EduGeek Classroom Control Toolbar (ECC) First Look

[witch]

It looks very useful - but can I make a request for a grammatical change?

 

Your sentence: Enter the name of the user....etc is not very clear

Would it be better as:

Enter the name of the user whose password is to be changed

 

I know, I know, I am SO picky

[ICTNUT]

It looks very useful - but can I make a request for a grammatical change?

 

Your sentence: Enter the name of the user....etc is not very clear

Would it be better as:

Enter the name of the user whose password is to be changed

 

I know, I know, I am SO picky

 

 

Done.

[Guest monkeyx]

Are you planning to make open source?

 

I am working on a very similar tool to this which is almost ready for release. Just need to document!!!! It has remote screen shot, and quite a few other features without needing client. My client integrates with AD and/or netbios to show live view of logged in users etc.

 

If you are able to make code open source it would be useful to share ideas and code?

 

Let me know what you think.

[ICTNUT]

This is an edugeek application, it is being developed on behalf of EduGeek, and yes the idea would be to release it as open source.

 

When the open source version would be released I don't know but like most of the apps that are being developed for edugeek (by us OP Software) are being done for free and will be provided for free for all to use.

 

Ultimately it will be down to the guys running EduGeek to decide when to open source any of the apps, ideally once it is stable.

[Guest monkeyx]

This is an edugeek application, it is being developed on behalf of EduGeek, and yes the idea would be to release it as open source.

 

When the open source version would be released I don't know but like most of the apps that are being developed for edugeek (by us OP Software) are being done for free and will be provided for free for all to use.

 

Ultimately it will be down to the guys running EduGeek to decide when to open source any of the apps, ideally once it is stable.

 

Thanks for the reply but not sure I understand what you mean by "Edugeek project". To me open source is collaborative development through sharing source code and ideas.

 

Anyhow just thought you may be interested in collaborating, but I want to keep my project in open source domain, so I guess we will not be

 

Good luck with the project

[ICTNUT]

Thanks for the reply but not sure I understand what you mean by "Edugeek project".

 

The term "EduGeek Project" means I have been asked by the EduGeek team if I could do this so I deem it to be an EduGeek Project.

 

To me open source is collaborative development through sharing source code and ideas.

 

I totally agree.

 

Anyhow just thought you may be interested in collaborating, but I want to keep my project in open source domain, so I guess we will not be.

 

As I stated before I am not the one to make this decision however the ethos surrounding Edugeek is to keep applications like this Open Source and freely available for all to use so with this in mind I would say that it is very likely that the source will be released I just cannot say when. So we may be able to collaborate yet

Edited May 31, 2009 by ICTNUT
typo

[Ric_]

@monkeyx: The reason that the EduGeek apps that are being developed by ICTNUT are closed source initally, is to get a stable product that EduGeek members can use as quck as possible.

 

Once the apps are stable and do thing that they are meant to, the source can be opened for new features to be added. We just want to make sure that there are no hold-ups.

[ICTNUT]

OK, after looking into AD delegation for staff in order to allow them to do:

 

Password changes

Membership changes - for banning internet access

Acount Lockout reset

 

These are all easy to delegate within Active Directory with compromising security.

 

With this in mind I will work towards adding Membership changes and Account lockout reset to the toolbar so staff can do this also.

Edited June 1, 2009 by ICTNUT
typo

[alan-d]

A monday morning question! How does this work with laptops that are used in more than one location, or in our case, any classroom?

 

What happens if 2 banks of laptops are used in a classroom which won't necessarily be the classroom they are normally located?

[ICTNUT]

A monday morning question! How does this work with laptops that are used in more than one location, or in our case, any classroom?

 

What happens if 2 banks of laptops are used in a classroom which won't necessarily be the classroom they are normally located?

 

As long as you have the laptop list as a selectable "room" then the changes will be applied.

 

Remember the text files you create simply has the PC/Laptop name in it with one per line and selecting these will push the changes out.

 

The word "room" can be seen in a virtual sense in this case.

[JJonas]

Looks good. When can we get our hands on it?

[ICTNUT]

Looks good. When can we get our hands on it?

 

Hoping to get a release out by the end of the week but I also have a release of the helpdesk to get out as well so it maybe the week after.

[tom_newton]

Sounds good but will it need a proxy restart to take effect like the current room filtering does?

 

That is officially a bug, which will be rectified in this change, yes.

[PiqueABoo]

 

It's the text files full of IP addresses that always bothers me about things like this.

 

Most domains use DHCP and IP addresses obviously can/do change = maintenance pain. Programatically pulling lists of comps+OU paths out of AD isn't hard, nor is subsequently getting IPs (although laptops can have the added complexity wired + wireless). Worst case you might need a file to map a user friendly display name to some typically static but not pretty/comprehensible LDAP path.

 

So why the text files everyone? Are we betting on typical OU structures being such a mess that they're the only pragmatic option (and if so should continuing mess be encouraged)?

 

[Ric_]

@PiqueABoo: I understand it that DNS names can be used for the config rather than IPs. The text file is simply to limit the clients that will be displayed.

[contink]

A monday morning question! How does this work with laptops that are used in more than one location, or in our case, any classroom?

 

What happens if 2 banks of laptops are used in a classroom which won't necessarily be the classroom they are normally located?

 

Perhaps a rethink on the term "room"... computer block, group...?

 

If you can put a tooltip in for that so it explains what a "room" is though I'm sure that would help... Just thinking teacher style for a minute

[ICTNUT]

 

It's the text files full of IP addresses that always bothers me about things like this.

 

Most domains use DHCP and IP addresses obviously can/do change = maintenance pain. Programatically pulling lists of comps+OU paths out of AD isn't hard, nor is subsequently getting IPs (although laptops can have the added complexity wired + wireless). Worst case you might need a file to map a user friendly display name to some typically static but not pretty/comprehensible LDAP path.

 

So why the text files everyone? Are we betting on typical OU structures being such a mess that they're the only pragmatic option (and if so should continuing mess be encouraged)?

 

 

You don't have to put IP addresses in the text file you can use NETBIOS and FQDNs if you wish

 

There are a few reasons for using text files:

 

1 - You may not want all PCs in an OU

2 - Pulling information from AD adds another 2 or 3 steps to the whole process and is problematic in that we would need to filter off all the stuff in AD that you don't want anyone to get access to i.e. Servers OU

3 - Ease of deployment - The domain admin can control what rooms are listed.

4 - AD/OU setups are different in each school (naming conventions) and may not be clearly obvious to the teacher what the OU is.

 

I am not saying that it cannot be done as it interfaces with AD to dothe whole Password Reset / Account Lockout / Group Membership thing already I just think it is far easier this way and if anything much more flexable from an admin point of view.

Edited June 2, 2009 by ICTNUT

[ICTNUT]

Perhaps a rethink on the term "room"... computer block, group...?

 

If you can put a tooltip in for that so it explains what a "room" is though I'm sure that would help... Just thinking teacher style for a minute

 

Hmm Yes you could be on to something there !

[contink]

Hmm Yes you could be on to something there !

 

It's just nit picking but as I'm sure you know the whole "intuitive" thing is a whole other kettle of kippers when it comes to some users. The more 1d10T level coverage the less* some poor tech is going to have to explain it...

 

*I did say "less"... No explanation required is nirvana and you should really wake up now

[PiqueABoo]

General point for any project: The best time to ask for comments is when you've just made the list of requirements and proposed a technical architecture/solution to satisfy them. It's a lot harder to say things I'd have happily stated earlier when something is mostly finished - makes me feel mean/ungrateful, and no one who has just done a load of work ever wants to revisit square one do they?

 

You don't have to put IP addresses in the text file you can use NETBIOS and FQDNs if you wish

 

Apologies I missed that bit.

 

There are a few reasons for using text files

 

Not persuaded. My starting position for any domain management app is that AD is where you do everything you possibly can because it is the native central, queryable, nicely replicated domain management database after all. Subject to the app (not for this) I'd also go for ADUC context menu extensions. Might be more short-term work on an app, but it's almost always less work afterwards.

 

Some random comments:

 

- If people's computer OU's do not reflect physical site topology then it's sad, but..

 

- There is a computer object attribute you can readily find and edit in ADUC specifically intended to hold a location and that can be entered in a user friendly format.

 

- Filtering AD objects by OU or some attribute is a pretty basic AD concept (both in ADUC and any code talking to AD). You control the vertical so if Fred shouldn't see X then don't show it. See also: Security through obscurity.

 

- Hands up everyone if you have credible evidence of your proxy settings being reapplied during a policy refresh in the absence of any changes to your GPOs.

 

- Haven't thought this through, but is the real requirement to block the Internet (which might cause minor collateral damage when done via proxy fiddling e.g. maybe AV uses the IE proxy to get updates), or stop kids running apps they're not supposed to at any given point in time? Would it be more useful as something that stopped IE, Firefox and any other apps? Might write it off if I think about it some more, but I'd have considered a small appinitDLL to kill and sabotage subsequent startup of (temporarily) verboten apps.

 

- ToolStrip.GripStyle=Hidden?

 

 

All the above said, I don't think it really matters much for this app and I agree that less is usually more, but I feel better now

 

Question: I'm not clear about where the app that actually disables the net and shuts down a PC runs. Remote APIs, WMI etc., code running permanently on each PC (if so what's the rough memory footprint) or both?

[ICTNUT]

@PiqueABoo: I'll cover your points one by one, and I do apreciate them...

 

My starting position for any domain management app is that AD is where you do everything you possibly can because it is the native central, queryable, nicely replicated domain management database after all.

 

Yes I agree however the more intergration you have with AD then "potentially" the more delegation you have to give to those using the toolbar, now talking from exprerience I have come across sites where this is limited technical expertise due to many varying reasons and having to do mass delegation is not an option.

 

Neither is creating complex ADUC MMC's to do the job. The whole idea is simple to use, simply to deploy, and lightweight.

 

If people's computer OU's do not reflect physical site topology then it's sad, but..

 

Yes very sad but very true, i've seen it.

 

There is a computer object attribute you can readily find and edit in ADUC specifically intended to hold a location and that can be entered in a user friendly format.

 

Again alot sites don't use this. Scenario: I release a toolbar to help users and technical staff make life easier but before you can use theres a fair bit of AD admin you need to do first, people just won't use the toolbar and alot of time, effort, and goodwill will be wasted.

 

Hands up everyone if you have credible evidence of your proxy settings being reapplied during a policy refresh in the absence of any changes to your GPOs.

 

Yes a good point but they are definately reapplied at logon, or have I miss understood the question?

 

Haven't thought this through, but is the real requirement to block the Internet (which might cause minor collateral damage when done via proxy fiddling e.g. maybe AV uses the IE proxy to get updates), or stop kids running apps they're not supposed to at any given point in time? Would it be more useful as something that stopped IE, Firefox and any other apps? Might write it off if I think about it some more, but I'd have considered a small appinitDLL to kill and sabotage subsequent startup of (temporarily) verboten apps.

 

Again the idea was to have a lightweight clientless application.

 

Question: I'm not clear about where the app that actually disables the net and shuts down a PC runs. Remote APIs, WMI etc., code running permanently on each PC (if so what's the rough memory footprint) or both?

 

The application would normally be installed on the teacher PC in a classroom or on admin (IT Support) PCs. The calls are based on classes built into the .Net framework which opens up alot more remote management and connectivity than before (non .Net languages) and the maximum memory footprint we have seen in testing when running shutdown commands on 25 virtual PCs was 4.5Mb and when sitting idle it uses around 1.1Mb

 

Hope this answers some of the points you raised.

Edited June 2, 2009 by ICTNUT
typo

[PiqueABoo]

the more intergration you have with AD then "potentially" the more delegation you have to give to those using the toolbar

 

AD is a directory, thus user and computer accounts get to look up (read) most of the stuff we care about by default. In this case I was basically arguing for the 'contents' of rooms to be dynamically read from AD.

 

Neither is creating complex ADUC MMC's to do the job

 

Sure, that's not appropriate in this case ( ADUC context menus = No, above).

 

Again alot sites don't use this (AD Location - Ed.). Scenario: I release a toolbar to help users and technical staff make life easier but before you can use theres a fair bit of AD admin you need to do first, people just won't use the toolbar and alot of time, effort, and goodwill will be wasted.

 

Work creating entries in application specific text files and work filling in ADUC attributes are both work of a roughly similar magnitude. But the latter data is in a better place for any future scripts/apps that care about a room/location.

 

I don't doubt the prospect of having to do anything in ADUC will be a show-stopper for some folk, but people like that are not why I pay my taxes and the sooner BSF or some equivalent lands on them the better. Seriously. In my experience, which is fairly broad, internet blocking is overwhelmingly Secondary territory and if people looking after 500+ desktop vanilla domains aren't comfortable with ADUC they definitely shouldn't be looking after them.

 

Yes a good point but they are definately reapplied at logon

 

Not for me. This may well depend on mandatory vs. roaming profiles etc. and there are always special cases, but my experience with the defaults for GPO processing says that once a set of GPOs has been applied to a user profile their policies will not be applied again until the version number of one or more of those GPOs changes.

 

IOW if I'm right and you block via the proxy config I think you only need to worry about the effect of systems which push proxy config out through policy and have "Process even if the Group Policy objects have not changed..", or systems where policies are changed very frequently.

 

the maximum memory footprint we have seen in testing when running shutdown commands on 25 virtual PCs was 4.5Mb

 

Nothing then.. not that I or anyone else will care given that there is no permanent footprint on all the target boxes.

 

Another question: What happens when a random handful of boxes in a defined room are unreachable when you attempt to do X to them all i.e. how are you working around RPC time-outs? Preliminary pings or something? Absorbing the time-outs with multi-threading?

[ICTNUT]

Another question: What happens when a random handful of boxes in a defined room are unreachable when you attempt to do X to them all i.e. how are you working around RPC time-outs? Preliminary pings or something? Absorbing the time-outs with multi-threading?

 

Anything to do with more than one action on more than one item uses a multi threaded approach.

 

In the case of anything to do with the target PCs a scout ping is sent out if a response is recieved then the action is performed on the target PC, if no response is recieved then a boolean marker is placed against that PC and a warning image is shown next to its name in order to identify a problem.

[mossj]

When is this being released out of interest? could of done with it yesterday....