[SOLVED] Questions about setting up some small business PCs to be an Admin controlled network (i.e. group policy, permissions, user accounts)

[Lewis6209]

Hi all,
In the future I may open my own franchised business where I will be provided with 2 computers as part of the basic setup. The software used for business matters has its own permissions system which does all of my needs there, but of course I need to restrict parts of the Windows system too for any employees, taking off useless things, disabling security risks, and in general making the system more work friendly. I'm overally quite computer nerdy but this kind of networking and permissions I have never dabbled in. Not looking for any detailed instruction - I'll do that research myself via online resources and playing around myself, but I would appreciate any pointers. Please note some graphic design will apply so not looking for any kind of virtualisation/thin client/remote style setups which tend to add latency. Also, while computers will be internet connected (should add that a 1Gbps 16 port switch is included), they will not need to connect (yet) with a similar style of private/employee/work network externally - all of this would be in the same building.

1. I would be provided with those two Windows 10 Pro computers. It may expand to around a maximum of 5. Ideally I would like to network these systems in a way that I can change all permissions and accounts on one device and it is shared everywhere, just like most corporate networks. Would it be okay to use one of the systems to achieve this, or would it be better to get a server rack/dedicated machine to act as the host/server?
2. What would be the best way to handle user accounts and permissions overall? I am aware of the Group Policy editor, but does this do enough to restrict things appropriately, or would you recommend a seperate peice of either Windows or third party (free or paid but not crazy corporation prices) software that could handle this?
3. If not answered in question 2, what is the best way to handle user accounts? When looking at the add new account screen in Windows 10, I notice the Work/Education account option and one of the 'alternatives' is 'Local Active Directory Domain'. Is this the kind of thing I need to explore for that centralisation I desire, or something else?
4. Any other tips or pointers appreiciated.

Thank you very much for anyone who can assist.

 

[Wolfshadw]

1. While it would probably be better and easier to have another system running Windows Server and acting as a domain control for group policies, I believe it is possible to do using PowerShell Scripts.
2. Best way would be to run a Windows Server Domain Controller. This and the Group Policy Editor is the easiest way to manage accounts and system security.
3. See #2
4. If cost is an issue, maybe look up Linux Servers.

-Wolf sends

 

[Alabalcho]

If all your employees will need is that business software, it is relatively easy to lock the computers to run this software only. But if your employees will need eg Internet access, then you're moving into "Business" domain.