HCC

Hi, Thanks for the suggestions, How do I make procmon run remotely during the logon, do I have to use psexec? If it is ieunit4.exe, is there any thing that can be done about it, other than to change the drives to SSD? To answer previous questions; the roaming profile is 1.5Mb and there are no file screens on the server.

Hi all, I finally found a bit of time to use process monitor to find this key. For anyone else looking to make the keyboard appear on desktop apps (if there is no physical keyboard) its: The key to prevent the question - do you want to switch to tablet mode when removing the physical keyboard is:

Hi, I am trying to speed up the logon for students on our Windows 7 PCs which currently a little less than a minute. I've turned on the 'highly detailed status messages' and can see that for 40 seconds or so the logon is stuck on 'preparing windows'. If I press ctrl+alt+del at this point then cancel. I can see a black screen with the small 'Preparing your desktop:Windows Desktop Update' box in the top left. I can't find any more info from the logs as to what's being done at this point that takes so long. We use mandatory profiles, and are redirecting folders to a 2008 R2 server with dfs. If I deny apply the group policy I use to set folder redirection and a few other user settings, this preparing stage only takes 5 or so seconds. Has anyone else managed to solve a similar logon speed issue, with a similar set up?

So Writeback to AD as in they can change their password on the 365 logon page?

Hi, I recently upgraded our office 365 dirsync to the Azure AD connect program, which was surprisingly easy for a Microsoft piece of software. At the end of the wizard and in the readme there is a reference to running the powershell command Initialize-ADSyncDomainJoinedComputerSync to make windows 10 computers sync with Azure. Has anyone done this? Is this something I should be doing? I was under the impression that a windows 10 computer could only be domain managed or azure managed. I've chosen domain because of group policy, but this option does intrigue me....

Does anyone know the reg key for setting the onscreen keyboard option "automatically show the touch keyboard in windowed apps when there is no keyboard attached" The default option in local profiles is for it to be off. I couldn't find a group policy option for it, and since mandatory profiles don't work in 10 I can't set it that way. Thanks,

Hi, On a blog post back in May Microsoft alluded to the idea that you can add link Windows 10 to Office 365 and get single sign on: How do you achieve this though? This hints that it can't be done until Server 2016, and a new System Center are released Come on Microsoft - How is Windows 10 now enterprise ready, when you haven't released the infrastructure software needed... Anyone had any success just using azure login? In the Feed#2 on page 22 it says that a Primary have done it this way. I'm just thinking that without group policy it's asking for trouble, on shared devices in a secondary like ours.

Hi, I migrated our 2003 Certificate Server to a new Server 2012R2 server. By transferring the config from one to the other as per Microsoft documentation. This has appeared to work fine, the replacement server has the same name and root certificate and can issue out certificates etc. The problem is that the RADIUS wireless and some other services we use the cert server for, now have a trust anchor problem. Unlike when we had the 2003 server, you have to agree to connect to a security warning message. If you click connect on the prompt everything works as it did before, but I would like to solve this problem as it confuses teachers. The error message is: I checked the certificates mmc on computers and the root CA certificate is still in Trusted Root Certificate and intermediate certificate authorities Any idea's on how to fix?

Hi all, The school is running a drama production this summer, and would like to set up a video wall of 8 monitors for background scenery changes. We have the screens and the vesa mounts, but that's just the tip of the iceberg. Does anyone know of a low cost vga splitter that breaks a single VGA source image down into 8 vga channels, making one big image? (not lots of duplicates) I'm thinking a projector would be a better solution, but their set design doesn't allow for this. Regards,

The lightspeed agent works by sending AD group information to the lightspeed server. So it works great on Domain computers when deployed via group policy msi. Not so well with workgroup computers or tablets. You could set them to be static ip addresses, and then add the ip exceptions to web filter, authentication, exceptions. The problem is without authentication it will default access to the tier policy level and won't show any user details in the logs.

OK, so I looked into the policy and I am using PEAP and MSChapv2 and only computer auth. As per Authentication may not succeed when you use PEAP-MS-CHAP-v2 as the authentication method for an 802.1X connection in Windows Vista, Windows XP, Windows Server 2003, and Windows 2000 looks like the computer password expiry is causing the problem. I can't change to user & comp security as it would allow any student access. Interesting that Windows 7 isn't listed in the support article as I've seen it on windows 7 as well. I think I'm going to have to change to EAP-TLS, but I'm going to put that off until I upgrade the 2003 RADIUS server and CA to 2012, and have to set it all up again anyway.

eh? I am using computer auto-enrolment, in group policy with a CA.

Thanks for your replies not sure where this is set - I'm using the Windows Server RADIUS Server On some, but I've removed the horrid proset rubbish. Others are Dell I have tried leaving them for 1/2 an hour but they still don't connect, all have 'wait for network' on group policy set. If I set up a temp SSID with just a WPK-PSK password it works OK, but I don't really want to have to change all the settings. RADIUS should make it more secure. Connecting a cable then logging on, then removing the cable still leaves the fault. It has to have the cable in as windows loads up.

Hi, For years we have been experiencing a wireless problem on student wireless laptops, that would be really useful to resolve: in XP 'domain not available' and 7 "no logon servers available" at logon screen with wireless on. It can be fixed by connecting a network cable and restarting the laptop, then disconnecting the cable at the logon screen. Wireless will then work as expected. Student Laptops that are used regularly, don't have this problem. Here is what I think is happening - Laptops are not being used within 30 days, the computer password expires in AD, they go to blow the dust off and use them and the radius computer auth fails because the password has expired. The computer can't update the password because its not connected to the network: hence the chicken & egg. Has anyone else experienced this? Any ideas to resolve? Thanks,

In case anyone else gets this in future: I managed to solve this in the end by backing up the files, and the all important Outlook NK2 file, then deleted the profile. Then it worked perfectly in a new profile, and I restored the 'work'.

Hi, I have a laptop which won't create a VPN connection. I click the add a connection wizard, choose vpn, direct, put in the address, username and password etc. Then click next and it immediately says the wizard cannot connect (even though I asked it not to connect using the tick option) and a try again option appears. Clicking this just shows a never ending scrolling bar and a cancel button. I suspect the VPN Settings are corrupt somewhere but I don't know how to reset them, or if that is even possible. I've tried a system restore and sfc /scannow Any other suggestions you can think of?

I agree this is a trade off based on a best case scenario. I doubt that even if I give the students a big log off link that they would ever use it. We used to have smoothwall and the auth was done transparently without even needing an agent. Shame lightspeed doesn't offer the same but it's interface and ease of use is much better. There are a few things I miss from SW that lightspeed could easily implement to improve things: Improve the auth (NTLM) so no need for agent. Add a top 10 domains list with bandwidth to the dashboard Add a new summary report that combines the most viewed domains, most bandwidth heavy users, popular searches and graphs in one report. A report on duration specific users spend on sites would also be useful especially for staff Facebook access!

I managed to solve it. I changed it to basic redirection and used h:\ as the location despite it's warnings. I also had to disable offline files as this caused a problem where they couldn't create or modify folders. I think the root of the problem was that I'm using a DFS share for the home drives, and the redirect didn't like it.

Hi, I need to install Lexia on a lot of PCs and I've seen that there are two MSI files on their site, the updater and the fresh installer. I know how to customise the msi and create the GP but.... Does anyone have a script to check for which installer is needed? A few of the PCs already have an older version installed and need the updater, but most will need the full install Thanks,

I have seen the radius option. My concerns with this are: Would Ruckus show who is logged in, on the ruckus dashboard using the radius info? Would it use Ruckus' auth page or lightspeeds? I'm assuming the ruckus one since this is presented first then passed to LS. Is there a way I could restrict this auth to a specific group, or the option of disabling specific users if there is a need. (without disabling their use of normal college computers\logon) Would RADIUS auth restrict logons to one device? LS is currently set to a 55min reauth. After this time would the lightspeed reauth page reappear or Ruckus'.

Some more info might help .... Our home drive structure is : Root Year7\Username Year8\Username Year9\Username Year10\Username Year11\Username Staff\Username So the redirection policy is set as advanced based on group, create folder under root then has all the groups defined and unc e.g Year7 group \\server\home\Year7\%username%\My Documents. The settings tab has no ticks for move folder, grant permission etc and the option to redirect to local if policy is removed. In the XP policy redirect its set as h:\My documents so XP computers are unaffected by the location since it's mapped by the user home drive setting. I couldn't do this in the folder redirection for 7 because if I type h:\my documents it changes it to my home directory (UNC) when I click OK. I can't use %homepath% setting as this would cause the horrible desktop.ini problem and call all the folders documents. I'm still confused that the event viewer says the redirection applied OK when it doesn't work. and rsop says it redirected as well. I tried removing the user profile path on a test user to avoid the mandatory profile in case that was the cause but got the same library as default problem with a local profile.

OK, so I removed the 'Disable Known Folders' feature and now all programs default to libraries documents. But this folder is empty and users can't save here (could be profile location?, we use mandatory profiles for students)". They get the error "to use this library you must first create a folder" if they try to create a folder they get "unable to create new folder file system error (512)" I checked the event viewer and it says the folder redirect for documents etc was processed successfully. So I don't get it? why is it not choosing h:\my documents as default?

Hi, For some reason all our windows 7 laptops and PCs are set to desktop as the default save location. It only affects students and not staff or admins. I'm sure its group policy related, but any hint about where to look would be useful... My initial investigation shows that when a student tries to save it comes up with desktop. They just click save. It then says you can't save here would you like to save in My documents instead. they click yes and then it says this action has been canceled due to restrictions on this device. If they save to computer h:\ it works fine, but of course they don't do this, and end up losing their file by clicking close, don't save. If they click their name in the start menu they get a list of all the folders (documents, desktop, music etc) but most of them either fail with access denied or the restriction message. I think it might be because I tried to disable the horrid 'libraries' feature. I've managed to hide the libraries documents, videos etc within 'libraries' but not the link on the places bar. I'm going to try removing the guid filter to see if thats to blame tomorrow. Redirection of documents, music and videos is in place in the group policy file. under 'folder redirection'. Is there somewhere else I need to check or do you think its the disabling of the libraries thats to blame? Thanks,

Hi all, I currently have wifi guest access set up using WPA2-PSK, password, then Ruckus guestpass, and then lightspeed Web Auth via AD. I have Vlans, and transparent proxy in place and it generally works OK for guest devices Few annoyances: It's annoying I can't tell lightspeed to forget all web logins at lesson ends, as even with the 55 min auth its is possible to have the wrong student in logs if the machine was turned on half way through a lesson. In an ideal world I would like not to need the multiple systems of authentication. I'm aware Ruckus can do AD and RADIUS auth, the reason I used guestpass, is I like it auto-expiring access after a set amount of time, and it limits each student to one device. I don't see how I would achieve this otherwise but.... If I used RADIUS or AD auth on the ruckus guest SSID, is there a way for Ruckus to pass the auth info along to the lightspeed rocket? The reason for this is that I have had to set the re-auth for students to 55mins (lesson duration) and they find this annoying throughout the day. We collect their MAC address but I can't see how to use this as a method of auth on light speed. Has anyone managed to get Ruckus AD/Radius auth to be passed on to lightspeed? P.S Has anyone found a way to save the Ruckus logs for what device connects where? Would be useful for when inclusion lose a laptop to know what AP it used last.

Hi, I've been asked to put a page flipping thing for our prospectus PDF on the website. Yes I know, I think it's a horrid idea too, but senior management want it so I've got to try. Other schools in the area use issuu, and I had a look, but our Business Manager was put off by this in their T&Cs: Published Content. By uploading Published Content to the Issuu Service, you hereby grant to Issuu a worldwide, non-exclusive, transferable, assignable, fully paid-up, royalty-free, license to host, transfer, display, perform, reproduce, distribute, and otherwise use your Published Content, in any media forms or formats, and through any media channels, now known or hereafter devised, including without limitation, RSS feeds, embeddable functionality, and syndication arrangements in order to distribute, promote or advertise your Published Content through the Issuu Service. This license includes the right for Issuu to convert your Published Content to Issuu’s proprietary format, or such other file formats as may be used by Issuu, and to display and make your Published Content available, in whole or in part (including excerpts), on the Issuu Service in association with other Published Content, content or advertising. Subject to the license grant to other Users below, the license granted by you to Issuu in this paragraph terminates as to a specific Published Content once you remove or delete such Published Content from the Issuu Service. Does anyone know of a flippy thing I can use that doesn't want to own our content. Management are happy to pay a small amount for a software license. We use Joomla 2.5 for the website, so it could be a component, but I had a look on the extension directory and they all seemed to be jpg flippers with a complex install procedure. Thanks,