Jamo

For completeness have you had a look at cacti? For long term network monitoring and base-lining I don't think it can be beat! Its also much kinder on resources than the larger solutions like spiceworks which really hammer the server its running on!

Is that the removal of all Apples from the building cus I would LOVE that!

Also, watch out if you have apples in the fleet as we do. They will register their own reverse DNS records and you can end up with endless apples stuck in the reverse lookup zones as the DNSProxy account doesn't have permissions to delete the entries!

From MS By default, a Windows 2000 and newer statically configured machines will register their A record (hostname) and PTR (reverse entry) into DNS. If set to DHCP, a Windows 2000 or newer machine will request DHCP to allow the machine itself to register its own A record, but DHCP will register its PTR (reverse entry) record. Double check that the DHCP server has permissions to write to the reverse lookup zone, if in doubt test by allowing everyone full access, if that works then its permissions which are your issue. The Always update option basically just makes the DHCP server ALWAYS do the registering both on behalf of the client.

You can use radius with an IAS server, using PEAP MS-CHAPv2 you can authenticate with usernames and passwords and push them to different VLANS.

What do yuo mean RDS session based? Microsofts licencing when it comes to terminal clients is strange. For instance VDi. If you have 500 users in your 6th form, and you want them to be able to connect to VDi using your school owned laptops. Its legal to use your Software Assurance to 'upgrade' to VDA licences for your physical laptops so that they can connect to the virtual clients. If your users are using their OWN laptops to connect to your VDi, it is no longer legal. As the OS on thelaptops is not owned by the school, our software assurance no longer covers the 'upgrade' to VDA licencing which means that you have to individually purchase VDA licences per DEVICE for each 6th former. As usual licences cannot be transferred between devices for 3 months (standard MS stuff)

Yeah our IAS server was getting loads of weird requests from peoples mobile phones! We stopped using PEAP-MS-Chap a while back as we moved to certificate auth. Since then we now get loads of denied access requests which made me think that some policies had failed somewhere along the line! Turns out some crafty students had worked out you could connect with their username and passwords

Yeah we wanted to do the same, we don't have any access for students to their files on the network at the moment, virtual desktop was our stab at it but MS and their licencing soon stopped that one!!

I used to use Astra32 which just gives you the hardware IDs and then does a lookup for you

I would suggest not changing the %TEMP% path as it is a global change and may affect other software. It is better to get the software working on the current system, than change the system to meet an out of date legacy and no longer supported application.

Yup scripts are the only workaround here, its a complete mare that MS didn't include this kind of customisation for enterprise and we are sent back to the days of VBS scripts to get simple customisations! Still the scripts mentioned do work we have them deployed on our network along with a custom powershell script which deals with people resetting libraries to show C: drive locations.

Yup that is no problem though. If you ARE recieving 'unlearned' destinations then that means that you are recieving a lot of spam OR that the MAC tables are full in the unmanaged switch

I think the beginners guide is about as good as their motto: Go Deep Monitor it for a bit and check the packets you are recieving. If they are for other clients (barring the broadcast and multicast addresses) then you may find that the unmanaged switches just arent man enough for the job. Its quite a task running wireshark, best bet really is to monitor a good port vs a bad port i suppose otherwise you won't have a baseline to monitor against.

You always get one, its the end device

Traceroutes only class a hop as traversing a routable interface, so it would always report one hop to clients on your local subnet. Only thing you could try is wireshark the interfaces from the connected clients, see if there is rogue traffic

Comes down to the difference between hubs and switches. Hubs effectively broadcast all unicast traffic out of all interfaces as it is not 'intelligent' at traffic management like a switch is. On busy links this can make traffic soooooooooo busy! Coupled with the collision domain problem of hubs it would not be surprising that a wireless point, which is in itself a shared medium, would fail to perform adequately. Un-managed switches would be better, 5 port switches aren't too expensive and are far better than hubs, however neither can replace a managed switch for ease of management down the line!!

Totally agree about being involved in the project, that's absolutely essential! It's almost impossible to support a project if you have looked upon the entire endeavor as a black box project. I think the mitigation of risk is very important to management, as in the end its their heads that large failures would land on. Nothing wrong with doing a project yourself, but in schools, as is the case in many places, you just cannot be an expert in every sector of your environment (of course it is expected that you would be and I think I speak for everyone on here that we do our best to do that every second of every day). It's silly to think that someone could be a systems expert in linux, Windows, VMware, HP Cisco Juniper etc switched networks, firewall, security, backup and project management!

I think the crux of it comes down to the following: It is a huge investment for a school/company. Get it wrong, and you could spend the next 5 years trying to fix a square peg through a round hole. Getting someone to do the initial leg work for you doesn't mean letting go of your project, it means designing your project with them, with the understanding that they will deliver. If they fail, you don't pay etc etc. It's all well and good saying yeah I set up this system, but what about on going support, backups, speed, bottlenecks, or unseen issues along the way. I don't know anyone who hasn't completed an IT project who hasn't come across the typical IT weirdness, its part and parcel of the job!

we looked at vdi. It still has a number of issues within schools, mainly video still not being 100% (although that is considerably better than it was) and audio recording which was a big thing for us. We also looked at the byod side but got put off by MS licencing which is still very restrictive when looking at connecting a non school owned device to your hardware. (check vda licences here)

Lol its blocked by the LA policy at ours! Not that I have tried. Honest.

You never need to map an MSI package share, I won't even work if you deploy through GPO to a mapped drive as the map won't exist until the user has logged on. A share path is all that is needed. You need 'Authenticated Users' as the permission to read and execute on the share. You can change the NTFS security permissions to not allow folder browsing if you don't want people poking around in the folder. Thats in the advanced security settings on the NTFS folder itself. Adding the hidden share $ onto the share name is the only other part that is done in our school People really have to be persistent to get to the apps then! You can't add 'System' to the permissions as that's a local account, specific to each machine. You either have to have 'Authenticated Users' or 'Everyone'.

We restrict users from logging on twice using RSLogon Limit which is a small app I wrote (RS Applications) to restrict concurrent logins. coupled with the disabled user switching it stops the multiple logon probs

Christ that leap is cool! Not sure how often I throw wizzy 3d maps around but when I do it will be great!

I think they have REALLY missed a really key turning point in ICT developement at the moment. They had the ability to edge into the business market with fully managed tablets, but have instead made a frankenstein windows which achieves little but frustration when used!

They are all hotfixes?!?!?!??!??!?!?! Are MS planning on putting these in SP2? I have had some of those errors with CSC saying "The specified network name is no longer available" assumed it was dodgy wireless!