This is a utility that I wrote in VB .Net 2010 a number of years ago. It's basically a wrapper application for TightVNC that allows me to remotely control client computers in the domain (think Team Viewer). The inspiration for this came from an older application called 'Gen Control' that basically does the exact same thing, but only worked for Windows XP and earlier. As of this writing I can verify that it works on all version of Windows Vista through 10 1809.

This is what it does in a nutshell:

1. Writes configuration registry keys to client's registry
   
2. Copies TightVNC server binary and DLL to client via admin share
   
3. Registers TightVNC as service on the client
   
4. Calls the TightVNC viewer on the support technician's computer and connects to client
   
5. Monitors for closing of TightVNC viewer
   
6. Unregisters TightVNC server service on client computer
   
7. Removes registry keys from client
   
8. Deletes files that were copied over
   
9. 
   

Some security concerns I took into account when writing this:

• Passwords for the TightVNC session are randomly generated for every connection
  
• When the server service is registered on the client the startup mode is set to manual
  
• In the event of a loss of connection before the cleanup can begin a script is placed in startup that will perform the cleanup the next time the client is restarted
  

Requirements:

• Remote Computer Management is enable and the port open via GPO
  
  Computer Configuration / Admin Templates / Windows Components / Windows Remote Management (WinRM)/WinRM Service: Allow remote server management through WinRM

  
   
  

• Remote Registry Service is started and the port open via GPO
  
  Computer Configuration / Policies / Windows Settings / Security Settings / System Services: Remote Registry

  
  

  Enabled and set to automatic startup

  
   
  

• Port 5900 is open to incoming connections on client firewall
  
• Secure Attention Sequence needs to be enable via GPO to send CTRL-ALT-DEL to clients via TightVNC
  
  Computer Configuration / Admin Templates / Windows Components / Windows Logon Options: Disable or enable software Secure Attention

  
  

  Enabled and limited to services

  
   
  

• The account being used to run this application from needs to have local admin credentials on clients you're attempting to connect to
  

There are options to to change ports, run ping tests before attempting connections, block user input from the client end, and other things.

When opening ports on the client computers through GPO be sure to do it on the domain profile on the firewall config. This way if you're working with laptops then when the device goes offsite those firewall exceptions are closed.

Attached to this blog post is the source code and compiled binary. The compiled binary can be found here: .\ZenControl v2\ZenControl\bin\Debug

Any questions or comments can be dropped here. I haven't updated this code in quite some time and there might be some bugs, but it is actively used by my department. This handy utility has saved me from having to make plenty of trips to remote buildings in the dead of Winter. I hope this helps someone out there....

ZenControl v2.7z

• Fixed a bug where it didn't count the number of newly created users correctly.
  
• Fixed another bug with the continue statement not working as intended when finding an invalid grade
  

I wrote this Power Shell script to automate user creation in Active Directory. It's run off of a scheduled task and maintains a log file of everything it does. It handles pretty much everything:

1. Copies the export and names by date, also names log by date for easy sorting and retention for debugging if need be
   
2. Rudimentary checking of the export file for date and columns
   
3. Username formatting
   
4. User creation and OU placement
   
5. Group membership
   
6. Home folder creation
   
7. Home folder persmissions
   

The Export looks like this:

PSNumber	Lastname	Firstname	Grade
1000001000	O'Neill	Jack	12
1000001001	Carter	Samantha	9
1000001002	Jackson	Daniel	11
1000001003	Mal Doran	Vala	11
1000001004	McKay	Rodney	12
1000001005	Hammond	George	12
1000001006	Quinn	Jonas	10
1000001007	Mitchell	Cameron	12

You'll have to change a few things to fit your environment, but this makes for a good starting point. The script is designed with an OU structure that breaks students down into graduation years.

-Students

-2018

+Student A

+Student B

-2017

-2016

-2015

+Student C

Every student is a member of their respective graduation year group: Students_2018, Students_2017, etc.

Account name is the first six letters of the last name, followed by the last four digits of their student number. The script will also remove some special characters from the names that AD could gripe about.

I hope this helps...

-Mark

#Define editable strings
$WorkingDir = "script path goes here"
$ADDomain = "Domain Name goes here"
$Password = "student"
$BaseOU = "ou=Grad Year,ou=Students,ou=Your User OU,dc=domain name,dc=com"
$BaseHome = "\\yourfileserver\students$\"
$HomeDrive = "H:"
$UserCount = 0

#Define non-editable strings
$LogPath = $WorkingDir + "Log $($LogDate).txt"
$LogDate = Get-Date -UFormat "%Y-%m-%d.%H.%M.%S"
$PSExportPath = $WorkingDir + "student.export.text"
$UserExportPath = $WorkingDir + "User $($LogDate).txt"
$TimeStart = Get-Date

#Create the log file and write the header - file named with date
"Processing started on $($TimeStart)" | Out-File $LogPath -append 
"--------------------------------------------" | Out-File $LogPath -append 
"" | Out-File $LogPath -append 

#Load the Active Directory module
Try{Import-Module ActiveDirectory -ErrorAction Stop}
Catch{
   "[CRITICAL] Active Directory module not loaded! Aborting." | Out-File $LogPath -append 
   "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append
   "`t $($_.Exception.Message)" | Out-File $LogPath -Append
   Exit
}

#Check for existance of user export file
$FileExists = Test-Path $PSExportPath 
If ($FileExists -eq $False){
   "[CRITICAL] User export not found! Aborting." | Out-File $LogPath -append 
   Exit
}

#Check age of user export file and stop script if more than 12 hours old
$PSExportFile = Get-Item $PSExportPath
$Limit = (Get-Date).AddHours(-12)
If ($PSExportFile.LastWriteTime -lt $Limit){
   "[CRITICAL] User export is more than 12 hours old! Aborting." | Out-File $LogPath -append 
   Exit
}

#Copy automated user export file to another name that includes the date
#this preserves the file along with the log, both named by date for debugging purposes
Copy-Item $PSExportPath $UserExportPath | Out-Null

#Import CSV and bust down using a tab delimiter - script stops if this fails
Try{$Users = Import-Csv -Delimiter "`t" -Path $UserExportPath -ErrorAction Stop}
Catch{
   "[CRITICAL] Export not formatted properly! Aborting." | Out-File $LogPath -append
   "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append
   "`t $($_.Exception.Message)" | Out-File $LogPath -Append 
   Exit
}

#Used to determine fiscal year - most US schools operate on a 9 month calendar year
#because of our SIS system the graduation year is derived from the current year and the student's grade level
#anything after the month of June is considered to be the next calendar year
If ($TimeStart.Month -gt 7) {$FiscalYear = $TimeStart.Year + 1}
Else {$FiscalYear = $TimeStart.Year}


#Function where the magic happens
Function AddUsers{

   #Step through each line of the export loaded into $Users
   :nextUser foreach ($User in $Users) {

       $i++

       #Assign each column it's own variable
       $UserFirstname = $User.First_Name
       $UserLastname = $User.Last_Name
       $PSNumber = $User.Student_Number
       $Grade = $User.Grade_Level

       #Check for blank entries in any of the columns - if any are found then log it and go back to the top of the loop, skipping this user line
       If (($UserFirstname -eq "") -Or ($UserLastname -eq "") -Or ($PSNumber -eq "") -Or ($Grade -eq "")){

           "[ERROR] Information missing.  Check source line $($i)." | Out-File $LogPath -Append
           Continue nextUser
       }

       #Remove special characters that don't play nice in AD from user names
       $UserFirstname = $UserFirstname.Replace(".","")
       $UserFirstname = $UserFirstname.Replace(" ","")
       $UserFirstname = $UserFirstname.Replace("'","")
       $UserFirstname = $UserFirstname.Replace("-","")

       $UserLastname = $UserLastname.Replace(".","")
       $UserLastname = $UserLastname.Replace(" ","")
       $UserLastname = $UserLastname.Replace("'","")
       $UserLastname = $UserLastname.Replace("-","")

       #Generate user's login name - syntax for our environment is first six characters of last name followed by last four digits of student number
       If ($UserLastname.Length -lt 6){
           $SAM = $UserLastname + $PSNumber.Substring($PSNumber.Length -4,4)
       }
       ElseIf($UserLastname.Length -ige 6){
           $SAM = $UserLastname.Substring(0,6) + $PSNumber.Substring($PSNumber.Length -4,4)
       }

       #Generate strings for other pieces of user information
       $Displayname = $UserFirstname + " " + $UserLastname
       $UPN = $SAM + "@" + $ADDomain
      
       #Make sure that grade is within proper bounds - if not, write to the log and continue back to the top of the loop skipping this user from further processing
       Switch ($Grade) {

           12 {$GradYear = $FiscalYear + 0}
           11 {$GradYear = $FiscalYear + 1}
           10 {$GradYear = $FiscalYear + 2}
           9 {$GradYear = $FiscalYear + 3}
           8 {$GradYear = $FiscalYear + 4}
           7 {$GradYear = $FiscalYear + 5}
           6 {$GradYear = $FiscalYear + 6}
           5 {$GradYear = $FiscalYear + 7}
           4 {$GradYear = $FiscalYear + 8}
           3 {$GradYear = $FiscalYear + 9}
           2 {$GradYear = $FiscalYear + 10}
           1 {$GradYear = $FiscalYear + 11}
           0 {$GradYear = $FiscalYear + 12}
           Default {"[ERROR] Grade not valid.  Check source line  $($i)." | Out-File $LogPath -Append
           Continue nextUser}

           }

       #Generate some more stuff and populate variables
       $HomeFolder =  $BaseHome + $GradYear + "\" + $SAM
       $OU = "ou=" + $GradYear + "," + $BaseOU
       $GroupName = "Students_" + $GradYear

       #Try block to check for existance of user - if this fails then log it and continue back to the top of the loop, skipping this user from further processing
       Try   {$UserExists = Get-ADUser -LDAPFilter "(sAMAccountName=$SAM)"}
       Catch {
               "[ERROR] Unabled to check for duplicate user $(SAM)  Source line  $($i)." | Out-File $LogPath -Append
               "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append
               "`t $($_.Exception.Message)" | Out-File $LogPath -Append
               Continue nextUser
       }

       #If user doesn't exist, create said user
       If(!$UserExists){
           
           #Try block to create user - if this fails then log it and continue back to the top of the loop, skipping this user from further processing
           Try{

               New-ADUser -Name $SAM -DisplayName $Displayname -SamAccountName $SAM -UserPrincipalName $UPN -GivenName $UserFirstname -Surname $UserLastname -HomePhone $PSNumber -Description $GradYear -AccountPassword (ConvertTo-SecureString $Password -AsPlainText -Force) -Enabled $true -ChangePasswordAtLogon $true -PasswordNeverExpires $false -Path $OU -HomeDirectory $HomeFolder -HomeDrive $HomeDrive -ErrorAction Stop

           }
           Catch{
               "[ERROR] User $($SAM) not created.  Source line  $($i)." | Out-File $LogPath -Append
               "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append
               "`t $($_.Exception.Message)" | Out-File $LogPath -Append
               Continue nextUser
           }

           #Count the number of users added for later use in the log
           $Global:UserCount = $Global:UserCount + 1
           
           "[sUCCESS] User $($SAM) created.  Source line  $($i)." | Out-File $LogPath -Append

           #Try block to add newly created user to the appropriate student graduation group - if this fails then log it and continue back to the top of the loop, skipping this user from further processing
           Try{Add-ADGroupMember -Identity $GroupName -Members $SAM -ErrorAction Stop}
           Catch{
               "[ERROR] User $($SAM) not added to group $($GroupName).  Source line  $($i)." | Out-File $LogPath -Append
               "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append
               "`t $($_.Exception.Message)" | Out-File $LogPath -Append
               Continue nextUser
           }

           "[sUCCESS] User $($SAM) added to group $($GroupName).  Source line  $($i)." | Out-File $LogPath -Append

           #Try block for creating user's home folder and setting permissions - if this fails then log it and continue back to the top of the loop, skipping this user from further processing
           Try{
               New-Item -ItemType "Directory"  -Path $HomeFolder -ErrorAction Stop
               $Acl = (Get-Item $HomeFolder).GetAccessControl('Access')
               $Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($SAM, "Modify",'ContainerInherit,ObjectInherit', 'None', 'Allow')
               $Acl.SetAccessRule($Ar)
               Set-Acl -path $HomeFolder -AclObject $Acl
               }
           Catch{
           "[ERROR] User $($SAM) home folder messed up.  Source line  $($i)." | Out-File $LogPath -Append
           "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append
           "`t $($_.Exception.Message)" | Out-File $LogPath -Append
           Continue nextUser
           }
           
           "[sUCCESS] User $($SAM) home folder created.  Source line  $($i)." | Out-File $LogPath -Append
       }
       Else{
           "[iNFO] User $($SAM) already exists.  Source line  $($i)." | Out-File $LogPath -Append
           Continue nextUser
       }
   }
   #Give a half second between creating users to let AD catch its tail
   Start-Sleep -Milliseconds 500
}

Addusers

#Write statistics to the end of the log
$TimeEnd = Get-Date
$ElapsedTime = $TimeEnd - $TimeStart
"" | Out-File $LogPath -Append
"Processing Finished on: $($TimeEnd)" | Out-File $LogPath -Append
"Total processing time:  $($ElapsedTime)"  | Out-File $LogPath -Append
"Users created:          $($UserCount)"  | Out-File $LogPath -Append

#Debug function
Function Debug {
   Write-Host "Username:    "  $SAM
   Write-Host "OU:          "  $OU
   Write-Host "Grad Year:   "  $GradYear
   Write-Host "Home Folder: "  $HomeFolder
   #Write-Host $UPN
   #Write-Host $GApps
   Write-Host
}

dude-install-4.0beta3.zip

Beginning to look at ways of solving this problem I saw that some admins had come up with scripts that detect whether or not the system is on the domain network, and if not it would revert Windows Update to look to Microsoft rather than the internal WSUS server. This would work for most, but I just don't use WSUS for delivering Windows security updates - I also use it to update Chrome, Flash, Adobe Reader and a few others using WSUS Package Publisher/ (auto update for said software is disabled in base image). The ability for remote users then to reach the internal WSUS server is pretty much a necessity then at this point unless I wanted to change my process (which I didn't).

Before setting this there needs to be some prerequisites:

• Your internal domain name doesn't have a made up TLD like .local or .corp
  
• You own your domain name on the outside
  
• You have a certificate authority
  
• A functioning WSUS install
  

The above isn't absolute and there are ways around them, but this is how I set it up on my network. And since this is going to be exposed on the outside, you need to do move forward with security in mind. We will be enabling SSL and locking down some sections of WSUS.

 @echo on

set KEY=HKLM
Set VALUE=Display1_DownScalingSupported


for /f  %%A in ('reg query %KEY% /v %VALUE% /s ^| findstr HKEY') do (
reg add %%A /v "Display1_DownScalingSupported" /t REG_DWORD /d 1 /f

The above will enable you to select 1024x768 on a system that only supports 1024x600. The aspect ratio will be off, but if you have applications that check for resolution requirements then this will get you past that. After the keys are changed the system needs to be rebooted.

This was successfully used on Dell Latitude 2100 and 2120 netbooks to get past the 1024x768 resolution requirement for the NWEA Locked Down Browser.

The code below is a sub from my logon script that deals with this issue. The setting the keeps Java from running said unsigned code is the security level and is stored in the deployment.propterties text file in each user's local profile. The default level is high and the line is not present in the config. Adding the line will force JRE into medium the next time it is launched. Since this is plucked out of my logon script you'll need a source for the username, but other than this it'll work as is for Vista/7. For 2k/XP you'll need to modify the path.

Sub TempFixes5

	Set objFSO = CreateObject("Scripting.FileSystemObject")

	Const ForReading = 1
	Const ForWriting = 2

	FoundIt = False

	strUserFilePath = "c:\Users\" & strUserName & "\AppData\LocalLow\Sun\Java\Deployment\deployment.properties"
	strSecurityMedium = "deployment.security.level=MEDIUM"

	'Check to see if Java is installed, if not, then exit sub
	If objFSO.FileExists(strUserFilePath) Then
		'Do Nothing
	Else
		Exit Sub
	End If

	'Check to see if Java security is set to medium, if so, then exit sub
	FoundIt = (InStr(1,objFSO.OpenTextFile(strUserFilePath,1,true,-2).ReadAll,strSecurityMedium,1) <> 0)
	If FoundIt = True Then
		Exit Sub
	Else
		'Do Nothing
	End If

	'Open Java configuration files for reading
	Set objUserFile = objFSO.OpenTextFile(strUserFilePath, ForReading)

	'Copy file contents into string
	strUserFile = objUserFile.ReadAll

	'Add medium security line to config
	strNewUserFile = strUserFile & Chr(13) & strSecurityMedium
	
	'Open Java configuration files for writing
	Set objUserFile = objFSO.OpenTextFile(strUserFilePath, ForWriting)

	'Write the files
	objUserFile.WriteLine strNewUserFile

	'Removes Java configuration file from memory
	objUserFile.Close

	'House cleaning
	Set objFSO = Nothing


End Sub

Now, I just figured I could write an ADM template and do this through GPO, but the values you need to changed are stored under a key named according to the version of Java installed. So writing a template would only be good for the version you wrote it for. Scripting was next viable alternative and this one will handle any version of Java installed on the system.

Const HKEY_CLASSES_ROOT = &H80000000
Const HKEY_CURRENT_USER = &H80000001
Const HKEY_LOCAL_MACHINE = &H80000002
Const HKEY_USERS = &H80000003
Const HKEY_CURRENT_CONFIG = &H80000005

strComputer = "."

Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colOS = objWMIService.ExecQuery("Select * from Win32_OperatingSystem")

For Each OS in colOS
strOSArch = OS.OSArchitecture
Next

If InStr(strOSArch, "64") Then
WriteKeys HKEY_LOCAL_MACHINE,"Software\Wow6432Node\JavaSoft\Java Plug-in\",strComputer
WriteKeys HKEY_LOCAL_MACHINE,"Software\JavaSoft\Java Plug-in\",strComputer
Else
WriteKeys HKEY_LOCAL_MACHINE,"Software\JavaSoft\Java Plug-in\",strComputer
End if



Function WriteKeys(HKEY_LOCAL_MACHINE, strKeyPath, strComputer)

Set objReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
objReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys

For Each SubKey in arrSubKeys
	objReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath & SubKey, "UseJava2IExplorer", 0
	objReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath & SubKey, "UseNewJavaPlugin", 0
Next

End Function

Set it up as a startup script in GPO and you should be all set. I hope this helps...

The On Error Resume Next line in the email function is to prevent the script from hanging if there is an error with the mail server. If that were to happen without it there instances of wscript.exe would keep spawning and never exit each time the scheduled task would fire.

Call Main

Sub Main
'MAC to find
strFindMAC = "xxxxxxxxxxxx"

Set objFSO = CreateObject("Scripting.FileSystemObject")

Const ForReading = 1
Const ForWriting = 1

'Determine log name based on day of week
strLogPath = "c:\windows\system32\dhcp\"
strWeekDay = weekdayname(weekday(date))
strFullLogPath = strLogPath & "DhcpSrvLog-" & Left(strWeekday,3) & ".log"

'Check to see if log exists
If objFSO.FileExists(strFullLogPath) Then
	'Do Nothing
Else
	WScript.Quit
End If

'Open DHCP log file for reading
Set objDHCPLogFile = objFSO.OpenTextFile(strFullLogPath, ForReading)
	
'Copy file contents into string
strDHCPLogFile = objDHCPLogFile.ReadAll
objDHCPLogFile.Close

'Break into individual lines
arrLines = Split(strDHCPLogFile,vbCrLf)

'Loop through the array and build another array of lines that contain the MAC
For Each strLine in arrLines
	If InStr(strLine, strFindMAC) Then
		intCount = intCount + 1
		ReDim Preserve arrFound(intCount)
		arrFound(intCount) = strLine
	End If
Next

'If no matches are found then abort the script
If intCount = 0 Then
	WScript.Quit
End If

'Get the last line of matching MAC log entries
strLastLine = arrFound(intCount)

'Split the log entry on commas and dump to array
arrLastLine = Split(strLastLine, Chr(44))

'Format message
strDate = arrLastLine(1)
strTime = arrLastLine(2)
strAction = arrLastLine(3)
strIPAddress = arrLastLine(4)
strHostName = arrLastLine(5)

strMessage = "MAC address " & strFindMAC & " has checked into the DHCP server on " & strDate & " at " & strTime & "." & Chr(13) _
			 & strIPAddress & " was " & strAction & "ed" & " to hostname " & strHostName & "."


'This next block of code will read/write a log for the script itself.  This will prevent the script from sending multiple
'emails for the same DHCP log entry.

'Check to see if script log exists
If objFSO.FileExists("DHCPScriptLog.txt") Then
		'Read log and get the time
		Set objScriptLogFile = objFSO.OpenTextFile("DHCPScriptLog.txt", ForReading)
		strLastTime = objScriptLogFile.ReadAll
		objScriptLogFile.Close
		
		'If the last time matches the time pulled from the DHCP log then quit the script
		If strLastTime = strTime Then
			WScript.Quit
		End If
End If
	
'Write the log file
Set objScriptLogFile = objFSO.CreateTextFile("DHCPScriptLog.txt", ForWriting)
objScriptLogFile.Write strTime
objScriptLogFile.Close

'Call the email function to send the message
Email(strMessage)

End Sub

Function Email(strMessage)

On Error Resume Next

Set objMessage = CreateObject("CDO.Message")
objMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2 
objMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "mail.domain.com"
objMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25 
objMessage.Configuration.Fields.Update

objMessage.Subject = "DHCP Log Script"
objMessage.From = "DHCPScript@domain.com"
objMessage.To = "you@domain.com"
objMessage.TextBody = strMessage

objMessage.Send

End Function

There are two ways to go about doing it: adding a custom HTTP header, or rewriting the URL on the fly. The cleanest way is using the custom HTTP header, but as of Squid 3.1 it doesn't natively support adding custom headers. You can only change existing ones. To do this you need to setup an ICAP server and it seemed a bit overkill for this simple task, so I elected to go for the URL rewriting. The basic gist of this is that your school's filter ID needs to be appended onto the end of every URL. This is accomplished by means of either a perl or PHP script that Squid calls out to do the rewrite. Seeing as how I'm a VB monkey and couldn't wrap my head around Perl in the time allotted for this task so I cheated.

Following Youtube's guidelines I wrote the script in VB to give me the desired output and used a converter to go to Perl. It needed some tweaks, but it seems to work. Just replace the filter ID with your own in the script and you should be set.

#!/usr/bin/perl
$|=1;

$strSchoolID = 'edufilter=xxxxxxxxxxxxxxxxxx';

while (<>) {
@X = split;
$strURL = $X[0];

if ((index($strURL, 'youtube.com') + 1)) {
   if ((index($strURL, 'edufilter') + 1)) {
       print $strURL, "\n";
   }
   elsif ((index($strURL, '.css') + 1)) {
       print $strURL, "\n";
   }
   elsif ((index($strURL, '.gif') + 1)) {
       print $strURL, "\n";
   }
   elsif ((index($strURL, '.png') + 1)) {
       print $strURL, "\n";
   }
   elsif ((index($strURL, 'gif') + 1)) {
       print $strURL, "\n";
   }
   elsif ((index($strURL, '.js') + 1)) {
       print $strURL, "\n";
   }
   elsif ((index($strURL, '.xml') + 1)) {
       print $strURL, "\n";
   }
   elsif ((index($strURL, '?') + 1)) {
       $strURL = $strURL . '&' . $strSchoolID;
       print "$strURL\n";
   }
   else {
       $strURL = $strURL . '?' . $strSchoolID;
       print "$strURL\n";
   }
}
else {
   print "$strURL\n";
}
}

The Squid configuration should look something like this:

url_rewrite_program /etc/squid3/helper/urlrewrite3.pl
redirect_rewrites_host_header on
redirect_children 30
acl RedirectYoutube dstdomain .youtube.com
redirector_access allow RedirectYoutube
redirector_access deny all

By default Squid will pass every outgoing connection through the script, so I set an ACL to only pass connections going to Youtube. And don't forget to set execute permission on the script file.

I haven't pushed this out to an entire building yet, but it works with my test group so far. If you find any bugs with this drop me a line. I hope this helps!

The sample script below I left in debug mode. You can run as is and it'll bring up the collected information in message boxes. In addition, the sub that pulls group membership calls out to a function that will in turn call back on itself for every nested group it finds. This will add nested group membership to the final results. I hope this helps...

Edit: The strExpectedPrtName string is derived from the computer name. Most machines in the district are named by building, room, and then number. For instance, a teacher computer in room 12 in building A would be: BDA-RM12-TW01. Classroom printers are named the same way, just minus the workstation designation, so it would be: BDA-RM12. So the at the end of the printer sub it'll attempt to add a printer with the name it derived from the classroom workstation name. If it doesn't exist, it'll simply skip over it an finish normally due to the error handling.

Dim strUserName
Dim strUserPath
Dim strADSite
Dim strCompName
Dim strCompPath
Dim strGroups
Dim strUserGroups
Dim strCompGroups

Call InitializeScript()
Call GetGroupMemberships
Call Debug
'Call Printers


Sub InitializeScript()
Set objNetwork = CreateObject("WScript.Network")
Set objADSysInfo = CreateObject("ADSystemInfo")

strUserName = objNetwork.UserName
strUserPath = "LDAP://" & objADSysInfo.UserName
strADSite =  objADSysInfo.SiteName
strCompName = objNetwork.ComputerName
strCompPath = "LDAP://" & objADSysInfo.ComputerName	    
End Sub

Sub Debug
Msgbox "Username: " & strUserName
Msgbox "User LDAP Path: " & strUserPath
Msgbox "AD Site: " & strADSite
Msgbox "Computer Name: " & strCompName
Msgbox "LDAP Computer Path: " & strCompPath
Msgbox "User is a member of the following groups: " & strUserGroups
MsgBox "Computer is a member of the following groups:" & strCompGroups
End Sub

Sub GetGroupMemberships
Set objUser = GetObject(strUserPath)
   Set colUserGroups = objUser.Groups

Set objComp = GetObject(strCompPath)
   Set colCompGroups = objComp.Groups

   For Each objUserGroup in colUserGroups
       strGroups = strGroups & objUserGroup.CN & "|"
       GetNested(objUserGroup)
   Next
	
	strUserGroups = strGroups
	strGroups = ""
	
For Each objCompGroup in colCompGroups
       strGroups = strGroups & objCompGroup.CN & "|"
	GetNested(objCompGroup)
   Next

	strCompGroups = strGroups
	strGroups = ""
	
End Sub

Function GetNested(objGroup)
   On Error Resume Next

   colMembers = objGroup.GetEx("memberOf")

   For Each strMember in colMembers
       strPath = "LDAP://" & strMember
       Set objNestedGroup = GetObject(strPath)
       strGroups = strGroups & objNestedGroup.CN & "|"
       GetNested(objNestedGroup)
   Next	
End Function	

Sub Printers
Set objNetwork = CreateObject("WScript.Network")

If Len(strCompName) < 5 Then
	strExpectedPrtName = ""
Else
	Position = InStr(5, StrCompName, "-") - 1
	If Position < 0 Then Position = 5
	strExpectedPrtName = LCase(Left(strCompName, Position))
	intCompNumber = Right(strCompName,2)
End If

If InStr(LCase(strCompPath), "BuildingA") Then

	strPrintServer = "\\BldA-PrtSrv01\"
	objNetwork.AddWindowsPrinterConnection strPrintServer & "BldA-Copier"
	objNetwork.SetDefaultPrinter strPrintServer & "BldA-Copier"
	
ElseIf InStr(LCase(strCompPath), "BuildingB") Then

	strPrintServer = "\\BldB-PrtSrv01\"

	objNetwork.AddWindowsPrinterConnection strPrintServer & "BldB-Copier"

	If InStr(LCase(strUserGroups), "staff") Then
		objNetwork.AddWindowsPrinterConnection strPrintServer & "BldB-OfficeCopier"
		objNetwork.AddWindowsPrinterConnection strPrintServer & "BldB-MediaCopy"
	End If

	If InStr(LCase(strUserGroups), "student") Then
		objNetwork.AddWindowsPrinterConnection strPrintServer & "BldB-LibPrt01"
		objNetwork.AddWindowsPrinterConnection strPrintServer & "BldB-LibPrt02"
	End If
End If

On Error Resume Next

objNetwork.AddWindowsPrinterConnection strPrintServer & strExpectedPrtName

If Err.Number <> 0 Then
	'Nothing to see here folks, move along.
	Exit Sub
Else
	objNetwork.SetDefaultPrinter strPrintServer & strExpectedPrtName
End If

End Sub

-Building 01
  -Staff Member A
    +Drop Off
    +Pickup
 +Staff Member B
 +Staff Member C
 +Staff Member D
+Building 02

Every staff member of a particular building (or group) will have a folder on a share named by their last name, and under said staff name will be two addition folders. One for students to pickup assignments, and the other for them to drop off, or turn finished assignments in. To keep the folder structure intact and to keep students from sharing their assignments with others, file level permissions are set. This is where this gets a bit goofy...

For this to work correctly, you're going to need two security groups: one for building level staff, and a second for the students (ours are done by grade level). At the root of the building folder both security groups have read and execute to allow them to traverse the folder structure. At the pickup level, the specific teacher will have Read/Write on sub folders and files only so they can manage files without being able to delete the pickup folder itself. The drop off folder though is a bit more intricate. We can't allow students read and list to this or they'll be able open other student's completed assignments, and since the students group has read/execute at the building level, we'll need to block inheritance on this folder. Once inheritance is blocked, the students group is given create files/write data only. Teachers are given the same permissions as on the pickup folder: RW on sub folders and files only. Now all the students can do is blindly save files to this folder.

That's pretty much the gist of drop off and pickup folders, but creating these by hand would be an enormous time sink, so I wrote a VB script that will handle bulk creation. This script will pull teacher names from an OU in Active Directly, and will pass off permission settings to icacls. All you have to do is create a fresh building folder on a share somewhere, edit the strings at the top of the script and let it go.

Cheers!

strLDAPPath = "LDAP://OU=BuildingA,OU=Staff,OU=Organization,DC=sampledomain,DC=com"
strUNCPath = "\\server\Dropbox\BuildingA\"
strTeacherGroup = "BuildingA_Staff"
strStudentGroup = "BuildingA_Students"

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objShell = WScript.CreateObject("WScript.Shell")    
Set objContainer = GetObject(strLDAPPath)
objContainer.Filter = Array("user")

objRun = objShell.Run("icacls" & Chr(32) & strUNCPath & Chr(32) & "/grant" & Chr(32) & strTeacherGroup & ":(OI)(CI)RX")
WScript.Sleep 100
objRun = objShell.Run("icacls" & Chr(32) & strUNCPath & Chr(32) & "/grant" & Chr(32) & strStudentGroup & ":(OI)(CI)RX")

For Each User in objContainer

strUser = User.SAMAccountName
strFullPath = strUNCPath & strUser

On Error Resume Next
Set objFolder = objFSO.CreateFolder(strFullPath)

If Err.Number <> 0 Then
	strLog = strLog & strUser & Chr(58) & Chr(32) & Err.Description & Chr(13)
Else
	Set objFolder = objFSO.CreateFolder(strFullPath & "\Pickup")
	Set objFolder = objFSO.CreateFolder(strFullPath & "\DropOff")
		
	objRun = objShell.Run("icacls" & Chr(32) & strFullPath & "\DropOff" & Chr(32) & "/inheritance:d")
	wscript.sleep 400
	objRun = objShell.Run("icacls" & Chr(32) & strFullPath & "\DropOff" & Chr(32) & "/remove:g" & Chr(32) & strStudentGroup)
	wscript.sleep 400
	objRun = objShell.Run("icacls" & Chr(32) & strFullPath & "\DropOff" & Chr(32) & "/grant" & Chr(32) & strStudentGroup & ":(OI)(CI)(WD)")
	wscript.sleep 100
	objRun = objShell.Run("icacls" & Chr(32) & strFullPath & "\Pickup" & Chr(32) & "/grant" & Chr(32) & strUser & ":(OI)(CI)(WD,AD,DC,X,RA,RD,REA)")
	wscript.sleep 400
	objRun = objShell.Run("icacls" & Chr(32) & strFullPath & "\DropOff" & Chr(32) & "/grant" & Chr(32) & strUser & ":(OI)(CI)(WD,AD,DC,X,RA,RD,REA)")
	
End If

WScript.Sleep 100

Next

'msgbox strLog

You'll need the deviceID for the card reader in question and this can be obtained through device manager. If all the readers you're tying to disable are the same make/model, then this will be same for all of them. Copy the entire string.

Now the syntax to disable said card reader will look like this. Just replace the deviceID shown with your own. If the need arises, this utility also supports wild cards.

devconx64 -disable "USB\VID_0644&PID_0200&REV_0408"

This can be pushed out a number of ways; I wound up going ahead and creating a GPO and setting it up as a startup script. Startup scripts run with machine credentials and will have the permissions necessary to disable hardware. If you choose to incorporate this solution into a login script, then this will run with the user's credentials. So be sure the user logging in has local admin privileges.

One last note, the download for Devcon from Microsoft includes x32 and an ia64 version. Obviously ia64 is for the Itanium architecture and won't do any good for the majority of us out there. There is an x64 build, but it is only available through a resource CD or something of the like and not as a standalone download. So I've attached a zip to this post containing both the x32 and x64 versions for convenience.

I hope this helps.

DevCon.zip