Slashdot Mirror

Back when I was working the computer labs at my university, we used a product by Centurion to secure our workstations.

We would build an image, then lock down this little device installed in the case.

The computer user never even notices it, and they can write to temp folders and change settings, and everything.

When the computer is then rebooted, this device just reloads the OS from the "locked" partition, and it's just like it ever was.

Day to day it was great, but applying updates was a pain because you had to visit each system and unlock it manually. This was 15 years or so ago, so I'm sure they have a better system in place now, but it worked pretty well for our group and the hundreds of computers we maintained.

DriveShield, which is what I used in my classroom lab. Allows you to manage the HD 'locks' from the network, as well as reboots, shutdowns, etc. Excellent product (Windows & Mac versions), excellent support (always very knowledgeable and friendly when needed), and mostly trouble-free. Only times I needed to call was to help recover licenses when client HDDs suddenly died for whatever reason. I'm sure this compares very similarly to DeepFreeze, just I'm not as familiar with that product.

We use DriveShield to secure around 5000 student PCs with WinXP at a community college. It works like a champ and doesn't seem to interfere with any known applications. http://www.centuriontech.com/products/driveshield/ Users can manipulate the desktop, install software, change settings, and download potentially harmful files from the Internet! A simple reboot of the computer restores it back to the administrator's pre-defined pristine configuration. DriveShield(TM) and MacShield(TM) simply wipe the session changes free... leaving the computer like new. Additionally, DriveShield(TM) and MacShield(TM)protect the computer from viruses prior to discovery and remedy. When DriveShield disposes of the changes made to the computer, potentially harmful files such as worms, trojans, viruses and spyware are wiped free from the machine, never getting the opportunity to reach the hard drive.

There are products out there that do a bang up job in securing a workstation. I work at a small college and we use CenturionGuard from centuion technologies http://www.centuriontech.com/ Students and faculty can use the desktop, install software, change settings, and download what they wish. Just a simple reboot of the computer restores it back to your defined configuration without the risk of probable harm.

If you want to use windows and basic windows programs, I would stay away from thin clients. To help with mantaining them, I would look into somethign like this: http://www.centuriontech.com/ We use this stuff in all of our labs. You just have to unlock the computer once a month to get updates.

To solve your last issue of valid users crippling the system you could use a hardrive protection utility like Centurian Guard. This hardware device puts the harddrive into a "read-only" state allowing anyone to do anything to the contents of the drive. You can even deltree c:\*.*, but once you reboot the contents come back because the users can only actually add/remove data on a temp partition. This works really well with a domain controller (ala samba) so all users data stays safe on a network drive.

Take a tip from an administrator in a public school system:

Pick up a copy a copy of DriveShield for the Mac, and allow the students to do whatever they wish to it.

DriveShield is a driver that sits between the hard drive and the OS. Any writes made to the hard drive are redirected into a sratch area of the hard drive, and thus don't stick around for the next reboot. The machine will be back in the state it was in when it was locked on every reboot.

I've tested it by even booting off a System CD and reformatting the drive... on the next reboot it comes right back to how you expect!

The philosophy used to be to lock the machine down as tight as possible to prevent the users from making any changes to it. (Restricted Finder, Windows Policies, etc.) Products like DriveShield (DeepFreeze is another one) work differently -- they don't lock down the machine to the user at all, they just prevent any changes from sticking across a reboot.

Protect the machine with DriveShield (or something similar), and have all the kids log in as the admin. Quick and easy to do, and the kids don't have to be restricted to a limited set of options on the computer!

We've been using this technique in several of our schools now (only in the open labs, mind you -- not the staff computers!), and the only support calls we now recieve in those labs is for hardware problems, not software.

- Bunny

Great for schools? Maybe. But you know what's better for schools? Centurion Guard. You can format the hard drive, install another OS, then when you hit the reset button everything is magically restored. Sure it's not the open source solution to all our problems we'd like to see, but it works. My college runs Windows on all the lab machines and we've never had a virus survive more than a few hours. Why? All you have to do when you get one is hit the reset button. ;)

It makes my job as the lab supervisor a lot easier. If someone fubars a machine, hit the reset button and everything works.

Centurion Technologies makes a product that removes all changes to a filesystem between boots. A friend of mine that works in a university lab environment uses it (as well as Ghost) and swears by it.

The second setup was a more campus-wide solution. I'm not sure how they achieved it, but it seemed that each machine maintained a log of which files were changed while a particular user was logged on. When they logged off, the machine simply returned the disk to the state it had been in before.

Perhaps you're referring to a Centurion Lock?

I work for an academic library (state university). I'm not a librarian, I exclusively do computer "stuff" for them. So I am familiar with these issues.

We do not save historical checkout information. Our feeling is that there is no reason for us to save that information. The only way that we could know what books a person had checked out and returned would be if they returned them late and have unpaid fines. Once the fines are paid, they go away. So be sure to pay your library fines ;).

For anonymous browsing we are currently using a product called Centurion Guard. It keeps files from being written to the hard disk permanently. Once the computer is rebooted, the browser cache, history, EVERYTHING is reset to the state it was in when I installed it.

The reason for doing these things was not anonymity initially. We didn't want to waste a hard disk on the automation system logging user's browsing habits. The Centurion Guard is really to keep users from breaking systems, but has the nice side-benefit of hiding user's identities.

I have talked about this a little with our Dean and he staunchly supports the patron's right to privacy, so I don't see us changing any of this any time soon. Which makes me happy.

Don't think that libraries are ignoring privacy and freedom issues. Some of the most fierce freedom of information advocates I have ever met, I have met in the library setting. ALA is one of the best freinds that we have right now.