k-strider

Its 0029... and I have just finished the last of the Red stuff from the bottle... but since i didn't start it it doesn't count as a full bottle so should i open the next and take another glass?

Lol .. i'll keep my Pacman then since it will eat anything bad that comes my Way!!!!

Radius Authentication at work is on my to-do list too... i have just set my WiFi up as WEP at work cause its the lowest common denominator for clients since not all my WiFi clients support WPA.. most do but not all!!! though at home i use WEP128 cause my cisco 340AP only does WEP :-( ..at a super fast 11Mbps as well... does that mean that some one can hack me in 1 minute........ Lol...

We use Securus, I quite like it Its quite a job trawling through it and working out what to process / hand on to teachers for punishment etc... good for catching those Web proxies.. it has a most common web sites visited too.. We actually bought it to cover our backs legally just so that we were being proactive in protecting the users... I get some interesting screen grabs from it... you learn all about all the secret affairs etc hehe... It’s also useful for finding things you want to look for, for example I added our unfiltered proxy so I could check it was just staff that were using it and not kids finding some way of changing the IE proxy On the Licensing front the way the rep explained it to me was that the server keeps track of the number of clients we have about 200 Lics so it keeps tabs on the first 200 concurrent users anyone after that it doesn’t keep tabs on... we have it deployed on about 300 stations but I haven’t ever seen the client count above 200 on the server... The server crashes occasionally.. but always when your browsing the console... so you know to go and restart it...

if you remove your exchange server besure to read this http://support.microsoft.com/kb/822931 <- Exchange 2K3 or http://support.microsoft.com/kb/307917 <-Exchange 2K I wonder if you would beable to move the mailboxes over if the original Exchange Server Services are not starting... i moved the mail boxes from one server to another and yes it is very easy but both my exchange servers were alive at the time!! I don't think your so lucky as to make DNS changes to make exchange work all that will have with regards to exchange is MX records.. i hope you don't need to use ADSI Edit ... eak...

all our servers are R2 now and we use PMP 5.5 it works fine...

I was trying to get ultraVNC into an MSI so I could mass deploy it to the PCs in preparation for deploying LanView 3. So I used Visual Studio 2005 to create the MSI Package. I can get VS to copy all the files into the folder and merge the required registry settings , I created two custom actions one to register the service, by calling winvnc.exe -sinstall and a second custom action that calls the setupdrv installs now it runs the custom action to register the service fine. But it either doesn’t run the one to install the VNC Hook Driver or it does run it but it doesn’t do anything... if I go and manually run it after I installed the MSI it works, it installs the driver and it appears in Device Manager. I have tried putting the custom action in two places install and commit. Has anyone successfully built an MSI that installs the VNC Driver Hook?

Thanks Guys I’ll have a look at 802.1x I just upgraded my switches last summer to Netgear Layer2 Managed switches... so I hope they support it... otherwise its a non starter cause I’m not replacing them this year

Oh dear sounds like you’ve had the worst possible day!!! Still on the upside you will be an AD and Exchange Expert when you sort it all out...... I’d go with the Site rename rather than the Schema Update that buggered it up... did you go through the Systems Manager and check all the various properties to see if you could find anything relating to Default-First-Name-Site... Good Luck in the AM... Google is your Friend... Note to self don’t change the default-first-name-site name...

Re your plan some reason i must have missed / not read this Could I use this new server by attaching it to the domain and setting it as the DC? If so, and once that has been done, is it just a matter of: - exporting the shares [from within the registry] - Yup - exporting the Group Policies using the GPMC tool – these would replicate to the new DC so not required NEW STEP move the FSMO roles over to the new server there are 5 i believe... google it. - removing the old DC from the domain –yes but DC Promo it to demote it. - erasing the C drive -yup - installing 2003 SP1 again -yup - attaching to the domain -yup - premoting it again -Yup - importing the shares reg file - Yup - importing the group policies using the GPMC – not required this will replicate back from the other DC.. Personally i’d leave both servers as DC and put the GC on them both.

Sorry i don’t think i was being overly clear... Like djm968 says you really need to promote a second DC in your domain. What I meant regarding the exchange server was that you could use that as your second DC. Or use a workstation that’s spare (or a virtual server on vmware/virtual pc) and put 2k3 on it. I have done this before.. move all the FSMO roles over to the new DC whether this is the Exchange Box or another PC.. (personally I wouldn’t use the exchange box, but I have dc-promo’ed and demoted an Exchange 2003 server and it was ok) I though I read in your posts that sometimes people couldn’t access the server until it was restarted... perhaps I read wrong... so what i was trying to say was if you move the DC operations to another server then you could eliminate the Authentication / GP Processing away from access to actual files (work).. what I was thinking... was if the server “crashed” ie no access did the workstations also fail to login (domain x is not available) as well as fail to have access to the files/data... you see what I mean you could establish if the issues were AD related or Server Machine related. Iif you actually want to destroy and recreate your directory I think I am right in thinking you are effectively going to have to export all your mail boxes and probably rebuild your exchange server as well.. whereas by trying to move the directory onto another PC and rebuild the file server would be much simpler if it works because you won’t need to fiddle with exchange at all. It would also have minimal impact on availability of your domain if you just move the Directory, even if it doesn’t fix the issues if I was in your position I’d be inclined to try and move the DC operations over to another Server before effectively destroying the domain, because rebuilding AD will effectively mean that.. I’ve never had to recreate a domain that has an exchange server involved. I too still think it’s likely to be DNS related. In the forward lookup zone under the _msdc.yourdomain.whatever there are lots of folders like dc, domains, gc, and pdc which have service location pointers that point to the DC... when you create a new DC you will notice new records appear and when you demote the older one the references to that will disappear. Have you tried to repair your AD DNS? A quick google brought up this not explicitly related http://www.petri.co.il/troubleshooting_dcpromo_errors.htm It suggests using a tool called netdiag /fix part of the windows 2000 Resource Kit... it might be worth looking up. or seeing if there is a server 2003 equiv. tool

I know you have said that you have been over everything with a fine toothcomb… have you expaneded every single folder in DNS and made sure there is absolutely no reference to the old ip addresses in there? You also have an exchange server have you tried promoting that to a AD or some other Virtual Server move FSMOs and demote the Original ? again trawl the DNS cause sometimes things get left behind. If that’s sorts out the Authentication ie the only connection issues then appear with connections to the server in question, then rebuilding it and moving the AD back *should* sort it out… The NTFS permissions on other drive volumes remain as long as you don’t Format them lol.. File shares are kept in the registry can be exported and merged back in a reboot then they are shared again… If you had to rebuild with exchange in the equation that would take a long time… it must be faster surly to try rebuilding the Server first… if it doesn’t fix then I guess you have to bite the bullet and rebuild the lot..

I agree with DJM968 that a sort of swing migration is the best way forward, other wise you have a lot of work todo... When I first got my job it was one week before an October half term.. they had a old unreliable NT4 server.. and a newer windows 2000 server that was not configured, and I needed to move the data and the domain onto the Win2k box. The first thing I did was take a ghost image of the Boot drive of the NT4 PDC (there was only one server.. No BDCs) if its small enough this is a fast way to roll back to the start point if it all goes ***s up.. I setup a BDC on a virtual PC so that i had a copy of the Users and Computers... I then upgraded the NT4 PDC to windows 2000 it went ***s up the first time.. so used the Ghost image and tried again... I then, once I had the server at 2K i DCPROMO’ed the new server. Then transferred all the FSMO rolls to the New server, I moved the home drives over to the new server using a piece of software I found NTmanagment or something.. cause on2K you couldn’t multiple change users properties easily... But you could easily do it using NTBackup and then restore it.. this keeps the security info and just in 2K3 you can change the home drive path on mass.. Once you have it all moved over you can use DCPromo.exe to demote the Original server and remove it from the domain... I didn’t remove my original server from the domain straight away but it was rather soon after since it was rather unreliable... You need to plan your migration extremely well and make sure people know there will be some down time.. I did it when we only had support staff in and the total migration took me about 2 days.. I managed to get minimal downtime by using the BDC to authenticate logins whilst the upgrade was happening.. at the time we had about 150 ish Computers in the school... obviously i moved the Support staff over first... (I may have even used NTManagent to move the home drives before I did the in place upgrade I can’t remember now) Do your workstations use DHCP... I only ask cause windows makes extensive use of DNS and well mine weren’t I spent days finding pc’s and changing them over to DHCP before I did the said upgrade otherwise it would have been a disaster!!!

I was reading some whitepapers the other day of Microsoft’s web site about IPSec and wondered if it would be a good way to stop LAN side attacks / unwanted student laptops gaining access to vulnerable services by just jacking in to a RJ45 point. Now we haven’t had any issues yet but I don’t want it to happen on my watch so to say, and just wondered if anyone had implemented this before, what the pitfalls are. For ref we have 5 W2k3 servers all R2 and all clients are XP or W2K. Oh yeah and a couple of HP PDAs running Windows Mobile 2003

We have some WG102s in our school, along with WAG302s and more recently some WAG102s they all work really well, though my only regret with the WG102 is that they are only B/G and not A/B/G like the other two. Most of our laptops are A/B/G so we get twice the bandwidth of one point... but I can vouch for them being good access points, they are also PoE so if you plan ever to deploy them across the school you can power them from a PoE switch. They also can use AutoCell so if you buy lots of them they chat to each other and adjust their power output and channel to best cover the area.

Net drive looks usefull thanks... though it doesn't seem to run on vista... having just reisntalled vista x64 RC1 5600 webdav does now seem to work... so it could have just been my last dodgy install.. which was an inplace upgrade from XP x86 to vista x86 RC1 5600

I have Vista RC1 5600Build on my laptop… I tried to get access to our files from home. And realised that we might have a problem in the future.. We currently use WebDAV over https to allow students access to their home drives from home. Has anyone else noticed that this doesn’t work in IE 7 on Vista? Has anyone tried it using IE7 on XP SP2 ? I am assuming that a lot of schools use this method of allowing external access as my sister used to do her homework like this at the school she used to goto…

There’s been plenty of suggestions already we use A free program called poweroff.exe (google it its at the top) Then we use start-up scripts to install it as a service @echo off REM test to see if installed already!! IF Exist %systemRoot%\poweroff.exe Goto end :copy copy \\ourdomain\sysvol\ourdomian\Policies\{5370A990-AEE9-473F-921B-2309D1C7393D}\Machine\Scripts\Startup\poweroff.exe %systemRoot% @%systemroot%\poweroff -create_service -notray -allow_remote -remote_pswd echo copy :end One of our servers then runs a batchfile every night at a set time with basically a list of all the pcs in… poweroff poweroff -remote room0101 -force -password -quiet I just made sure that the start-up script had a deny on the Pupil group (in security) so they couldn’t work out the password and shut down systems… We actually like the staff to leave the PCs on at night cause the Windows update happens about 5/6 and they then shutdown after that!!

I haven't tried this, but if you have W2k3 R2 you can push printers either to Computers or Users... we use a VB scripts that look at the computer name if its room43Somthing they get the 43 printers etc... one on login and one on logout.. and they work well so I haven't bothered exploring using R2s Printer push option.. I believe you need to deploy and have running an EXE on the PCs from the brief gander I had at it…

We have a couple of teacher using PDA access of Eportal for electronic registration and it seems to work ok.. (most use laptops) at least I don’t get that many can you fix my pda for eportal requests. We use HP HX4700’s and some HX2XXX cant remember the model now… they seem to work reasonably well.. our whole school has wifi since we have staff and students with laptops, we have Netgear WAG102 WAG302 and WG102s… these APs are slightly more than most but the do POE which is a must if your putting APs all over the place or hiding them in the false ceiling with no sockets up there… so they are out of site.. rather than in sight one day gone the next!!.. they also have autocell which means they chat to each other and keep there strength and channel optimal.. and the WAGs work on 2.4 and 5Ghz so you get twice the bandwidth usefull if you have lots of laptops on one AP… so long as tbe laptops are A/B/G too.. not really relevant to PDAs and eportal though!!

We have some NSO Pcs which come with a 3 year warranty so we don't need to fix them if they break we just send them back. I guess that’s probably the important thing so your time isn’t take up. The other thing I would suggest if your getting a local supplier to build them is get a couple of test units in to see how they work.. we have some IBMs for example bad case design cant put memory sticks in the front… so having the machine there in front of you will probably help, you could probably also arrange to make a standard build and get the supplier to ghost them for you this would also save time and they are probably willing to do it to get the deal… Check out the components used as mentioned else where… just make sure they are good quality… all our pc’s have Intel main boards in for example.

Thanks for the Replies guys I’m testing some of the things suggested over the next week or so. The profiles generally between 2 and 30 meg most probably average on 10ish… I’m hoping that the more paths I exclude from the profile over the next few days that should shrink them.. Also I have started moving some peoples profiles onto a different server to see if it makes a difference. I’d be interested to hear how to use the Office Outlook ADM to make it auto-magically be setup with mandatory profiles, I had a quick look through the Outlook ADM but couldn’t see a setting for use outlook in exchange mode or the like…. Because that really is the only thing stopping me using them. The students do use web access from home etc but its just not as good as outlook especially the way the address book works and the inability to open other calendars I am becoming off the opinion one server for one job… and I was hoping to off load the WSUS and other stuff away from the main file server.. either be it a new cheaper server and upgrade the disk system in the current file server or a new file server and use the current one for those tasks. For ref the server supports about 1000 Users but as I said in my original post there are 3 classes so 90 fixed terminals plus about 70 teacher laptops so usually about 160 Users Plus upto 90 more depending on how many year 7s are use there laptops.. which makes it about 160-250 concurrent connections. next year it will be +90 more as we increase the number of student laptops. etc etc.. That dell storage server does look good value for money I might investigate that further next year when the money comes in! some nice SAS drives would be very fast!!

The Profiles vary from 2 MB upto about 50MB I am just running diskSpace Explorer to get a Pie chart overview so I can see the average size of the profile. It takes ages so I’ll post the outcome tomorrow once I know. I use GPO to Exclude some of the directories in the roaming profile. I don’t want to use mandatory profiles because we use outlook for email and they would have to run through the setup every time, also word and other apps would constantly bring up the windows installer on first run. Perhaps I need to be a bit tighter and exclude a lot more folders from roaming… if anyone knows any of the folders in the Application Data\Microsoft that are good /safe to remove without causing the windows installer to run endlessly that would be helpful as this often seems to be the biggest folder in the Application Data folder. Thanks to the Last post DMcCoy … Cookies of-course whilst don’t take up much space are lots of tiny files which will cause a real strain on the Servers request for files, especially in IDE drives that are made for workstations! And not optimised for servers. I’ve just added them to the list!! This is my current Profile Path Exclusion Local Settings;Temporary Internet Files;History;Temp;Application Data\Serif;Application Data\Mozilla;Application Data\Macromedia;Application Data\Sun;Application Data\Microsoft\HTML Help;Application Data\Adobe;Application Data\Real;Application Data\Identities;Application Data\Microsoft\Speech;Cookies For more info on the Server, whilst it hosts all student and Academic staffs home Drives it also does a couple of other jobs too… it’s the WSUS server and has an SQL Express database on it for said WSUS. It also runs some AQA online test software which also has a SQL database on it.. Its memory usage runs around 1.1 to 1.7GB. in the Sessions, Shared Folders, Computer Manager there are usually about 160 Open Sessions at any time.. this makes sense since we have at least 3 rooms 90 PCs plus staff and student laptops. It really churned last year until I had a spare 1GB I could put in it when I upgraded the Exchange Server. Only the Fixed terminals have Roaming Profiles, since students and staff don’t share there laptops they just have Local Profiles. I have applied windowsxp-kb899409-x86-enu.exe to one room cause if it takes 20 Secs its worth it… and once I see the impact of that I am going to move the profiles to a different server and see if that helps. I only want to do one thing at a time and measure the difference. I'll Post more on Profile Size in the AM.

We are experiencing some slow login/outs at peak times, i.e. at the start and end of each lesson. It can take up to 10 minutes for students to login at the worst of times. Whenever I test it, it usually takes me about 1-2 minutes to login but I can never login to 100 workstations all at once.. obviously!! I am fairly certain its not DNS related, as it varies depending on server load, and also browsing the file server that hosts the home drives whilst people are login in is very slow. We have 3 classes so about 90 terminals plus teachers laptops probably about 50-70 on during the day. Plus year 7 student’s 90 of them have their own laptops which they may or may not be using at any one time. Now the main File server that holds the home drives is overloaded and under spec’d Dual Xeon 2.4Gzh 2GB of Ram Intel Board with dual Gig bonded Ethernet Disk Array controller Adaptec ATA1200 with mirrored WD1600SB Disks Separate 40GB IDE disk on the IDE controller with the Roaming Profiles on. Unfortunately the Server was spec’d and bought before I arrived. I Believe the problem lies with the IDE disk array, as its not designed to support 100s of users accessing it all at the same time. So I am putting in my budget for next April a new file server specifically for storage and ideally would like to put Microsoft Windows Storage Server Edition on it so it can’t be used for anything else. I have a quote for the file server below at £3250 ish Ex VAT Intel Compass Creek Storage Server SSR212CC 2U Chassis fully redundant power 2Gb (2 X1Gb) ECC REG DDR memory Five Western Digital Raptor 150Gb SATA hard drives My Question is really has anyone experienced this sort of problem and resolved it in the past? I don’t want to recommend a £3.5K solution to the problem and it still be there after I migrate everyone onto the new server. I updated the Network Infrastructure last year got Giga bit Ethernet to each Cab and a 6 Gig Link between the Two main Cabs. Each switch has 1Gb uplink and 100Mb to the desktops. Watching the Task manager the network utilization doesn’t get saturated at peak times. In the mean time I think I might move the roaming profiles off that server onto the VLE Server which doesn’t do a lot at the moment.

This is what i use it shows it as na error when they reach a certian percentage of their quotaspace2.vbs