Just ban the accounts of anyone who does that kind of thing. Problem solved.

Harness that creative energy and get the kids to fix it :Y

Isn't the more important thing trying to work out what this default profile is (is it a local machine profile?) and why it isn't locked down and password protected?

Seems like there is something much more fatally flawed if they can gain access to the local machine with Administrator privileges that easily.

That's just it, they're logging into a network profile and when it loads, they remove the network cable before it's got all of the GPO settings, effectively giving them lots more rights.  So it's their profile, only it hasn't fully loaded.

You're doing something wrong.

I have no idea what, but if a correctly setup modern Windows network can be circumvented by temporarily pulling a network cable it would be all over the news and everyone here would probably already know about it. (And Microsoft would be working on a real patch, not a VBS kludge.)

The process of loading a profile should add privileges, not give full admin rights then remove them.

They can't circumvent domain privileges, but they can circumvent ones locally.  They pretty much end up with local admin rights.

But that's kinda the point, why isn't the default profile locked down and if it isn't can you change the default profile so it is locked down or put a password on it?

Not saying you're doing it wrong, just that's what I would be looking to change rather than use a hack in the form of a VB script.

Do you know how you change the default profile though?

No, I don't. But the profile must be being loaded from somewhere, so you must be able to change it.

Link: http://www.mombu.com/microsoft/windows-group-policy/t-group-policy-being-bypassed-by-unplugging-the-network-cable-511604.html

I like that their forum filters the "cum" out of "circumvent".

Aha, you actually just copy another profile and make it the default.  Nice one, I'll try that.

I bet no one on that forum lives in Scunthorpe then.

I may be completely off target here, but could the problem be that you need to use an actual executable in the registry entry, and supply the script's filename as a parameter?

Like instead of just

"C:\Windows\HackyScript.vbs"

you'd have

"C:\Windows\RunVBScript.exe C:\Windows\HackyScript.vbs"

Or Penistone...

Bawdrip should be fine though...

http://i.imgur.com/XRbGpt2.jpg

As if anyone knows anything about coding living in Bawdrip. All their time is taken up gossiping about their town's name. I'm sure it sounds more salacious when spoken with your subtle, yet sonorous lilt. </s's>

Wow, I wish I lived in a far away house so I could get a magical free bus service too.

Apostrophes do not make fucking plurals.

 :-(( I needed something in there to define what I meant. In hindsight I should've typed /Ss. However that looks like I'm trying to either refer to or close the SS down and what a nice neighbourly bunch of boys they were. Not that that's got anything to do with a farcical HTML tag. I'm sure there's (probably) a point in there somewhere, but I've been distracted by breakfast and work and any train of thought I had going has pulled out of the station leaving all the passengers behind looking confused and disgruntled.

I try to make them, except my true love is the comma! 

(hug)