OverWorked

Michael, Thanks, but your link's broken! EDIT:- I've just found the latest version. It says:- Windows Server 2003 R2 (32bit) with latest service pack They haven't updated for Server 2008 yet. Did I mention I'd got it running On Web Server 2008? It runs on the Tomcat server, but I'm having trouble getting IIS 7 configured. I've just seen IIS 7 for the first time today and its quite a bit different to IIS 6. Serco haven't released a guide yet. Anyway, all early indications are that it'll run OK.

As for two-factor authentication... The cost is just prohibitave. That'll kill it. The trouble is the govt insist on parents having real time access (I've read somewhere), then insist on expensive security for it. Don't get me wrong. I'm all for the external access, and the use of technology like this, but the thought of the expense gives me a cold sweat.

According to the Server 2008 Client Access Licensing page, CALs are needed as the users are authenticating. As users authenicate with ePortal, they each need a CAL. Someone please prove me wrong!

Thanks, but that's referring to SQL Server CALs, for accessing the database; not the Windows Server CALs, for the ePortal end users. That document gives the minimum ePortal server spec as 'Windows 2000 Server (or higher)', recommended 'Windows 2003 Server (Standard Edition or higher)'. It also says that 'ePortal will need 5 x CALs.', presumably SQL CALs, but doesn't say why only 5, irrespective of the number of users. BTW, I've just installed Eportal on Windows Web Server 2008 and it runs fine.

I'm in the process of setting up eportal for external access by staff, and later, parents. I've just been struck by a thought: We'll need user CALs as ePortal will be hosted on Server 2008. Is this right? Reading the MS pages on Server 2008 licensing, we need CALs for any users who authenticate with a web site, either through Windows or any other technology - like logging on to ePortal. This could get expensive. The way round it is to host it on Windows Web Server 2008, which doesn't need any CALs. But will ePortal install and run on Windows Web Server? I'm just downloading the trial Web Server edition now to try it. Does anyone know for certain before I spend time on this?

John, I'll send a you a PM.

I've just been going through the Verisign site for the VIP service. The demos are worth watching. They don't mention prices, which generally means "you can't afford it". Our LA's human resources dept use 2-factor auth and issue the number generator key fobs to schools at £150 each. That gives some idea of how expensive it is. I'll probably go for Verisign's "Secure Site", their cheapest SSL product. There's also Thawte's "SSL 123", which is even cheaper.

You're right!

I'm just going through this myself, and learning as I go. I have an experimental site at the moment. For a while it was just secured with a SSL cert issued by my domain's CA. It's worked well, but the browsers flag up warning about the site not being trusted. This morning I've installed a free 14-day trial Verisign cert on the server. I'll test it tonight when I get home. A word of warning: Verisign send you the cert several hours after requesting it, and the instructions on what to do with it about twelve hours after that, leaving your web server useless in the meantime. Please correct me if I'm wrong, but there's no harm in just using a cert created by your own CA. It just means that machines from outisde the domain will be unable to verify the authenticity of it, but communications will still be secured. The biggest problem would be training users to click through the warning to get the site every time. (As I write this I wonder if it's possible to generate a root CA trust cert from the domain CA and give this to users to install on their home computers, so they will trust it).

@garethedmondson: It's not such a stupid question. I have little idea of it either, apart from what I've read on EduGeek. We're in one of the more affluent areas, North Yorkshire, (although you wouldn't think it to look around our school), so we're not getting BSF'ed for years. Careful how you spell that. It's better to be tuped than tupped. Ask a sheep farmer.

Awww come on. Someone tell me when and where it is.

Russ / Chris, Sorry if I'm being thick, and this info is published elsewhere here, but should the eventelephant listing have the location, date and time? It'll save looking for it. Chris' summary just says its in Chorley on a Wednesday in May. Thanks!

I'll second that. I only use the online support now, and it's great. Every query gets resolved promptly. It can't be much fun working on a telephone help desk all day and it's not a job I'd like to do. I did suggest to Tom at the last EduGeek conf that he take the helpdesk staff out for a day to cheer them up.

I've just renewed our subscription to start the second year, for the school I work at and a children's charity I support. It's pretty hard to be negative about Smoothwall, but here goes:- 1) There's a quite a bit of a learning curve to go through, especially for the filtering policies and rules, but once you get the hang of it, it makes sense. It comes preconfigured with default policies, but you're better off deleting these and creating your own. You'll gain a better understanding of how they work that way. Thanks to Smoothwall's tech support for that tip. 2) Errr... that's it. If you'd asked the question a couple of months ago, I'd have added that the admin web interface was very slow, but they've fixed that recently with an update. I recently had a sales call from Bloxx. I agreed to the demo, as it's been a while since I last looked at it. They started by quoting more than double Smoothwall. And that didn't include a firewall. They suggested that I could use Smoothwall for the firewall and Bloxx for the filtering - yeah right.

I've just completed my own solution, which is a refinement of terrorvis' solution. I use .bat files to call import .reg files to switch the proxy on or off as required. It doesn't alter the other settings, like proxy address, because they're set by group policy. The user just click on the shortcut they require and it sets the proxy and runs IE. batch file example:- @regedit.exe /s "c:\proxy_script\proxy_off.reg" @"%programfiles%\Internet Explorer\IEXPLORE.EXE" (The @start command suggested to run IE wouldn't work for me). registry file example:- Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings] "ProxyEnable"=dword:00000000 I've created an msi, which is attached. IE Proxy at Home.zip

Unrecognisable!

Thanks to the three above. I'll look into these. I've tried the creating a wpad.dat file with DNS pointing to it, but just can't get it working. IE won't pick up the settings. Anyway, as I think I mentioned earlier, I'll go for a shortcut to a script on the user's desktop, so they can do it themselves.

A couple of people here have mentioned scripts to change the proxy settings. Can anyone let me have a copy of such a script? It seems the easiest way to go - a shortcut on their desktop saying "I'm at home" which they can click and it resets their proxy address to the blank default. So far I've just told people how to clear the proxy address themselves, but it's not easy for them. Soon they'll be expected to access from home, so I have to remove as many obstacles as possible.

I think I'm going to go for that with AVG free AV. Over the years I've used F-Secure, Zone Alarm, and currently Eset. All of them have caused problems. I used to have a USB broadband 'modem', but now I've got a NAT router, I'm not sure I need a software firewall.

I've spent two whole days on this, this half term. I finally got it working, but it's just too unreliable. Even with computer-only authentication, users frequently get the domain-is-not-available message (even when the IAS server's system log confirms that the machine has been granted access). Users also frequently get profiles and group policies failing to load. It is rare that a user can log on successfully. I've removed the group policy setting wireless security and changed the AP back to 'open'. Any suggestions?

I don't see what's wrong with that. It looks like school dinners. But then I'm not fussy. It's just down to the low res photos with bad lighting.

I phoned BT today to get a MAC code to cancel my BT BB. After 2 sales pitches from them begging me to stay, they reduced their price to about £7 per month, down from £15. They threw in the router as well (although I suspect they normally give these away). I'm staying with BT BB, having got a reduction of £90 a year and the router. (I've currently got the BT Voyager USB modem, instead of a router). I signed up for Sky TV and phone in November, but Sky aren't charging me for the BB because I never started it. Suits me!

Trust John to spoil it! Why is a central heating cylinder outside anyway?

Offline files is a machine setting, so it would appear for all users of that machine, but not to the same users if they went to another machine that didn't have offline files configured. It keeps a copy of all their file in certain folder. By default it's their My Documents and Desktop, I think, but this can be configured. It works for redirected folders, like you have. It's useful for laptops that get taken home, so the users can still log on with their domain account and use their documents. When they return to the network, the laptop will synchronise and copy the latest version of file between the laptop and the my Docs share on the server. It's configured from Group Policy. I can't remember where exactly, as I'm at home while writing this. Find the setting in Group Policy, and disable it. On a machine that's permanently, wired to the network, like a desktop, offline files synchronisation will probably just be a nuisance. The offline file cache will fill up the hard drive and slow that machine down if it's used by a large number of users. Hope this helps.

Like wagnerk, I studied it systematically for certification, but in day-to0day use I just Google for stuff. I took in loads of info for the exams, then forgot half of it immediately. @Maniac: RADIUS & IAS is what I'm working on at the moment. Can't get it to work yet, though.