Bombproofing Win-NT / Win95

[Ulrich Babiak]

Hello All,

here's a rather detailed question regarding the use of Win95 in conjunction
with NT Server for keeping public PCs "bombproof". If (if...) I can finally
figure out how to set it up (maybe with a little help from you) I could 
post a summary of the necessary steps if somebody is interested.

In order to avoid big mistakes in the beginning I would like to ask for 
a good way to get started. This is what I want to set up:

Public internet access from PCs running under Win95 in a tiny little
Network (currently 3, probably expanding up to 10 client PCs) administered
from an existing NT Server. As our library patrons like to
play around with system settings, the workstations should be set up to
reload all the configuration information at boot time, so when something
is screwed up the staff only need to reboot the machine and everything
should be fine. The Win95 policy editor should be used to disable user access
to most of the user configurable part. I even consider using it to allow only
access to specified applications, if possible. (Is it possible?)

When booting up, the workstation should request the user-/system-/policy-
files from the server and then dive directly into Netscape without any login
screen.

How can I achieve this with the logics of NT-Administration? 

Here's what I have considered so far:

On the NT server, creating one user for every client pc and putting these
users together in one group, permitting access to all the software (browser,
viewer, telnet etc.) they need. Software will remain on the server.

On the client PCs, creating one "default" user (the same user as on the NT
server)  with minimal rights, whose registry information remains on the
server and is loaded at boot time using the built-in features of Win95.

Does this seem to be reasonable? As a complete newbie with NT, I doubt that
I really understood the concept of user and computer management in NT, so 
if this is the wrong way to go, please stop me!

Also, what I don't understand is how to make the "public" user the default user
of the workstation (as there still has to be an additonal "administrator" user)
so that the login procedure (both local Win95 login and server login) can
be performed automatically after booting up (the "public" user will have no
password).


If you have any ideas (or if you are interested in the summary)
let me know.

Uli

Ulrich Babiak             |       Buero ubabiak at dom.de   
Dipl.-Netzer :-)          |       privat  v9100055 at athena.rrz.uni-koeln.de
StadtBibliothek Koeln     |       http://joe.law.pace.edu/staff/ub/ub.html
---------------------------------------------------------------------------
Gegen Zensur im Netz: Spendet an die <a href:"http://www.eff.org"> EFF </a>