markwilfan

Even stranger our Win 7 devices do not have this patch either hmmmm

** Shakes fist at MS *** Thanks MrMat was 10th in the queue on the SIMS helpdesk when I read this. Anybody found which update it is for Win 8.1 ???? This update doesn't seem to apply to Win 8.1 but it still happens

I did ours myself. Went on a course and picked up lots of tricks.

@harriuk has done this at his school

Burnt at the steak. Yum. Medium rare please @mbedford

Have a look at this https://psappdeploytoolkit.codeplex.com/ Specifically this section of the ps script which allows you to pop in applications to be uninstalled first #*=============================================== #* PRE-INSTALLATION If ($deploymentType -ne "uninstall") { $installPhase = "Pre-Installation" #*=============================================== # Show Welcome Message, close Internet Explorer if required, allow up to 3 deferrals, verify there is enough disk space to complete the install and persist the prompt Show-InstallationWelcome -CloseApps "iexplore" -AllowDefer -DeferTimes 3 -CheckDiskSpace -PersistPrompt This is an excerpt of my old java deployment ps using psappdeploy #*=============================================== #* PRE-INSTALLATION If ($deploymentType -ne "uninstall") { $installPhase = "Pre-Installation" #*=============================================== # Show Welcome Message, close Internet Explorer if required, allow up to 3 deferrals, verify there is enough disk space to complete the install and persist the prompt Show-InstallationWelcome -CloseApps "iexplore" -AllowDefer -DeferTimes 3 -CheckDiskSpace -PersistPrompt #remove old versions of JAVA #check to see if latest version of java is installed if it is bomb out $JavaVer = Get-InstalledApplication -Name "Java 7 Update 67" If ($JavaVer -ne $null) { Exit-Script -ExitCode "06" # I use a custom error code here for tracking. } Remove-MSIApplications "Java 6 Update 2" Remove-MSIApplications "Java 6 Update 20" Remove-MSIApplications "Java 6 Update 21" Remove-MSIApplications "Java 6 Update 22" Remove-MSIApplications "Java 6 Update 23" Remove-MSIApplications "Java 6 Update 24" Remove-MSIApplications "Java 7 Update 5" Remove-MSIApplications "Java 7 Update 25" #Remove-MSIApplications "Java 7 Update 45" Remove-MSIApplications "Java 7 Update 51" Remove-MSIApplications "Java 7 Update 55" Remove-MSIApplications "Java 7 Update 60" Remove-MSIApplications "Java 7 Update 65" Remove-MSIApplications "Java 7 Update 67" This is how we used to push out Java.

@harriuk this one is for you but may help others too Make java SCCM Application as normal using the msi extracted to %USERPROFILE%\AppData\LocalLow\Sun\Java when you run the offline installer. Use this in the Installation program box in the SCCM application msiexec /i name_of_msi.msi JU=0 JAVAUPDATE=0 SPONSORS=0 AUTOUPDATECHECK=0 RebootYesNo=No WEB_JAVA=1 /q Totes obvs change the filename to something relevant to the same of your file you deploy more switches here if you want them Installing With a Configuration File I retire the old versions then and tell new application to supersede the old ones too. As of Java 8 only high and very high security modes are available. So to get around sites that use code that is unsigned and "MUST" be used we use a central site.exceptions file deployed via the following method. The following files are stored in a share; deployment.properties, deployment.config, & exception.sites . Add any sites you want to bypass the java security on. Wildcards do not work though. Make an SCCM package that runs a .bat file with the following in rem @echo on rem copy files used for Java settings rem ***************delete Java settings************************** del /s /q /f "C:\Windows\sun\java\deployment\*" rem ***************Java settings copy ************************** xcopy /C/Q/Y/R/E "\\servername\sharename\Java\*.*" "C:\Windows\sun\java\deployment" Totes obvs change the share to something relevant to your network Then deploy the package to a collection of your choice making the deployment rerun on a schedule. All you have to do is add sites into the site.exception file in the share then either wait for the schedule to run or manually rerun it. We only do this for student devices at the moment as if you use the above method to centrally manage the site exceptions users cannot add their own. I am considering just deploying to all to make things more secure but remember kids; security and convenience are directly opposed = potentially more support tickets. Hope this helps somebody java deployment files.zip

Hehehe

Good post here http://blogs.technet.com/b/odsupport/archive/2011/11/14/how-to-discover-kms-hosts-via-a-dns-query-and-remove-them-if-need-be.aspx

You could also use this "nslookup -type=srv _vlmcs._tcp >%temp%\kms.txt" to check dns for other kms servers. When setting up kms people have been known to accidentally set up other kms servers lol @harriuk

Will post how I do it when I'm on a PC

+100 for munki

We use sccm retiring older packages as they get released. Install switch turns off nagging updates and sccm package deploys site exceptions to the clients to get around unsigned java. This auto deploys once a day

Slmgr /dli will show you the licensing state. Domain membership shouldn't play a role afaik

Probably found one by now, but we use nagios (with Check_mk) to monitor switches, servers and WAPs. Then we use nagvis to make our network map. It is all done manually but just updated as part of our documentation changes whenever something is added/removed. If you spend some time with nagvis you can build yourself a nice little heatmap As you can see ours is not quite there but hopefully should get this sorted by the end of the week. ---- edit: Just realised you are after a network scanner. Still once you know where everything is I found the best way to learn our network (been in post for 11 months) was to populate nagios and piece together the nagvis map. Good luck

There are a few ways to do this. I prefer the remote method Open Group Policy Management and scroll down until you see Group Policy Results. Right click this and use the Group Policy Results Wizard to run a remote RSOP

If you are not using GPPs then a resultant set of policy export on each user on a single device should be able to sort your problem. Print them both out and sit in a dark room with a coffee highlighting settings that are the same on both RSOPs

Have you got GPPs for IE settings? If you have and they are different for staff and students that is where I would start. In the advanced section there are SSL/TLS options.

Ah yes sorry itguy. You are correct. Only a security risk if you are using mdt or sccm with mdt . Still good practice though

Thought I'd pass this on in case it helps anybody else. We are using SCCM 2012 R2 for OSD and as I'm a good boy I'm using a standard account to domain join with rights delegated to the right OU. All was working fine; then just stopped working. After lots and lots of troubleshooting, finally found this in a sysprep log "netjoindomain error 8557" which let me to ConfigManager OSD : Joining machines to a domain and its security | System Center Configuration Manager Turns out by default normal users can only join 10 machines to a Domain. As our OUs are read only to our standard users I just cleared the value; et voila. For those of you using a domain admin account to domain join in sccm or mdt just remember the shares are read only to all and snooping students could find their way into the unattend.xml files. Hope it helps somebody one day

For anybody else that experiences this, according to the SIMS helpdesk "auto deploy" overrides auto download. So if you have auto deploy on, even if you have "auto download" unchecked on the update tab, updates will download and auto deploy as they become available. Must be an undocumented feature

Another vote for Salamander here. Fantastic value for money; does everything; support is absolutely fab; great product all round. I would highly recommend it.

@MatthewL presumably because of offline files

Hey cragz. I found this tother day. Changed the redirected "old" menu for a shiney pruned one and was much quicker. In the process of going through all shortcuts for old dead links. Did you get around the airplane mode problem? Ie you can't disable airplane mode?

plug a keyboard in and press esc on boot or hold down delete to get to the bios. Works on linx 10