However, after implementing DirectAccess its became apparent that when machines were connecting at home, they would pick up the WPAD settings and all Internet traffic was routed through our gateway/filter/firewall (which we didn't want it to do). The wpad even had an IP check in it which I thought would make the clients use a direct connection.

I believe that this is because the DirectAccess remote clients would find the wpad entry in DNS and use its internal IP, not its local IP, so according to the wpad function the machine was 'on network' with an internal IP so it tells the browser to route traffic through the on-site proxy.

A simple fix for this was to only publish the wpad location via DHCP. All major browsers now support the DHCP method (unlike a few years ago). Therefore when a DA client connects, it checks DHCP for the location (using its local DHCP server, which fails), then checks DNS (which fails) so uses a direct connection.

The setup

The DA server is running on Server 2012r2 (non DC). It is behind a Smoothwall UTM so NAT is involved (although supported by DA in Server 2012R2 is complicated things a bit).

The client I tested is running Windows 10 Education (Windows 8.1 Enterprise should work as well, Windows 7 Enterprise needs extra config not detailed here).

I have an external IP with a public URL of da.<school>.<local authority>.sch.uk

The Smoothwall UTM has a port forwarding rule to forward all traffic from our public IP on port 443 to DA server’s local IP.

The steps:

1. Create AD Security Group for machines that are allowed to use DA.
   
2. Install DA role on server:
   
   1. 
      
   2. Choose “Remote Access” role -> “Direct Access and VPN (RAS)” and accept the extra bits it wants to install.
      
   3. Reboot.
      

[*]Configure initial DA settings:

1. Run “Remote Access Management” from the Start Menu.
   
2. Run the getting started wizard.
   
3. Click “Deploy DirectAccess only”.
   
4. Choose the “Behind a Edge device (with a single network adapter) topology.
   
5. Enter your public URL (important: I found you must you the public URL, even though it says you can use the IPv4 address it doesn’t work in this setup (plenty of discussion on the net about this)).
   
6. Exit the wizard.
   

[*]Configure client settings:

1. On the setup screen, go to “Step 1 - Remote Clients” and click “Edit”.
   
2. Check “Deploy full DirectAccess for client access and remote management” and click next.
   
3. Remove the default group and add in your DA security group.
   
4. Uncheck “Enable DirectAccess for mobile computers only”.
   
5. If you want to force all remote clients to tunnel through your network for Internet access then check “Use force tunnelling” (though I doubt you will do this). Click next.
   
6. Here you need to add a highly available machine that clients can attempt to ping (I use our Smoothwall box) – there should also be DA webprobe added automatically, leave this alone.
   
7. I checked “Allow DirectAccess clients to use local name resolution” – I think that this is a good idea…
   
8. Click finish.
   

[*]Configure DA server settings:

1. On the setup screen, go to “Step 2 - Remote Access Server” and click “Edit”
   
2. Check the settings on this screen and click next.
   
3. Check the NIC is selected.
   
4. Check to use a self signed certificate (unless you want to create an upload a proper cert). Click next.
   
5. Choose your authentication method.
   
6. Click finish.
   

[*]Configure Infrastructure settings:

1. On the setup screen, go to “Step 4 – Infrastructure Servers” and click “Edit”
   
2. Ok so a note here. I am not clear exactly what a Network Location Server is, nor, apparently, do a lot of people who set this up. I plumped with using the DA server itself which a self-signed certificate which seems to work fine. Click next.
   
3. Ok another odd one here. On this screen you have to add in a DNS server on your local network. So I did, and it failed miserably. Next I took the option of allowing the setup to detect a DNS server and it came up with the DA server. Its not a DNS server but it worked. Go figure. Click next.
   
4. Add in your domain suffix. Click next.
   
5. Next you can add in any management servers. I added in our SCCM server but truth be told, I am not 100% on this option.
   
6. Click finish.
   

[*]On the setup screen, go to “Step 4 – Application Servers” and click “Edit”

1. I clicked to not extend but alter to our environment.
   

[*]Apply the settings:

1. On the setup screen, click at the bottom of the screen to apply settings.
   
2. You should now see that lots of whizzy things are happening, including:
   

    

   [*]Check the settings apply correctly:

   1. Click on the Dashboard link
      
   2. You will probably see that things are still being setup. The DA server needs to retrieve and apply the DA server GPO from a DC. This can take up to 15 mins.
      
   3. When applied you should see lovely green ticks next to all the checks.
      

    

   Once your DA clients have picked up the new DA policy you should be able to take the machine outside of your network and it will connect!

    

   Something to be aware of: It seems that a lot of people report that the DNS entries that the setup process creates are deleted during a scavenging cycle. Therefore I altered the following records to not be deleted when they are stale:

    

   1. directaccess-corpConnectivityHost (both IPv4 and IPv6 records)
      
   2. DirectAccess-NLS (both IPv4 and IPv6 records)
      
   3. directaccess-WebProbeHost
      

    

   Good luck! And post in the forums if you have problems and I’ll see if I can help J

1. Install the following patch to your KMS host: https://support.microsoft.com/en-us/kb/3058168
   
2. Request the following KMS key from VLSC "Windows Srv 2012R2 DataCtr/Std KMS for Windows 10" and install on your KMS host
   
3. Slaughter a fatted calf in the centre of a pentagram during a waning moon.
   

Seems so simple now I write it down...

Oh! And note that for some reason, if you setup a new KMS host on 2012R2 the KMS listening port defaults to port 0! It should be 1688.

So, in an effort to save other people the hassle of searching for this info here are a couple of things I learnt and my notes on how I deployed SCEP in the first place. Of course this is for my environment but can be easily adapted for yours. This is best way I could come up to structure everything in SCCM. Feel free correct any idiocies contained within.

Stuff I learnt:

1. Pre-Win10 machines use the full FEP client installed as a separate application, with post-Win 10 machines a layer is added to Windows Defender to control settings, def updates and AV policy
   
2. Hence from 1. its not a good idea to have Defender disabled by GPO
   
3. People having a Games Evening don't like to be lectured on the finer points of why can't play *that* particular card that that point in the game and don't respond to huffs, tuts and arm crossing
   

How I deployed SCEP

The elements of my AV setup in SCCM are:

1) Client Groups

2) Definition updates

3) AV policy

4) Client settings

Client groups (\Assets and Compliance\Device Collections\Endpoint protection groups)

My clients are organised into following groups based on product installed and location:

- FEP - onsite devices

- FEP - laptops

- Defender - onsite devices

- Defender - laptops

- Servers

Groups were then created to apply def updates and AV policies:

- Def updates

- All FEP clients

- All Defender clients

- AV Policy

- Groups for each type of machine that need a different policy (e.g. laptops are allowed to update defs from the Internet, different server types have different exclusions)

- Client settings

- A group containing all the AV clients to apply the global settings to

Def updates (\Software Library\Overview\Software Updates)

- Two Auto Deployment rules:

- ADR: FEP definition updates

- ADR: Windows Defender definition updates

- ADRs run every night after WSUS sync and add updates to appropriate Software Update Group and Deployment Package

- Software Deployment Groups are targeted at appropriate def update client group above

AV Policy (\Assets and Compliance\Overview\Endpoint Protection\Antimalware Policies)

- AV policies have been created for different types of machine

- Policies are targeted at appropriate AV Policy client group above

Client Settings (\Administration\Overview\Client Settings)

- Endpoint Protection management settings contain the settings the apply to the AV Client - this package is deployed to the Client Settings client group above (and hence to all machines with FEP to WD AV protection)

Dear couriers,

I have come to accept that you are not the brainiest bunch on the planet (in fact when they were handing out intelligence I suspect that you weren't at the back of the queue but actually not in the queue at all as you couldn't find the queue and were riding around in your garish van looking for the queue (probably driving dangerously)) but please can you note the following:

1. I work in a school. Our school is not open on a Saturday. Therefore claiming that a package was successfully delivered on a Saturday is a lie. Do not argue this fact, accept that you have been caught out, sort the delivery out and we can both move on. Do not continue to argue until the package is delivered the following week. DO answer my complaint.
   
2. Sometimes we are open during holidays and I am onsite. If I order something to be delivered during a holiday then I will be there to collect it. Don't assume that we are closed and don't both to attempt delivery and claim the school was locked up. See above about being caught out.
   
3. If the school is closed and I ask for a delivery to be made at the start of term, do not attempt to deliver during the holiday and wonder why the school is shut.
   
4. If the school is closed and I ask for a delivery to be made the first day of term, I mean the coming term, I don't mean term after that, or next year or ten years time. I certainly don't mean a random date plucked out the air to suit you.
   

Thanks,

sparkeh

So if you have tried to install Sketchup 8 on CC4 you might have come across the following problems:

1. Annoying auto update
   
2. Setting the default template for students
   
3. Annoying welcome screen
   
4. Probably the most important: it crashes if a non-admin user is the first to run it.
   

1 and 2 are easily solved with the following reg frag:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Google\SketchUp8\Preferences]

"DefaultTemplate"="C:\\Program Files (x86)\\Google\\Google SketchUp 8\\Resources\\en-US\\Templates\\Temp01b - Simple.skp"

"CheckForUpdates"=dword:00000000

Windows Registry Editor Version 5.00

"ShowOnStartup"=dword:00000000

[HKEY_CURRENT_USER\Software\Google\SketchUp8\WelcomeDialog]

So I just bought a new Android tablet and naturally scoured the instructions before turning it on. However I am worried after reading this warning:

For the smeared memory loss that is caused by product damage, repair or other causes of product damage, repair, the company is not responsible for it, so please follow the user's guide and timely backup.

The first in this series comes from an RM CC4 computer build:

Ummmm......

If this message from the Local Authority is to be believed it seems the good people at Capita have even more influence than previously believed and are now handing out honours!

Following the recent SIMS.net upgrade the Staff Title displayed on the 'Todays Register Report' shows either 'Lady' or 'Dame' (Reports/Attendance(Lesson Monitor)/Whole Group Pupil Reports/Todays Register Report. This will be corrected in the Summer 2011 Release

One of the things that I wished Chrome did as standard was the auto reloading of tabs. This is handy for a number of scenarios but I wish to keep myself logged into our Local Authority portal so I get the correct Internet filtering level all the time without having to keep logging in again when the timeout period expires.

There are extensions out there that will do this for you (eg Auto-Reload) but I was alarmed at how all these extensions have access to your website and navigation data. Then I stumbled on a handy hint on a forum that pointed me toward a much better solution. I didn't know this but you can include Javascript in the URL field of a favourite. Therefore you can do the following:

1) Create a new favourite with the URL below:

javascript: timeout=prompt("Set timeout "); current=location.href; if(timeout>0) setTimeout('reload()',1000*timeout); else location.replace(current); function reload(){ setTimeout('reload()',1000*timeout); fr4me='\n'; fr4me+=''; with(document){write(fr4me);void(close())}; }

2) Select the tab you wish to reload, then click on the favourite you just created

3) Enter the number of seconds you wish to refresh the page in.

Et Volia! Refreshed tabs in Chrome!

Just an update on my post "Making Installshield deployments silent"

After making a package using the above method I found that the machine was rebooting after installation even after attempting to suppress reboot.

Natually I thought that there must be something in setup.iss that was causing this and I was correct. If you need to stop a reboot in this situation, open up setup.iss, scroll to the bottom and change "BootOption=3" to "BootOption=0" and voila, no more reboot.

Somewhere, there sits a broken man, looking out of iron grilled window as his fellow inmates drag themselves around the stark exercise yard. Two orderlies stand and stare, one nudges the other one and asks "What's this guys deal?" The other leafs through a file of dirty papers and pulls out a patient profile "Ah yeah, sad story really, when they brought him in he only gave the name 'sparkeh' and a few details about what happened to him, hasn't said a word since, he just sits and stares."

As the orderlies read the story of how this man ended up in an asylum they shook their heads and made sympathetic noises. "When will people learn?" one sighed as he balled his fist and looked to the ceiling.

As the lonely sound of the retreating footsteps of the orderlies echoed down the corridor, the lips of the man slowly parted and exhaled a sigh. If anyone had been listening they would have sworn for all the world it sounded like "Sssssophossss"

Every so often I come across something that I am astounded that I don't already know. This might be a lot of old chips to you but whilst looking for tips on deploying Installshield installers I stumbled across guidance on making the deployment silent.

As you probably know, Installershield deployments usually come as a setup.exe file. This is not always the case but then you can usually grab the setup.exe and other setup files (cab file for example) from a temp folder when you launch the installer.

If you want to make the installation silent you need to use the /s switch, however the installer will look for and answer file called setup.iss. If you are luck then your software vendor will have provided one. Not very often though in my experience.

The good news though, is that you can create one yourself by running the installation with the record switch /r. This dumps a setup.iss file in c:\windows. Move this to the same directory as the installer and you can run the installation silently (with /s) with all the options you chose in the recorded run through. Well almost

There is one sting in the tale to be aware of though. Due to a forked process starting up and completing before the installation is complete, you need to add another switch (/sms) to force the process to wait until the installation is complete.

So in summary, once you have a installer with its setup.iss in place you can run 'setup.exe /s /sms'.

I hate Flash. I have wasted too many hours of the one precious life we are given attempting to troubleshoot network deployments of this terrible piece of software to garner even a tiny shred of bonhomie. So when I upgraded to Chrome 10 and suffered an irritating series of Flash crashes I was compelled to drop kick my laptop out of the window, book a ticket to Adobe HQ and make my feelings abundantly clear. Probably in a very British way, presenting a strongly worded letter explaining that I would think very hard before using their product again, or tutting loudly as people went in and out the building.

However I didn't do that but instead sought a solution which I will share in case you find yourself watching your computer sail out the window whilst you feverishly scour the Internet for the cheapest way to make it to the Adobe Offices to roll your eyes at the employees. As many other users seem to be suffering the same irritation this is quite likely.

Examine your plugins (click the spanner -> options -> under the bonnet -> content settings -> plugins -> disable individual plugins. You may see that the you actually have two versions of Flash installed. Disable the newer version and Flash will no longer crash.Well for that reason at least :/

Meantime we can all wait until the issue is fixed properly. Or Flash is destroyed. Either is good with me.

Just in case you hadn't seen this. I am too hacked off with this decision to post anything useful at the moment so here's the quote:

As you may be aware, Microsoft® is ceasing support for Windows Vista® SP1 in July 2011. We will therefore be ceasing telephone support for issues specifically relating to Windows Vista at that time. This will affect customers with a managed Windows Vista SP1 workstation either on Community Connect® 4 or Community Connect® 3 (through RM Client Connect).

With Microsoft's decision to extend the life of support for Windows® XP Pro and the uptake of Windows® 7, we have had to review our own support for current operating systems. As a result, we have taken the difficult decision not to release support for Windows Vista SP2 on Community Connect. By consolidating our development and support to Windows XP Pro and Windows 7 operating systems, we will be able to deliver a more timely solution to you in the future.

Please note: What this means in practice:

• This will not affect the level of technical software support that CC3 and CC4 contract holders receive for current CC3 and CC4 components. For example any customers operating Windows Vista SP1 workstations on their CC3 or CC4 network are still entitled to telephone support and 24/7 online support for any CC3 or CC4 related incidents.
  
• As Windows Vista related incidents are out of RM's control, under a customer's current contract if we diagnose that the issue is specific to Windows Vista, we may not be able to provide a resolution. Customers will still have access to technical support articles relating to Windows Vista SP1 in the RM Knowledge Library.
  
• As Microsoft will no longer provide any updates to Windows Vista SP1, any security flaws or other issues with the operating system will not be addressed by RM.
  
• Future development including software products (for example, virus protect and backup solutions) and RM software update releases will not be tested or supported on CC3 or CC4 Windows Vista workstations.
  

>:-(

Hands up who uses Testbase.

Hands up who likes installing Testbase.

I thought so. Its apt that the name is abbreviated to TB as it provokes a coughing fit everytime I have to deal with it.

I am so sick of this ridiculous program that when the Deputy asked for me to install the latest version it was prefixed by profuse apologies.

So here I am trying to install issue 13 on CC4. First port of call was to visit the TB site and get hold of the instructions for CC3; the process for CC3 and CC4 is roughly the same so shouldn't be too tough right? Not too tough if the instructions made any sense that is. I firmly believe that these set of useless instructions was the rejected content from an experiment to test the infinite monkey/Shakespeare theory - although I believe if I sat a monkey down in front of a CCx machine and explained the package building process it would produce better instructions than the tosh I am trying to work from.

So I decided to break it down an actually look at what TB is and what is does to find the actual way to install it.

So first up you copy all the data files to a server share. Ok thats fine, no issues there. Then the workstation component copies a few files, registers an object and a shortcut....and...that's it? That's all that's required to install on a workstation? How the hell is it possible to fudge the instructions for that?

In reality the install process is very simple and here are some working instructions that have also been sent to TB in the hope that they might do something about their own. Fingers crossed.

1)Create a shared folder on RMPublic drive called Testbase32 giving the 'everyone' group 'Read and Execute' access.

2)Logon on to a workstation as an admin user and run the installation program for each subject you have purchased, using the 'Network install' option, directing the installer to the 'RMPublic\Testbase32' folder, entering your licence information.

3)Logon to clean workstation as PackageBuilder user (with clean profile), run Application Wizard and choose to create a new package then proceeding with the first scan.

4)After the first scan has completed, navigate to 'RMPublic\Testbase32' and click 'Button B'.

5)Run the second scan to create the package on the server.

6)On a CC3 network: Copy the shortcuts from 'RMPublic\Testbase32\workstation' to the shortcut bank.

On a CC4 network: Add the shortcuts from 'RMPublic\Testbase32\workstation' to the shorcutbank via the RMMC.

7)Add the shortcuts to a program set.

8)Allocate out the Testbase package.

Simple.

Even more frustrated that the open source dev version (Chronium) has binaries available for certain distros but you are running Ubuntu which hasn't?

Well I have done some digging and found a simple way to install the latest dev version of Chronium in Ubuntu and its actually pretty damn good. (By the way I have done this in Karmic, I am not sure if this applies for older versions).

First step is to add the ppa source so add the following line to /etc/apt/sources.list

deb http://ppa.launchpad.net/chromium-daily/ppa/ubuntu karmic main
deb-src http://ppa.launchpad.net/chromium-daily/ppa/ubuntu karmic main

(or if you like the GUI add those lines to the software sources 'Other Software' option in Synaptic)

Next install the browers by either finding 'chromium-browser' in Synaptic or on the commandling with:

sudo apt-get install chromium-browser

I guess now that you want Flash to be working. To this we have to manually add the Flash plugin to the Chromium plugin folder.

If already have Flash installed then chances are the file we are looking for (libflashplayer.so) is in /usr/lib/flashplugin-installer. Therefore a quick copy to the plugin directory will suffice:

sudo cp /usr/lib/flashplugin-installer/libflashplayer.so /usr/lib/chromium-browser/plugins/

Finally a cosmetic step. It appears that Chromium uses Microsoft TrueType fonts which can be installed from the commandline with

sudo apt-get install ttf-mscorefonts-installer

or again using Synaptic.

And jobs a good'un

No. However, by a series of arcane incantations, reading out of date OO manuals and shouting at the computer, I have divined the sequence of operations that achieve this.

First of all you must ensure that the *full* open-office.org-base package is installed. This is not installed by default on Ubuntu and is not immediately obvious as there appears to be lots of database functionality available without it.

Then you can create your spreadsheet but make sure you save it as .sxc format so the information is accessible later.

Now you go to Writer to add the spreadsheet as a data source. There appear to be many options to add this (eg in the database options or via Exchange Databases in the Edit menu) but I found that all failed. Apart from one. The only time I could get Writer to add the spreadsheet as a data source was by attempting to add a field to the document (Insert -> Fields -> Other) and adding a new database. Interestingly after this step the spreadsheet appeared in the other database config windows that I tried above - go figure.

Ok next step is to go View -> Data Sources (if you don't have this option then you don't have the package discussed above installed), this brings up a view of your spreadsheet and you can simply drag and drop columns into your document leaving fields ready for merging.

Finally run the mail merge option and you have your document.

(The simplicity of these instructions belies the sheer hair pulling that accompanied their discovery)

Engineer called in to finish up and we have our test network.

So some boot time stats:

New machines (2.8GHz Core 2 duo, 2GB RAM) take 2 mins to boot screen from cold start and 30 secs from login to workable desktop.

Old machine (3GHz P4, 2GB RAM) take 3mins 20 secs to login from cold boot to login screen and 1min 25 secs from login to workable desktop.

Got to speak to engineer who told me that he was not coming in. Straight after the project manager phoned to tell me the engineer was coming in today.

Thing is, I am not opposed to a remote install, in fact I requested it and was told it was not an option. I mean I can connect everything up and fire off workstation builds perfectly fine. What I am opposed to is paying full whack for an engineer to be on site for two days and ending up getting a remote install and doing some of the work myself

I came in this morning to find the engineer connected remotely to the server and still configuring it.

I find this worrying as this means he is still at home. 2 1/2 hours away. Will he come back today? We only have today scheduled to finish off. Also I can see that he is only 1/2 way through the server commissioning instructions.

Of course I can do some of the bits (connect up APS, commission stations etc) but the point is we have paid to have this done by an engineer. I guess if I do anything wrong then I am liable rather than RM.

Hmm I portend a stressful day coming on.

Server setup is just about there and the engineer has setup PXE install as a favour which was nice. Been having a look and the RMMC is nice and snappy, much better than CC3's web based affair (although I haven't used it in anger yet).

Tomorrow I move on to building the test stations and taking those for a spin!

Just watching and I realise that the engineers have a set of instructions to follow - never really thought about that before, could have done that myself

Merrily doing its thing now. RM Engineer is reading a book. Apparently its a long wait.

Perhaps I can cajole him into helping me with some other issues I am having