program.

  • Volume Licensing: If you need to buy licenses for anywhere from 5 to hundreds of thousands of computers, Microsoft Volume Licensing is the easiest and overall cheapest method. Depending on what type of agreement you make, you can either purchase 30 upgrade licenses just once, and install Windows 7 Pro on all of your machines, or you can purchase a Software Assurance agreement, which entitles you to upgrade (or downgrade) to any version of Windows, even when new ones are released.

  • Retail upgrade licenses: this is probably the most expensive option, so I would advise against it, but you can just flat-our purchase upgrade licenses. Since you mentioned expense in your question, this is probably not a great suggestion.

Option 1.5: Alternatives to Windows Server, but still buying Windows 7

If you can swing some Windows 7 Pro licenses, but don't want to pay for a Windows Server license (which can be quite pricey), there's also the option of using SAMBA as your domain controller. This gives you most of the functionality you're asking for - essentially, the ability to set up group policy. It runs on Linux, and there are also lots of options for internet filtering which run on Linux as well.

Option 2: Jerry Rigging

If your organization really can't afford Windows 7 Professional licenses (and really, trying to spin your own solution will most likely cost you more long-term because of all the development and support time, but as you wish), you can try to make your own solution. I've done this before for around 10 computers, so it's probably doable with 30, it'll just be painful, and if your organization grows even further, it'll really suck.

You'll want to check out the Group Policy Settings Reference for Windows. This gives a comprehensive list of all Group Policy Settings (which are what you use to restrict users' desktop actions), including - most importantly - the registry settings for these restrictions. There are a few problems though:

  • Not every restriction has a registry setting. Some of them are stored in other ways which you can't easily change.
  • When you apply these settings manually, there's no easy way to do it for just certain groups on the computer. For each account, you would have to manually import the settings. You could probably write a PowerShell script or something to automate the process, but there are further complications with that.
  • When you want to change a setting, you have to do it for every single user on every single computer. Which, again, will be miserable.

So yes, it is possible to get around the limitations of having Home editions of Windows, and hopefully that document will be a good place to start. But I still think it's going to be way more trouble than it's worth.

The other question to ask yourself is, "is it worth all this trouble just so that users can't change their background picture and access the command prompt?" In most small organizations, the answer is probably, "no, it isn't," so if your supervisor is demanding that you implement these restrictions - which more often than not get in the user's way rather than save anybody time - you should really make the argument that if they want to enforce those rules, they'll have to buy the proper tools to make it possible.

share|improve this answer
    
I keep forgetting that Home editions can't join domains . . . –  surfasb Jul 1 '11 at 23:32
    
@surfasb: That's odd, as that is what this question is all about, and your answer was selected. –  paradroid Jul 2 '11 at 1:26
    
@nhinkle: Isn't Samba just a file server? Can it do all the LDAP stuff to make it an alternative to a Windows domain controller? –  paradroid Jul 2 '11 at 1:29
    
@paradroid Samba v.3 (which is the current stable release) can act as an NT4-style domain controller. Samba v.4 (currently in development) will be able to act as an active directory domain controller. Many organizations use Samba as a complete alternative to Windows Server - it does file sharing, printing, and domain control. –  nhinkle Jul 2 '11 at 1:30
    
@nhinkle: Oh, okay, I didn't realise. –  paradroid Jul 2 '11 at 1:34

You're going to have to set up a server. I'm surprised you didn't have one already with 30 PCs in one office.

share|improve this answer

The home versions of Windows are not designed to be centrally managed. It used to be done on Windows 3.11 and Win9x using Novell Netware, but I have not seen that being used anywhere for many years.

share|improve this answer
    
You'll be hard pressed to find compatible drivers. –  surfasb Jul 1 '11 at 20:56

As Shinrai points out in the comments to another answer, Home versions of Windows don't support Group Policy, so it's simply impossible do much of what you're asking on those machines.

The only thing you list that can be done with your setup is Internet filtering, which can be done with Linux server configured to be a transparent proxy. For more information on configuring this, see this answer on Server Fault.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.