Changing IP From Standard User

[CraigWolfneden]

Hello Everyone,

I have been googling this problem for a while now, and I cannot see an anwser online.

I teach CCNA to students, the only thing they need to do is to change the IP address of the machine to match the various IP addresses during the course.

Ideally I will lock down the other parts of the OS using Group Policy Objects so they cannot disrupt the running of the OS.

One of the steps I come accross was to add the user to the 'Network Configuration Operators' group. However the UAC asks for a password when I change IP address, and then disallows the user from progressing.

The PC's have no password assigned while I am in the testng phase (this may affect UAC).

All the PC's are on a peer-to-peer so no AD or server to deal with.

I am running Windows 7 Pro 32-Bit on all the machines.

Such a simple problem is making me lose my hair!

 

[AddRAM]

Have never known UAC to need a password. But then I never create a Standard User.

UAC - Require a Password for Administrator

It looks like a Standard User would need a password, but an Admin would not.

Someone asked the same question here.

How to disable UAC password prompt for Standard User without admin?

The whole point of creating a Standard User is so they can not make changes to Windows, You should know this.

 

[Alejandro85]

It's not possible. Changing the IP address (as well as many other network configurations) is a system-wide change, and therefore requires administrator access. Allowing standard users to change it would mean that anyone can tamper with the network, disrupt connectivity or setup malicious activities. Either give them admin access or they can't do it.

However, this is a prime use case for a virtual machine. Just install a preconfigured VM and give it to the students to toy with, including full admin access there (but NOT to the host). After the class you just restore them to known-good points and throw away every change.

 

[samuria]

It's normal n these cases to run deep freeze or similar with that users can delete all windows if they want but any changes are gone on reboot that way they can be admins and on reboot it's back to normal for next class

 

[AddRAM]

We used Norton Ghost, great software.

But we installed a new OS everyday anyway.

Anyway ......

Teach them to create an Admin account on their PC`s, run your course, then have them remove the Admin account.

Not sure why a teacher is having any problems here.

 

[Alejandro85]

Teach them to create an Admin account on their PC`s, run your course, then have them remove the Admin account.

But creating another user account requires in itself another administrator account, which sort of defeats the point. I would still use a VM, or at least, reimage the computer after each class. It's not only a matter of deleting user accounts, any other changes must be reversed so that the next group can again solve the same problems.

 

[samuria]

With deep freeze no need to reimage as it reverts back to default even if infected and files deleted on reboot

 

[Alejandro85]

With deep freeze no need to reimage as it reverts back to default even if infected and files deleted on reboot

DeepFreeze IS an image! Automatically restored on each boot and taken with a different method, but it fundamentally is an image.

 

[craigwolfenden]

Hello guys and girls for your replies.

I would ideally use VM's for teaching, however due to my teaching environment this is not possible. I also need to maintain a high level of security on the PC's. Hence I do not wish to allow admin access, again due to my environment.

I know the nature of std user means admin access is not allowed. However there are programs that can elevate the privillages. Also the Network Operation Configuration group should allow someone to change in address Use the Network Configuration Operators group ... although a restart would be needed (hence not using deep freeze). Another problem with deep freeze is that it requires a yearly license. I can convince my employer for a one off fee, but an on going license is harder to convince them.

 

[craigwolfenden]

We used Norton Ghost, great software.

But we installed a new OS everyday anyway.

Anyway ......

Teach them to create an Admin account on their PC`s, run your course, then have them remove the Admin account.

Not sure why a teacher is having any problems here.

AddRAM I have no idea why you are coming across as hostile in your answers / replies. Allot comes down to my teaching environment being challenging, more so than your average classroom which adds further complications.

There are lots of software and configuration out there, we cannot know them all. I certainly do not know everything, and I am always open to learning.

 

[Alejandro85]

I would ideally use VM's for teaching, however due to my teaching environment this is not possible. I also need to maintain a high level of security on the PC's. Hence I do not wish to allow admin access, again due to my environment.

Why exactly VMs are inadequate for your needs? What things do you teach that they would not work? At least could you try to use them for part of the class?

Otherwise, you have conflicting requirements. Forget about the admin thing for a moment, you need high security and strict control over the computers right? But also you need to give them to students so they can "break and fix" them over and over? Fundamentally, from a security perspective, the students must never be trusted at all, even without administrator access. They can do literally anything, and you should treat those computers as public ones. They should be reimaged after each class, its data not used at all and not use them for anything else, even possibly isolate them in a separate network segment with an extra router.

Even more, since your class requires admin access, the computers themselves should be considered not trusted at all times, thus the recomendations of things like DeepFreeze. Explain your employeer that security cannot be achieved without blowing up the computers after each class, and software like this is designed to do so. If you don't want to spend money on it, just use an alternative, a few ones are listed here:
Top 3 Free Alternative for Deep Freeze - Your Post My Blog

Even you can do it manually, by taking an image and restoring it yourself. Boring, but doable. Going by that route, you then forget about the problem of giving administrator access. Just give it away, anything done will be destroyed each time anyway. Of course, it must be local admin power, not on some domain. If you need a domain, make one of the test computers a server and reimage it too each time.

 

[craigwolfenden]

Hello Alejandro,

VM's are perfect for my needs, however they are not permitted in the establishment I work with due to the type of students we educate. Which is why I have made this post to 'fish for anwsers' and possibilities. As part of the course, students only need to change the IP address of the local machine to the various different settings depending on the lab they are doing.

I am currently using Reboot RX in other areas of the classroom on independant machines (but I will also look at the others out of interest).

My real issue is trying to permit a standard user/limited account to change ip address; then I can implement a reimaging solution. If it is simply not possible,then I am barking up the wrong tree. However there are allot of people who read these forums, with all different kinds of experience and knowledge. I was hoping someone would be able to offer a fix or know of a program / waythat would allow me to circumvent / modify the restriction.

p.s. The machines are on a peer-to-peer so no domain or AD to worry about.

 

[AddRAM]

It`s far from hostile, it`s straight forward

 

[Barman58]

Not sure if this will help at all rather than use the in-built facility, a small 3rd party tool that can be set to select a number of IP profiles - Not that modern but actually from the right Windows 7 times
Simple IP Config download | SourceForge.net

it may be possible to enable automatic elevation at start-up, and start minimised in the tray - if it has the functionality you require ...

Elevated Program Shortcut - Create for Standard User