Administering Windows PC on a network

Hi guys, we have over 100 windows pcs running different flavours of Windows on a LAN and I was wondering what would be the best way administer them. i.e. install/update anti-virus, disable usb ports, control user access to say network config, etc.


Is this something to do with active directory, windows domain, or what? I know what I'd like to achieve but not sure what it's called if this makes sense.


Where do I start?


thanks for any contributions

For antivirus I recommend Sophos.

Web Protection/Filtering
Data Encryption
Device control (usb protection)
Application control
Data Control
Path assessment
NAC
Firewall
Exchange/share point protection

If you buy over 200 licenses they allow you to share their protection with your employees for home protection. Which is pretty cool. With this many machines id recommend active directory.

Everything you're asking for can be managed through Group Policy. Group Policies can be applied at the Group, OU, Domain, and Forest levels. This will allow you to specify if you want the USB ports to be utilized, desktop config, push out software (anti-virus), etc.

For 2003 Servers, you need to run gpedit.msc to open the console for Group Policy. 2008 and up servers have this readily available from the Administrative Tools, provided you are on a domain controller.

Thanks guys