FARONICS DEEP FREEZE ENTERPRISE - BEST PRACTICES 6-25-2009 Manual page 2

Introduction
This document was created to give administrators a set of guidelines to follow to ensure Deep Freeze
is set up and deployed in the most ideal way. This document describes the best way to set up a client
machine to use Deep Freeze. It also describes some different methods to administer Deep Freeze for
patches and updates.
Implementation
This section explains the recommended methods to initially configure your Deep Freeze environment
and deploy it to your clients. This section also explains additional configuration settings recommended
by Faronics to secure the machines.
Selecting a Customization Code
When configuring a Customization Code, it is good to use a combination of letters and numbers.
It is also recommended to write this code down and store it in a safe place. Unlike a password, a
Customization Code is not easy to change after deployment. Changing the Customization Code results
in having to re-deploy the entire installation of Deep Freeze.
Installation Configuration
When creating a workstation install file, there are many settings that can be configured. It is
recommended to create a password for the workstation that can be used locally at the client machine.
This allows the administrator to Thaw the client machine when changes need to be made. It also allows
for the possibility that the client machine will not be seen in the Enterprise Console, in which case this
would be the only way to turn off Deep Freeze.
Installation Deployment
Any deployment solution can be used to push an image with Deep Freeze to your clients. Faronics does
not recommend any specific deployment solutions. They should all work with an image that has Deep
Freeze installed. In order to successfully deploy an image with Deep Freeze installed, Deep Freeze must
be in a Thawed state with the Clone flag set. For more information about deploying with Deep Freeze,
please refer to the white paper entitled: Deep Freeze - Rapid Deployment at the following location:
http://www.faronics.com/whitepapers/DF_RapidDeployment.pdf
Securing the System
The CMOS should be configured to prevent booting from the floppy drive or CD-ROM drive (i.e. set
to boot to the hard drive) and the CMOS must be password protected. This is a normal precaution for
most public access computers. The Windows Registry, the computer CMOS, and the boot sector are
protected by Deep Freeze from within Windows.
Retaining User Data
In an environment where the user data needs to be stored on the local machine, it is possible to set
up an area where the user data can be stored. This involves redirecting data to a Thawed location. For
more information about setting up a Thawed area, refer to the document titled, Retaining User Data at
the following location:
http://www.faronics.com/whitepapers/DF_RetainUserData.pdf
Installation Order With Other Faronics Products
In order to properly install an environment that contains both Deep Freeze and Anti-Executable, it is
suggested to install Deep Freeze first, followed by Anti-Executable. This ensures that Deep Freeze is
properly added to Anti-Exectuable's list of authorized executables.
2