_techie_

Well I just added in all those entries into the software restriction policy at the same time and now it works! Will refine it a bit more Monday lol!!

Hi, I have some software restriction policies setup to prevent our students running .executables from Pen drives, their home areas etc, and it is working well so far. This policy is set as part of a GPO at the top of our Pupil OU, we have several OU's underneath for different students in year groups etc. I have done this by adding in %HOMESHARE% as a path rule on the software restriction policy for students. This policy is not enforced, and does not have "no overide" in its config. As part of our Y13's ICT lessons, I have setup a sub OU of the Y13 cohort OU, called VB Users. These users are using visual studio, and unfortunately, they need to use run exe files from the following directory: H:\Documents\Visual Studio 2010\Projects\.... If I add in either %HOMESHARE% %HOMESHARE%\*.* %HOMESHARE%\*.exe %HOMESHARE%\Documents\Visual Studio 2010\Projects\ %HOMESHARE%\Documents\Visual Studio 2010\Projects\*.exe %HOMESHARE%\Documents\Visual Studio 2010\Projects\*.* H:\Documents\Visual Studio 2010\Projects\ H:\Documents\Visual Studio 2010\Projects\*.* H:\Documents\Visual Studio 2010\Projects\*.exe to a GPO in the sub-OU, all as unrestricted, the programs are still blocked in Visual Studio by the previous GPO, higher up the tree! Some help as to where I am going wrong would be good please! Thanks, _techie_

Yes we are at 2003 level. Just went through everything and we have a slight problem in that we have inheritance blocked on our new windows 7 structure, to prevent any old policies from XP filtering down. I have double checked everything and have now cleaned this up. However, the default domain policy does not look like as expected and looks like it has been modified - great! more mess to clean up! Seems we have some more work to do! Will report back in a bit!

We are at 2003 level I think, but will double check... Thanks for the input. Will get back to you in a bit...

Hi, We have moved over to Windows 7 this summer, all is going pretty well, but I am struggling a little with password complexity at the moment. We would like to have staff to have more complex passwords, but with 1700 pupils, this is going to be a mess, and I don't really want to hold lessons up getting Year 7's to have complex passwords just yet! I am at the current stage of just getting passwords to be able to be changed regularly at the moment, with no complexity requirements, but keep hitting the this 'password does not meet length, time or complexity requirements on this domain' error message. I have set the password policy on both our domain controller servers and workstations to be the same but still no luck and is as follows: 1) Enforce Password history - 0 passwords remembered 2) Maximum Password Age - 0 days 3) Minimum Password Age - 0 days 4) Minimum password length - 0 characters 5) Passwords must meet complexity requirements - Disabled 6) Store passwords using reversible encryption Am I having problems because of the 0 chars password length limit? I have seen Angry Technicians post on his website about the specops tool, which looks interesting, but what have others set as the password policy on the workstations/servers/domain and where have you put this in your policy setup? Thanks _techie_

Hi folks, Moving to Win 7 over the summer, nearly everything sorted, but we have come across a small problem. With XP, we used the Send To file list, which I populated in the mandatory profiles to list a number of hidden shares on a server which students could use in a 'ballot box' scenario. This way, students could easily send teachers files, without accessing said hidden shares. Come to repeat the process on Win 7, and although it is possible, it is much harder, and the list truncates (we have 120 teachers here, and they all want a Work Hand In Folder!) I did look at assignments on Moodle, but there was no easy way to 'manage' individual files (say deleting some of them), you could delete all of them, or delete the entire assignement, neither of which is very helpful. Any other ideas, (I guess email is the last resort, but I was hoping not to have to build a new mail server over the summer, what with everything else we have to do!) Thanks for any advice _techie_

We tried all of the following you mentioned, with no real improvement in speed. The only time the transfer speeded up, was when we ran the job for a second or third time. When we reached 100-200MB a sec. However the volume of data being moved was much much less. Obviously this is fine, but really a speedier first time backup would be a real improvement. I am also concerned about the speed of restoration, on some of our bigger boxes, but will be looking at that tommorow.

We have our new SAN (Dell Equalogic PS4100) All in and Running, tied to two Dell R170 ESX hosts all on vSphere 5. Performance of the SAN is fine, and we are not noticing any real performance hit with it, nor is it recording any disk error problems. We are trying to improve the backup speed of our Veeam Backup v6 jobs, which is very slow at the moment (not hitting any higher than 14-16MB/sec, with the bottleneck being recorded as 99% source (I presume that this means the SAN, is this is where the VM's of our servers are stored). Our copy of Veeam 6 is installed on a VM running Server 2008 R2 x64, with two iSCSI targets setup and configured (one Netgear READYNAS 3200, and an old server - HP Proliant ML350 G5 running FreeNAS v8. Both these are being used as Backup Respoitories on Veeam 6). Both these are working fine, and we can copy data fine. Copying a 2GB ISO from the Server 2008 R2 VM to the FreeNAS tops out at again at about 14-16MB/sec... The FreeNAS box is not recording any disk issues, neither is the Netgear ReadyNAS, but both items reside outside of the iSCSI network running the SAN, and ESX hosts. Would attaching the FREENAS, or ReadyNAS in someway into the servers/VM's iSCSI network improve performance at all? I would hope it would - also how would you go about it? From within Veeam, we can see the SAN volumes, and have tried all Storage connection modes within the Backup proxy settings. The Backup Proxy is residing on the same server running Veeam 6 (the Server 2008 R2 x64 VM). Any ideas on how we can improve its performance? Regards, _techie_

Thanks, thats great. I will simply wanting this to be for basic replication purposes, rather than tying a load of folders together for organisational purposes, so a simple DC Replication Group, with one namespace shoud be good I think. I can see you could have a very easy way of tying lots of shares together for say different departments using DFS, which would be great! Thanks for your advice, I will get cracking!

Hi, I am in the process of doing some development work towards our Server 2008 R2/Windows 7 Domain, and as part of the process, I thought I would get around to making some infrastructure improvements. As part of this, I was looking at setting up a DFS share/namespace for our Windows 7 Profiles. We aim to have two DC's running together, one which will have our Profiles on which I am doing now in testing (nearly there by all rights!). As part of setting up the Namespace, I have a few questions: Does the DFS Server/Service need to be installed on one of the servers actually doing the Replication, or can it be elsewhere? What is the point of the Namespace folder? Is this so I can use one namespace that actually has multiple pieces of content? Some clarification would be good here? Thanks Mark

We have some ageing fat clients in our design technology department - the workshops specifically. These rooms are particularly dirty, so we were looking at some fanless clients, and are now looking down the route of a small scale Thin Client rollout for other areas of the school as well. Because of the mains power in the room, and emergency shutdown facilities for the D+T equipment, we were looking at some PoE Thin Clients? Has anyone got good or bad experience of these, or any recommendations? Thanks for any help? Regards, Mark

Cheers dude, I guess, its time to do some testing! Thanks. Mark

Hi, Could you send me some screenshots of how you did this? I am aware of the exceptions, but it still seems to be getting caught and quarantined? I can PM you my email if you wish. Thanks,

We are moving to Win 7 next summer, along with new hardware. We are going to be using Sophos 9.5, along with AB tutor 6.7.1. I have had some issues with AB tutor, not removing policies properly, as well as small issues launching some things. Whilst this has been going on, Sophos has been quarantining (sp?) the ABclient.exe file as suspicious behaviour/buffer overflow and other items. I can only presume that Sophos has blocked the ABclient, prior to policiy removal, hence why it appears we cannot undo our policies properly! Until then, can anyone who uses both Sophos, and AB provide me with any tips to give sufficient protection using Sophos Enterprise Console, whilst also allowing AB to work? Thanks Mark

Just re-updated firmware with latest raidiator upgrade (same version), but still the same. Everything else seems to be working okay, so I will just hang fire until the next break.

Just tried it, without a proxy, and still the same. I get the feeling the OS is screwed on it somehow, or some config file. Might try a raidiator update again, and see what gives. M.

We have a ReadyNAS 2100, which up until today, was working fine, very happy with it. Yesterday we had a mains power blip, and the UPS supporting the NAS failed to protect it, and it went offline. We have since replaced the UPS, with another one, and have tested it, which works fine. The ReadyNAS boots okay, responds as normal to iSCSi targets, and also ping requests. We can access the contents of the NAS and also ran one of our small servers from it today as an ESXi datastore, all with excellent/acceptable performance. We are on the latest RAIDiator version (4.2.19), but whenever we try and access the NAS admin interface from a browser, we get requests for credentials fine, and it responds quickly, but after that seems to take an age to get the full web interface up, quite often crashing the browser at the same time! Both network interfaces are up, and the IP addresses seem fine from what I can see, so I am a tad confused.... Has anyone experienced this, and can anyone shed any light as to what is going on? Is it some disk check in the background running, causing the slowness, or is it some configuration on the device which is gone? RAIDar can see the device, and reports no problems, as does the interface when it finally gets there… Thanks Mark

Yes we just set it to: H:\Documents where H: is the letter used for the users Home Directory. This seems to follow the w7 way of thing working. You don't need to create folders to start with, unless you need specific folder permissions to stop users writing there (e.g. Desktop etc...) Hope this helps _techie_

Trying to add some GPO links to the Favourites bar in IE8 on Win7 SP1 using GPO. I have successfully added them to the users own redirected favourites area, but trying to add them to the favourites bar, is like trying to get blood out of a stone! From what I have read, adding them to the "Links" Category should work....but of course, it doesnt! Any ideas people! I did try using preferences to add a URL shortcut to H:\Favorites\Favorites Bar\.... but it just creates a duplicate Favorites Bar folder GRRR! Thanks,

Gah.....not really what i wanted to do! Yes, they are in H:\Favourites, but it copies some stuff off the machine from somewhere, as if you delete the contents of the folder, then logon again, you get loads of links and folders including: Microsoft websites, favourites bar, etc. Just wondering where this was coming from!

Remove fsrm desktop.ini blocker, it speeds up the folder redirection immensley. You are best following the windows 7 default folder style, and making documents a subdirectory of the users home share. This works fine, and resolves the issue of multiple "my documents" folders in your students folder on your server. Mooching about, desktop.ini gets everywhere! Looking at the file, its contents refer to shell.dll, so its obviously some critical system file, and gives the folder its special appearance with the icons, over a normal folder.

We have folder redirection set on users favourites, pointing at their user area. When a new user logs onto one of our domain machines, the default links from Windows 7 get copied to the users favourites. Is there anyway to stop this from happening, as I can't seem to find where they are! They aren't located in the C:\Users\Default\Favourites location, as this is empty. Cheers _techie_

I have successfully managed to do this. What you need to do, is make an image for certain resolutions that you have (e.g. 1280x1024, 1024x768, 1280x800 widescreen) which includes you school badge in the right location. Your badge would also need to be a cerain height or width to fit the frame, so would need to be patient getting this setup. Personally I used fireworks mx to make my images, as I can create a png from several layers, (your badge being one of them) thus meaning you can make small adjustments and tweaks to its position, whilst also exporting your png as an image for your bginfo script to work. I can give you the folders you need, but you will need to be proficient with an image editing program, and group policy to achieve what you want. For the welcome screen to work, you also have to logon once, for it to apply, as it needs to copy some files around as part of the process. Let me know if you need anything or any help. Thanks Mark

Just been reading up on it on here...seems that us using fsrm to block desktop.ini could be causing issues with our folder redirection! Testing tommorow...lol

How about using gpp to add application/department specific icons to the start menu? Or how about redirecting to a local folder on each machine, for students, and for staff, e.g. C:\pupildesktop and c:\staffdesktop then depending on location, add the necessary shortcuts for each app to those locations. The desktop locations could exist on all workstations. Create a gpo for each department (e.g. D+t apps) and add the gpp shortcuts to the gpo to the c:\pupildesktop and c:\staffdesktop respectively. Hope this helps Mark