Microsoft K-12 Connection
September 1997
http://www.microsoft.com/education/k12/news/

CONTENT HIGHLIGHTS

In this issue, you’ll find the following five articles:

1. Connected Learning Community
•	“Three Cheers for Change.” The key to successfully implementing technology at Greynolds Park Elementary in Miami, Florida was building a foundation of support among teachers, parents, students, and local businesses. Discover how an entire community became shareholders in the education of their children. 

•	“Reality Bytes Back.” What happens when you set out to bring computers into the classroom and nearly everything that could go wrong, does go wrong? Andy Knowlton, teacher and technology coordinator at a junior high in rural Wisconsin, shares his experience. 

2. Network/Desktop Operating Systems
•	“Locking Down the Desktop.” How to use Windows NT 4.0 and Windows 95 to tighten security at the desktop.

3. Classroom Corner
•	“KidsConnect.” What is KidsConnect? A free online help and referral service for K-12 students. Established in April 1996, school library media specialists volunteering at KidsConnect help kids around the world find information on the Internet.

ANNOUNCEMENTS 
Beat the Rush! Order Internet Explorer 4.0 on CD Today! at http://www.microsoft.com/ie/ie40/ryce_info1.asp. Beat the rush now and get the final version of Microsoft Internet Explorer 4.0 for Windows 95 and Windows NT 4.0 delivered straight to you on CD when the product ships on September 30. For a limited time only, Microsoft is offering the Commemorative Edition CD for customers who order early. You’ll also receive over $100 worth of offers from Warner Bros., NBC, ESPN Sportszone, CBS Sportsline, MSNBC, US Robotics, Connectix, and others. 

Districts Get Help Designing Their Own Connected Learning Community:
With kickoff right around the corner, this year’s seminars demonstrate how Microsoft technologies can help create a stronger infrastructure, increase administrative efficiency, and most important, enhance learning. 

When you attend an Education Solutions Briefings for K-12 seminar you’ll learn about Microsoft’s vision for technology in education called the Connected Learning Community. The Connected Learning Community is a linked environment where educators, students, families, and the extended learning community are connected. The Connected Learning Community involves dynamic interactions in three ways: within and between schools, between schools and homes, and between schools and the broader community of learning resources. Attend these briefings if you are a district technology coordinator, site technology coordinator, superintendent, or district instructional specialist.

To register for the K-12 Education Solutions Briefing in your area, call 800 550-4300. 

1. Connected Learning Community
Three Cheers for Change

In this, the second article in a series about Greynolds Park Elementary School in Miami, Florida, you will learn about one school’s successful strategy for implementing technology. Within five years, Greynolds Park, an extremely overcrowded, working-class, urban school, was transformed into a model technology school. Much of the credit goes to David Multz, principal, who began by building a strong foundation among teachers, students, staff, parents and local businesses. Discover how an entire community became shareholders in the education of their children.

By Joan Kuperstein, former curriculum specialist and grant writer at Greynolds Park Elementary

 “Sometimes you want to go where everybody knows
your name and they’re always glad you came.” —Theme from the long running television series “Cheers”

What a splendid mission statement for a school! And here at Greynolds Park, with a lot of work and cooperation from every segment of the community, we’ve achieved two equally important goals: First, as in the lyrics, we’ve created a place where everyone—students, teachers, staff, parents and community members—is truly welcome. 

Second, we’ve transformed an average, technology-poor school into an outstanding, technology-rich school where students learn in an open, supportive environment. Over the past five years, our original equipment—six typewriters, two PCs and thirty-five Apple IIe’s—has been replaced with top-notch, networked computer stations in every classroom. Instead of an emphasis on right answers, routine and reproducing the known, the thrust of our teaching is to actively engage students in the learning process. Our kids are not always quiet and orderly, but learning is more relevant, more active and more fun. (For an in-depth look at how Greynolds Park built and funded a technology infrastructure, see “Fundraising at a Florida Elementary School” at http://www.microsoft.com/education/k12/news/may/clc/default1.htm.)

The school’s success is nothing short of extraordinary: The good news is that our experience can be repeated with a little bit of desire and a great deal of work. Read on, and you’ll understand why Greynolds Park is a place where people want to be. 
Setting the Tone for Change
The effort of transforming a school falls heavily on some and less so on others; at Greynolds Park, the key agent of change was the school’s principal, David Multz. Simply put, a school principal sets the tone for a school’s success or its failure. Multz strongly believed in the potential of technology to improve education, but he knew from experience that building a base of support for any change was crucial to its success, especially among teachers and parents. If individuals began to feel the school’s administration was listening to them, if they felt they had some influence in the education of their children, they would start to care, and if they cared, there was a good chance they would devote time and energy to the school. 

Integrating the School and Its Community
Like many schools, Greynolds Park desperately needed those “investments” of personal energy: In 1992 the student population was 825, but at the start of the 1996–1997 school year that figure had risen to 1,404, mostly because of immigration.

Multz’s first challenge was to remake the school into a place that welcomed all members of the community, especially parents. In a letter supporting Multz’s nomination as 1996 Dade County Principal of the Year, Carol Rentfrow, 1995–1996 P.T.A. president, describes the atmosphere at the school before Multz’s arrival: “The school existed as an island, isolated from the community. Doors were closed, visitors were looked upon as trespassers.”

Multz realized that to turn the situation around, Greynolds Park needed to do more than hold an annual open house.   “The school belongs to a community, not to an individual,” says Multz. “To bring more people into the process, I tried to open the school up to the community at every opportunity. I opened it every Wednesday night, from 6 to 8 P.M. for parents who had concerns or questions and for those who wished to speak to an administrator without a scheduled appointment.” 

Also on those Wednesday nights, parents were invited to attend classes with a bilingual (Spanish and English) curriculum specifically designed to help them understand the subjects their children were studying and the test-taking skills their children needed to learn. 

Previously, most parents heard from teachers only when a child had done something wrong. Multz bought a few cellular phones and made teachers responsible for calling the parents of every child in the school to tell them something positive about their child.
 
Mr. Carlos Azevedo, long-standing Boy Scout/Cub Scout troop leader and 1997–1998 Greynolds Park P.T.A. president, recalls that Multz opened the school during the evenings for troop meetings. “Mr. Multz went the extra mile to give the community their school,” he says. 

Multz let parents know what the needs of the school were, what he wanted to accomplish and how they could help; he also asked for their feedback—an approach that has been extremely successful. On any given day, 15 to 20 parents are present at Greynolds Park, helping out. Sometimes entire families pitch in—the Lynns are a good example. In addition to volunteering in the children’s classrooms or acting as P.T.A. vice-president and parent volunteer-coordinator, Mom Susie Lynn can be found selling frozen yogurt five days a week from 1:30 to 3:30 (proceeds average one hundred and fifty dollars a day and are used to fund technology).  Dad Jeffrey is an active participant in the Dade Business Partners Program that recognizes student achievement with special prizes and awards. He is also among the first to volunteer his time and skills for science fair presentations. Grandma Anita, a former educator, shows her special touch with children as she volunteers to spend time listening and talking with selected students in need of a “grandma’s ear.”  Grandma Anita and Grandpa Gerald are also often found helping out with yogurt sales and the annual book fair. 

Explaining her philosophy, Susie Lynn says: “I remember when I was in sixth grade and my mother asked me if I minded if she became president of the P.T.A. I clearly remember saying, “No, I would be proud of you.” Today, I know my parents are proud of me, as the belief in helping my own children and the children of the community has been passed down from one generation to another. And I know that my children are proud of me and their grandparents for our involvement at Greynolds Park.”

The success of the open-door approach was quickly recognized, and Greynolds Park became known as a caring school where people listen to each other; where humor is spontaneous and supportive, not hurtful; where people respect each other’s views, although they may not agree with them; and where caring is authentic, not contrived. 
Enlisting Faculty and Staff: You Can Be Yourself
Just as Multz welcomed parents aboard, he needed to enlist the support of teachers, many of whom had been uncomfortable with the previous atmosphere at the school and were ready and willing to work for change. Multz circulated a coordinated plan for a new decision-making policy that called for shared decision making among teachers and staff rather than the top-down approach. Initially, he gave the plan to a select group of teachers who, in turn, were able to establish consensus among their peers. 

To facilitate team building and “buy-in” by the greater faculty and staff, the plan called for the creation of a “cadre” with representatives from all components of the school staff. Monthly cÿ@re meetings determined faculty meeting agendas, issues of focus and special events. Teachers joined interview committees for the hiring of all new instructional personnel, shared in budget decisions and assisted in the selection of new instructional materials and programs. Perhaps most significantly, the cadre outlined the specifics that moved Greynolds Park toward becoming a full-scale technology school. 

Providing each teacher (and staff) with a box of personalized business cards delivered the potent message that the administration recognized its teachers were professionals and should be treated as professionals.
Multz also hired a full-time aide to carry out teachers’ requests for photocopies, and he abolished the old system of rationing paper to his teachers. Says Multz, “I felt that it was my job to be a facilitator for teachers by giving them the things they needed to get the job done.”

According to Mrs. Toby Arbeiter, a teacher at Greynolds Park for the past 22 years, “David usually got what he wanted, but the faculty and staff were always a part of it . . . that gave us a tremendous sense of accomplishment.” 

Royanne Reusch, pre-kindergarten teacher, United Teachers of Dade Union steward since 1992 was an eyewitness to this transformation, as she reflects in a letter nominating Multz as principal of the year: 

With our new-found sense of self-confidence, we [teachers] began to experiment with our own ideas. The administration encouraged us to participate in workshops and seminars, and provided release time from some of our daily classroom responsibilities for such attendance. Things really began to change based on teachers’ input, and suddenly many of us began to believe that we could be ourselves and make significant contributions. 

The Miracle of Change
A single attitude stands out as the foundation of the miracle of change at Greynolds Park. I have observed this attitude. I have experienced this attitude. Yet it is hard to know what term to put on it, so I shall use several. I think of it as prizing the players—prizing their feelings, their opinions and their worth as individuals. 

In an environment that was adversarial at one time, a new sense of collegiality blossomed. This rebirth was brought about through a shared trust that started at the top and filtered through all levels, down to the students who had come to Greynolds Park to learn. 

Resources:
You can reach Joan Kuperstein at castle@thenet.net or visit her Web site at  http://www.thenet.net/~castle

Next month: Greynolds Park develops partnerships with local business.

About the author: Joan Kuperstein was employed as a grant writer and curriculum specialist at Greynolds Park Elementary through June 1997. Currently, she is working as a consultant to K–12 schools.  “Time after time, I have seen successful technology programs result in improved student achievement. For the last four years my passion has been successfully developing and implementing technology plans at schools. Watching children utilize the new technologies to explore, to investigate, and to enter the discovery zone has made me recognize that technology is often the touch needed to push the gifted and talented “button” in our students; to help children understand that education is a journey, not a destination.”

© 1997 Microsoft Corporation. All rights reserved.

Reality Bytes Back

After five years of struggling to implement technology, the Lomira School District in rural Wisconsin has decided to take a year off to reevaluate the situation. In this article, Andy Knowlton, teacher and de facto technology coordinator, shares Lomira’s problems and the solutions the district is developing, believing that a lot of schools out there can benefit from its experience.

By Maureen O’Neill

You’ve read the glowing success stories: After computers are brought into the classroom, bored adolescents morph into National Merit Scholars; your fellow teachers become wizards of creativity and efficiency by using their very own PCs; and administrators revel at their ability to streamline student data over a brand new network. 

But what happens if, in spite of your careful plans, you spend 80 percent of your time trying to get your existing hardware and software to run with an upgrade several orders of magnitude greater? What if your hardware/software/shareware solutions don’t cooperate and the vendors each pass the buck, saying it’s the other guy’s product that’s causing the problem? What if you don’t have anyone in your district who has the technical expertise to understand the problem and deal with the resellers or vendors? What if you haven’t had time to train your teachers, and you find yourself with a lab full of Pentium-based computers being used for keyboarding? And what if your teachers are getting more than a little bit frustrated at having to cope with technology rather than take advantage of it? 

In short, what if just about everything that could go wrong, does go wrong, even though you’ve spent a lot of money, time and good intentions trying to set your school on the road to the future?

Andy Knowlton, who teaches keyboarding and computer applications at Lomira Junior High School, can answer all those questions. Been there, done that, still there. Like many a teacher with an aptitude for technology, Knowlton found himself  “technology coordinator” by default. Too often, he spends his time solving technical problems instead of attending to students—an especially frustrating reality for a man who recently left a career as a pharmaceutical salesman to become a teacher.

With only 1,100 students, Lomira School District is small, but its size isn’t unusual; according to the Digest of Education, nearly a quarter of the nation’s school districts have student bodies in the 1,000 to 2,499 range. The district has a K–12 building in the town of Lomira, Wisconsin, (population 1,700) and an elementary school 5 miles away in the community of Theresa. 

Though Knowlton was hired just last year, he’s become intimately familiar with the hardware-software configuration he inherited: 60 Compaq Pentium-based computers in labs and 120 PCs (mid-1980 IBM PCs), 40 Macintosh computers, and 30 Apple IIe’s in classrooms and offices. Just last year, the school buildings and the labs were networked with Novell NetWare 4.11, and the district is currently evaluating the Microsoft Windows NT operating system. On the desktop, the district has machines running MS-DOS, Microsoft Windows version 3.11, and Microsoft Windows 95 desktop operating systems. 

Great Expectations
Common sense dictates that before you invest hundreds of thousands of dollars in technology, you’ll want to explore the field and prioritize what you need; in this regard, Lomira did its homework. 

In 1992, 25 members of the local community formed a planning committee that included teachers, administrators, school board members, citizens and members of the local business community. The committee went on a three-day retreat whose purpose was to envision the future of education in the district, including the role technology would play. 

Lomira’s specific technology objective states: “By graduation, all students will successfully demonstrate the practical application of current technology.” After the retreat, a committee of 10 was charged with breaking the vision down into specific goals and the steps necessary to reach those goals. The result was a “Technology Action Plan” containing 27 areas of focus and a time-line.

Hiring a technology coordinator was the first goal in the action plan. Other goals included developing separate curricula for the elementary, middle and high schools; creating a staff development program; developing partnerships with business, and opening the school in the evenings to teach computer skills to community members. 

It’s not uncommon for a district, having been granted an initial lump sum to seed its schools with technology, to focus on the acquisition of hardware and software rather than the human resources needed to support it, and this was the case with Lomira. Hiring a technology coordinator got bumped behind the purchase of equipment for several reasons: the excitement over plugging into the information highway, the need to spend money allocated for technology within a specific time-frame, and the relative ease of buying hardware and software compared to creating a new position and hiring a specialist. 

 “When you talk about hiring staff,” says Knowlton, “you have to think about insurance, pension plans and so forth. Buying a computer is a one-time thing.” In retrospect, Knowlton believes failing to hire a technology coordinator was the critical error that Lomira is still paying for today. 
Roadblocks, Snags and Glitches
At Lomira, as is often the case in real life, planning and implementation ran side by side. The first wave of computers, low-end IBMs running on an MS-DOS-based network, had been installed in Lomira’s classrooms in 1992–1993, the same year as the strategic planning process just described above was taking place. (See the Lomira Time-line, below.)

In 1995–1996, after a yes vote on a building referendum, three new labs were built (two in Lomira and one in Theresa). Immediately, the labs became the “cool” place to be, but technical snags and compatibility issues between the labs and the classrooms created roadblocks at every turn. 

Now that they’re behind him, Knowlton can laugh about the problems he dealt with on a daily basis: “We had licenses to use software in the labs but not in the classrooms, so if students  were working on a project in a lab and needed to finish it in another room or the library, they didn’t have the software. When the labs were built, two outlets per computer were installed, but the speakers for the multimedia computers required a third outlet. I spent the whole first year with the speakers in boxes. I also found out that the HP InkJet printers we were using weren’t meant to be networked.” 

Even the basic task of printing became a challenge: Theoretically, anyone could print to any printer over the network. But since some desktops were running Windows 95 and some MS-DOS, the district ran into problems with printer drivers. “There was no rhyme or reason to where someone could print,” says Knowlton. 

When Lomira went back to its reseller with hardware/software problems, the reseller in turn went to the vendors, who ended up pointing fingers at each other. Knowlton notes: “The software company says it’s a hardware issue. The computer company says it’s a software issue. The printer company says it’s not their problem . . .”

Last year, one of the primary fears of many schools and districts came true at Lomira: Parts of the infrastructure had become outdated. “The wiring done in 1993 is not adequate for us now,” says Knowlton, explaining that the apparently standard practice of not terminating all the wires at the hub left four strands hanging. To switch to Ethernet protocol, Lomira needed to have all the original wires reterminated. “We had to pay for a second reseller to come in and clean up all the wiring, so we paid twice for the same thing.” When asked whether a technology coordinator or consultant could have avoided this expense, Knowlton replies that they might have at least asked the right questions.

Finally, the Internet, “window to the world,” blew open, and Lomira jumped out. Excited by the potential for distance education, the district “went into the Internet with firewalls and routers, but then found the Macs couldn’t communicate with the firewall and routing system.” 

“We got in over our heads,” acknowledges Knowlton, adding that the district has spent the equivalent of a teacher’s salary on tech support calls to its primary hardware reseller. “Eighty percent of our problems were technical,” says Knowlton, “which didn’t give us the opportunity to look at the other twenty percent—how to help teachers.”
The Team Approach?
Although Lomira has a five-person technology committee consisting of three other full- time teachers and two librarians, most of the actual work of maintaining and administering the network falls to Knowlton, in part because he’s been given one class period per day to attend to technical problems.

Knowlton concedes that the team “isn’t as effective as it wants to be,” explaining that full-time teaching commitments and the pressure of keeping the system running force him and the other team members to work independently more often than collaboratively. He also notes that the barrage of technical problems has taken its toll, leaving the committee exasperated in the face of problems members don’t have the expertise to solve. 

Staff development is “catch as catch can,” with experienced faculty sharing skills with other staff whenever they can. (Curriculum and staff development are the focus of next month’s article on Lomira.) 

Knowlton asserts that quality education has been maintained at Lomira, however, “because we’re fortunate to have creative staff who have helped students create great projects despite technical problems.” For example, he says, two special ed teachers received the Marcus Cable Award of Excellence this year.
Learning in the School of Hard Knocks
With the exception of upgrading the high school computer science lab, the district has placed a freeze on technology purchases for the 1997–1998 school year, and plans to spend that time looking closely at Lomira’s infrastructure and developing a plan for expansion and upgrading. The district plans to move to an entirely Windows-based platform and is currently evaluating Windows NT.

John Mason, district superintendent, describes the original technology plan as a “comprehensive, expansive, pie-in-the-sky venture,” but he stands by it, believing that “aiming high and getting all the options out on the table” was a sound approach. He has always realized, he says, that some goals would take time to get done and some might never get done.

Yet over the past five years, Lomira’s technical problems have exerted measurable drag on the momentum of the original plan. “Everything boils down to time, money and energy,” says Knowlton. The plan was ambitious, he admits, and mentions that financing  has been an obstacle. Yet as he talks about the situation at Lomira, Knowlton circles back to one simple fact over and over: “Ultimately, what this plan has relied upon [to succeed] has been teachers and administrators.” Clearly, that dependence on existing staff was a setup for future problems.

Knowlton is currently optimistic, now that Lomira’s problems and possible solutions have crystallized in his mind. Hiring a full-time technology coordinator is only  part of the answer: “We see two roles,” says Knowlton. “One is nuts and bolts issues—somebody to run the network and do all the systems management and administrative work. The other is teaching people how to use the tools—someone who can do the staff development and integrate computers into the classroom.”

This time around, the district is seriously considering hiring a technology consultant to add a dose of reality to the planning process (pending approval from the school board). “What we need is someone to come in and say “based on what you said you want, this is what we’re going to do, and we’re going to see it all the way through.”  

(For more information, see “Hiring a Technology Consultant” in the August issue at http://www.microsoft.com/education/k12/news/content3.htm.)
Lomira School District Time-line

1991–1992
•	Classroom phone and data system proposed. 

1992–1993
•	Classroom phone system installed. 
•	Team of 15 teachers meets and develops plan for installing a networked PC in every classroom. 
•	District requests and receives $400,000 from the school board for purchasing and installing PCs. Partial installation completed.
•	Strategic planning committee formed; three-day retreat yields a vision for technology. A postretreat committee of 10 people creates a detailed technology plan.
1993–1994
•	District requests another $400,000 and receives $300,000 to finish outfitting the rest of the classrooms with computers. Every classroom has a computer running on an MS-DOS-based network. 

1994–1995
•	Technology plan loses steam because of other pressing school issues (unrelated to technology).

1995–1996 
•	Building referendum passes, allowing building expansion to take place. Three computer labs created: two in K–12 school in Lomira and one in the elementary school in nearby Theresa.
•	District adds Internet capabilities.

1996–1997 
•	Andy Knowlton hired to teach keyboarding and computer applications.
•	Technology team formed.
•	Technical problems cause district to freeze technology spending and take a year out to reevaluate.
•	Schools networked with NetWare 4.11.
•	District evaluates Windows NT.
Resources:
•	You can visit Lomira’s Web page at http://www.lomira.k12.wi.us.

•	Andy Knowlton can be reached at aknowlton@lomira.k12.wi.us.

About the author:. Maureen O’Neill is the editor of Microsoft K–12 Connection.

© 1997 Microsoft Corporation. All rights reserved. 

2. Network/Desktop Operating Systems

Locking Down the Desktop

A how-to exploration of some important steps you can take to make the environment of your network workstations more uniform, easier to manage and most important, secure.

By Sean Daily

You’ve spent a lot of time getting the school’s computer network up to date. You’re running the Windows NT® and Windows® 95 operating systems, and you’ve integrated them into your school’s local area network. In addition, you have your Windows NT servers as well as your Windows 95 and Windows NT desktop workstations running under a Windows NT domain environment, having been told that this arrangement is best for maintaining tight network security. Although you’ve created a flexible and powerful work environment for users and administrators alike, you’re concerned about security and are wondering what else you can do to make sure that users (that is, students) can’t get into places they’re not supposed to.

Sound familiar? If so, you are definitely not alone! One of the first things any system administrator faces when setting up a network is the issue of locking down the desktop, that is, controlling user access to the system and the network as a whole. Let’s face it: It’s in kids’ nature to be curious, to experiment and to test the limits around them. While these behaviors are an important part of the learning process, they can also have disastrous effects when applied to a network with no security restrictions in place. In this article, we’ll help you avoid that kind of security problem by using some tools and methods that can minimize unauthorized access to your network and its resources.
Educating the User
In the article “Setting Boundaries” (March 1997), we mentioned using “human policies” in addition to computer-oriented ones. Simply put, this means educating your students, teachers and staff about what is and is not acceptable use of the network. Although creating an Acceptable Use Policy is unlikely to stop a determined would-be hacker, it is still an excellent idea since it sets rules and regulations for network users to abide by. Once you’ve developed an Acceptable Use Policy, you can then distribute it to faculty and students; you could even make it a requirement that the policy be signed prior to the user or student being given an account on the system. Once you’ve done this, you’re ready to help enforce these policies by implementing physical changes that will remove a few of the more obvious temptations for system users.
Securing the Hardware
The first step to locking down the desktop is making sure that each of your networked PCs is protected as much as possible from unauthorized access or modification. One often overlooked area is the ability for a user to easily boot the system and make various configuration changes to the system CMOS using the BIOS setup utility (the option to enter this utility is shown at system startup). To prevent this from happening, consider password-protecting each system BIOS with the same password—one that only the system administrators know. In addition, most system BIOS utilities allow you to set the drives the system will use to boot and in what order. Setting this option to boot from drive C first (and thus the version of Windows installed on that drive) rather than drive A can help prevent network users from using a DOS or Windows 95 boot disk to gain unauthorized access to the system’s hard disk. Another benefit of this configuration is that it reduces the likelihood of a boot sector virus infection resulting from an infected floppy present in the A drive when the system is started.

If the copying of data from your network onto floppy disks is a concern, you may also want to secure the system floppy disk drive. For example, you could use one of the commercially available “floppy locks,” which can only be removed by an administrator with a key. Or, you can use the BIOS option present on many systems that allows you to set the mode for the system’s floppy disk drives to read-only rather than read-write. This will grant read access to disks inserted in the drive but prevent users from copying data onto them. The importance of these measures can’t be overstated: Not implementing them may allow a user to circumvent the software-level restrictions you’ve put in place.

Introducing System Policies
In “Setting Boundaries,” we introduced the concept of system policies, files containing special administrator-mandated system configuration settings. These settings are automatically downloaded whenever a user logs on and can be used to disable or restrict certain operating system features that aren’t appropriate for a particular user or group of users. The tool used to create and maintain these policy files is the System Policy Editor (SPE) utility, which is included with both Windows NT Server and Windows 95. SPE is an indispensable utility for any network administrator seeking to secure desktop PCs.

Policy File Basics
An often-asked question about setting up a Windows NT and Windows 95–based network is How can an administrator automate the process of controlling a desktop PC’s environment? This includes specifying which programs users can access, the level of control they have over their operating system environment, and even the appearance of their desktops. Imagine creating a list of system restrictions, stored on your server, that could automatically be applied to a desktop PC’s registry (configuration database) each time a user logs on. Furthermore, imagine that this list is both user- and group–specific; that is, the restrictions taking effect depend on the particular user and his or her group memberships. That is exactly what SPE accomplishes.

Because basic architectural differences exist between the system registries in Windows NT and Windows 95, a distinct version of SPE is required for each. Although there is no problem with using both SPEs on one network, always use the Windows NT SPE under Windows NT to create system policy files for Windows NT desktops, and use the Windows 95 version while running Windows 95 to create policy files for Windows 95 desktops. Keep in mind that implementing a Windows NT system policy file won’t really be necessary unless you have multiple computers running Windows NT Server and/or multiple client desktops running Windows NT Workstation.

SPE manages two distinct types of policies: the system policy for users and the system policy for computers. Together, they restrict a user’s access to the computer. When a user sitting at a computer running Windows 95 or Windows NT 4.0 logs on to a Windows NT domain with his or her user account, the system automatically merges the system policy for users portion of the file with the user’s profile (Ntuser.dat in Windows NT or User.dat in Windows 95) and replaces any settings in the user’s profile that don’t match those found in the system policy file. In addition, any machine-related settings defined in the system policy for computers get added at this time to the HKEY_LOCAL_MACHINE portion of the system registry database. The net effect is that you get a customized set of system configuration settings for every computer and user in the domain, with all the restrictions you’ve designed in place.
Policy Precedence
A policy “pecking order” exists when a user belongs to one or more groups with defined policies. The pecking order goes as follows: When an individual policy exists for a user, it takes precedence over any group policies defined for groups the user belongs to. If the user belongs to two or more of groups that have policies defined, Windows NT uses the group priority order that the administrator defines.

In much the same way individual policies override group policies, group policies take precedence over a default policy if one is defined. A default policy is used when no other policy definitions exist for a particular user. If you have only a default computer or user policy defined, SPE will apply this policy to everyone, including the administrator. If you don’t want to limit the administrator’s access to the machine, be sure to define at least a group policy that creates no restrictions for the Domain Admins global group.
Tips for Creating Policy Files
Install System Policy Editor on your system, if you haven’t already done so. For Windows NT, SPE is found on the Windows NT Server 4.0 CD-ROM but not on the NT Workstation CD-ROM. From the NT Server CD, you can install SPE on either an NT Server or on a Windows NT Workstation 4.0 system. To install SPE, run the Setup.bat file in the \clients\svrtools\winnt folder of the Windows NT Server CD. This program will automatically install the SPE utility and several other server administration tools. For computers running Windows 95, select the Windows Setup option from the Control Panel’s Add/Remove Programs dialog. Choose the Have Disk option, and then point the Have Disk dialog to the \Support\Apptools\Poledit folder on the Windows 95 CD. In the dialog that appears, select the System Policy Editor option and click OK to have SPE installed on the system.

Once you have SPE running and have created a new system policy file, it’s time to select some policies for your environment. Go through each of the listed policies carefully, and evaluate the possible advantages for each in your environment. Include those that control access to system configuration utilities, such as the registry editor applications, and others such as the Network and Display Control Panels. Although most of the security-related policies are located in the system policies for users and user groups, you may also want to set some of the computer-oriented policies to create a uniform desktop environment and define some general machine-oriented settings for your network workstations. As you peruse the system policy for computers and system policy for users, you’ll notice that there are many different kinds of policies serving different purposes, including those related to security, maintaining a more consistent desktop, system performance, and the automation of tasks.

To change a policy for a particular registry, navigate the policy tree by double-clicking the branch you want to expand. Once you’ve expanded a branch and located a value you want to change, you’ll see a check box which will be in one of three states: disabled, cleared or selected. A disabled check box means that no change is allowed for this entry. A cleared check box tells SPE not to use the item, and a selected box tells SPE to enable the item. When you enable certain entries, SPE sometimes requests additional information related to the item at the bottom of the dialog box. For example, if you’re creating a Windows NT policy file and check the box next to the NT System\Logon\Logon Banner policy to enable it, you must also enter a window caption and banner text for the custom logon banner in the boxes below.

The files that you create must also have different names: a global Windows NT system policy file must be named Ntconfig.pol, while a global Windows 95 system policy file must be named Config.pol. Either file, once created, should be stored in the NETLOGON share of your Windows NT Primary Domain Controller (PDC); typically, this is the \Winnt\System32\Repl\Import\Scripts folder. If your PDC is located across a WAN link and you would prefer to have clients pull policy files from a locally authenticating Backup Domain Controller (BDC) located at the same site, you can select the Load Balancing option in the Local Computer\Network\System policies update\Remote update policy section of the System Policy for Computers dialog. For networks with bandwidth or cost issues related to the use of the WAN link, this can be a very useful setting. If you select this option, be sure to have replication configured between the Windows NT PDC and BDCs to ensure that each BDC has a copy of the system policy files for your network. 

Now you’re ready to tackle the client side of things: Computers running Windows NT are pretty much capable of handling policy files out of the box, but you will need to take a few steps to ensure that your Windows 95 system policies work properly. Those steps are listed below:

1.	Configure each computer running Windows 95 to log on to the Windows NT domain using the Client for Microsoft Networks option in the Configuration tab of the Network Control Panel. In addition, it is recommended that you configure the system to use user-level rather than share-level access control (in the Access Control tab of the Network Control Panel).
2.	Enable user profiles on each computer running Windows 95. In the User Profiles tab of the Passwords Control Panel,  select Allow Users to Customize Their Preferences and Desktop Settings.
3.	Install group policy support on each computer running Windows 95 by using the Windows Setup tab in the Add/Remove Programs Control Panel. Select the Have Disk option, and then point the Have Disk dialog to the \Support\Apptools\Poledit folder on the Windows 95 CD-ROM. In the dialog that appears, select the Group Policies option and choose OK to have group policy support installed on the system.
4.	Using User Manager for Domains on one of your Windows NT Server domain controllers, make sure that every user has a home directory defined (this option is located in the Home Directory section of the User Environment Profile dialog, which you get to by clicking the Profile button when viewing a user’s properties screen. In addition, be sure that each user has at least Change permissions on their home directory on the server. This is important since this is where user profile data is stored for each network user.

Remember: there are many policies available to you in SPE, so it’s always best to start small and work your way up as you become more comfortable with using the editor. In addition, remember to test each policy change you make while logged on as a member of the user group you’re restricting. This will ensure the policies are being implemented properly.
Avoiding Some Policy Pitfalls
The pitfalls of first-time SPE users can be easily avoided if you know about them ahead of time. Setting a policy the opposite of what was intended is a common error; this is especially likely to happen with policies phrased as negative statements, such as “Do not display last logged on user name” or “Disable Registry Editing Tools.” Clearing these entries cancels the negative statement (for example, if you clear the check box for the first entry mentioned, you’re saying, “Do display last logged on user name”). Therefore, be sure to double-check the policies you implement and test them thoroughly afterwards to ensure they are acting as expected.

Another common pitfall is incorrectly placing the policy files on the network. As mentioned previously, the policy file for your domain should be placed as Ntconfig.pol (Windows NT) or Config.pol (Windows 95) in the Netlogon share of the Primary Domain Controller (PDC) (again, this is usually the \Winnt\System32\Repl\Import\Scripts folder). If some computers running Windows 95 aren’t using group policies (user policies created for domain user groups) properly, but are working fine with computer and individual user policies, it’s likely that you forgot to install the Grouppol.dll file on those machines. In addition, remember that for system policies to work properly on Windows 95 systems, you must have user profiles enabled in the Windows 95 Passwords Control Panel.
	
Many administrators new to SPE forget to create special provisions for administrators and power users, causing unnecessary restrictions on their desktop. When you create a new system policy file, set up policies with the appropriate settings for these users.

The last pitfall category comprises anomalies that occur in some environments where system policy files are being used. I’ve occasionally experienced situations where desktop computers running the OEM Service Release 2 (OSR2) version of Windows 95 would not locate and use system policy files until the Remote Update Path was manually set to the proper location using the Open Local Registry option of SPE (this allows you to do a “live” configuration of system policies on a machine rather than storing the settings in a policy file). Once the Remote Update Path is set to manual and points to the correct network location of the system policy file in these situations, the system will then process the policy file correctly (typically, the setting is Automatic Update whereby the client will automatically pull the policy file from the server that authenticates its logon). One last anomaly that some administrators may experience is a Windows 95–based computer that refuses to read a group policy, even when Grouppol.dll has been properly installed. In this situation, you may need to implement individual user policies in the system policy file as a workaround. These are rare situations and are Windows 95-centric; I have yet to see them occur on a Windows-based system.
The Limitations
Although the implementation of system policies on your network will go a long way toward increasing security and reducing administrative burdens, don’t expect them to be a panacea for all your network security needs. Specifically, with Windows 95 clients, there are a few limitations you should be aware of. Computers running Windows 95 are less secure than Windows NT computers. Although the use of system policies significantly enhances the security of a Windows 95 system, there are still ways around this security if you’re a clever enough hacker. Unlike Windows NT, Windows 95 allows you to boot to Safe Mode, which makes it easy to edit system configuration options and modify the registry since system policies won’t be in effect. In addition, it is always possible to use Ctrl-Esc in Windows 95 to open the Task Manager application (even before the user has logged on), which can subsequently be used to launch any application of the user’s choosing.

Although these limitations won’t cause problems in most environments, it’s important that the system administrator be aware of them. After all, forewarned is forearmed. As regards the Task Manager problem, you can reduce the ability of users to run unauthorized applications by storing as many applications and utilities as possible on an NTFS volume on your Windows NT Servers, allowing you to set permissions on these applications to prevent unauthorized access. The only way to create a fully secure environment is to use Windows NT on every machine on the network, which is logistically or financially difficult for many schools.

By following the tips in this article, you’ll be able to create a more secure environment that still provides your students and teachers with the network access they need to get their work done. System Policy Editor provides you with a new level of control over your desktop environment, one that will help prevent chaos and protect users from intentional or unintentional tampering. In addition, you’ll sleep a lot better knowing that no one can easily obliterate days’ or even weeks’ worth of your time and efforts.

About the author: Sean Daily is a Microsoft certified systems engineer (MCSE) and owner of iNTellinet Solutions, a network consulting firm and Microsoft Solutions Provider in Northern California that works with both businesses and school districts using Microsoft products. In addition to being a contributing editor to Windows NT Magazine, Sean is the author of Migrating to Windows NT 4.0 from Duke Press and Optimizing Windows NT from IDG Books.

4. Classroom Corner

KidsConnect

KidsConnect is a free online help and referral service for K–12 students. Established in April 1996, KidsConnect helps students around the world find information on the Internet with the help of school library media specialists. Beyond helping students find information, the service empowers them to use and cultivate lifelong research skills—otherwise known as “curiosity.”

By Miebeth Bustillo

Searching the World Wide Web for information that is both appropriate for kids and accurate can be a daunting experience. Enter KidsConnect, a free online help and referral service that provides a starting point for K–12 students and teachers learning to make sense of the Internet.  

KidsConnect offers:
  
•	Prompt, professional and reliable assistance from certificated school library media specialists.
•	Effective use of the wealth of information resources available. 
•	Student familiarization with Web-based technologies. 

As Barbara Troisi, a retired librarian and teacher turned KidsConnect volunteer, puts it, “We offer students the opportunity to be better connoisseurs of information . . . It’s their library on the Internet!” KidsConnect, underwritten by Microsoft Corporation, is a component of ICONnect at www.ala.org/ICONN—a technology initiative of the American Association of School Librarians (AASL at www.ala.org/aasl).  ICONnect is designed to offer school library media specialists, teachers and students the opportunity to learn the skills necessary to navigate the information superhighway.   

KidsConnect is growing at an accelerated pace with almost 4,000 questions answered by the end of its pilot year in April 1997.  It’s estimated that KidsConnect volunteers will answer 300 questions per week this fall, and 500 per week by April 1998, the official end of the second year. Currently, KidsConnect has nearly 200 volunteer librarians representing 10 countries (United States, Canada, England, Japan, Israel, New Zealand, Australia, the Philippines, Indonesia and Malaysia) and plans to add more school library media specialists over the coming year. Most of the users are elementary (K–5) and high school (9–12) students.

In a typical interaction, a student goes to the main KidsConnect Web site address at http://www.ala.org/ICONN/AskKC.html or sends an e-mail to AskKC@iconnect.syr.edu with a subject query, say  about aboriginals in Australia or a specific battle of the American Civil War. A KidsConnect volunteer then searches for possible resources on the Internet and responds with two or more resources within two school days. 

Janet Fortune, a KidsConnect volunteer from Alaska, notes that students are not just given an answer.  Instead “they are given the path . . . to find the answer.” That path may include learning how to select keywords or when to use a specific search engine. Often a librarian will suggest print, CD-ROM and other sources as well. With this strategy, the students benefit from directed, focused and comprehensive research, and they acquire basic Web research skills.  Results are often rewarding. Students from Ross School in Marin County, California, for example, used KidsConnect services for their preparation for an academic pentathlon. Here’s their reaction after winning:  

This is a very big deal as we are a small school competing with giants. Thanks so much for your help. Now that we know you are there . . . who knows what kind of questions we will be asking. Thanks again.  The Ross School Winners!!

Because of the two-school-day turnaround period, KidsConnect is not recommended for assignments due the next day. For students, school library media specialists and teachers who need immediate assistance, KidsConnect volunteers offer an interdisciplinary list of their "Favorite Web Sites," available at http://www.ala.org/ICONN/kcfavorites.html. A KidsConnect FAQ Web page is also in development.

In addition to helping students around the world take advantage of the wild and wonderful world of the Internet, KidsConnect volunteers find the work enjoyable and personally satisfying. Examples of the interesting information Fortune gleans from the Internet are that Robert E. Lee carried a chicken around during the Civil War so he'd have fresh eggs and that lizards’ tails will grow back if accidentally cut off.  
  
Teachers can also take advantage of the service. KidsConnect volunteer Carolyn Karis, from the Herbst Library in San Francisco, says she once “fielded questions from a teacher interested in developing an interactive exploration game on southeast Asia trade in the seventeenth and eighteenth centuries.”  The teacher’s “need to include accurate historical information about ships, trade patterns, weather . . .  required . . .  quite a bit of research,” says Karis. From her search, Karis suggested numerous resources including information found on the Web, local libraries, magazines, museums and even contact names. The teacher later sent Karis an e-mail thank you:

Thank you so much for your extensive research. . .  Almost all of my information for this unit is coming from books which have been out of print for over 20 years! I really appreciate your help in making this unit more factual and adding some nautical history. You are the greatest!   

According to Karis, KidsConnect also provides a “broader scope of information for individuals and for locales with limited local resources,” as demonstrated in this note from a teacher in Sydney, Australia:  

I had been down to our local library but they didn't have any books on Aboriginals and weapons. The next step would have been to go to the bigger library in Penrith, outer western Sydney . . .  I have bookmarked the Web sites you sent for any future questions the boys may have in their homework . . . thanks once again for your help.

KidsConnect can become your ally in teaching students how to learn. After all, what good is information if you can’t find it? And what fun is it, if it takes a gazillion hours to find?

If you would like to get involved, the ICONnect Task Force is looking for school library media specialists interested in being trained as KidsConnect volunteers. To learn more about participating as a volunteer and taking the online training sessions, please contact Sandra Block, KidsConnect co-chair at: blocks@mail.firn.edu. 

About the author:  Miebeth Bustillo is currently the project coordinator of the Microsoft K–12 Solutions Pilot Program, helping schools become connected learning communities. She has a master’s degree in public administration with an emphasis in education and social policy from the University of Washington’s School of Public Affairs.

© 1997 Microsoft Corporation. All rights reserved.