cogrady84

I've been using MRBS for a number of years now, multiple installations on the same webserver, all linked together, bound to AD. Its perfect for us, highly recommended and I am happy to assist with any installation woes!

If I was doing this i would probably use DFS with FSMT or Robocopy. But I would also suggest doing this during a holiday of some kind, makes everything much simpler!

1. Since Mountain Lion, I no longer have any binding/rebinding issues in my .local domain 2. This is probably due to mounting AD home folders and indexing them on the fly, especially mobile accounts, not having a .local domain suffix 3. Same as 2. 4. Again, no issues with this whatsoever 5. Can't really comment on this as we don't use these technologies at present I think alot of these issues may not be exclusively linked to the .local domain suffix, but a number of factors with the entire installation, although I am only running ~60 AD bound macs. I realise .local suffix can have an impact on Bonjour and mDNS, but alot of these problems were fixed with OSX updates and various workarounds server-side. Given the opportunity I would probably move away from .local to alleviate any future problems, but your list of problems can be fixed. Just my 2p

I found myself in a similar situation recently when attempting to improve the resilience of our SAN before some serious P2V. I was considering RAID-6, to improve redundancy, but after alot of research it still seems like RAID-5 is a viable solution. It has it's supposed problems, but in 12 years of the job, i've never had a single issue with RAID-5, i've had drive failures, but rebuilds have always been flawless. Keep your drives as similar as possible, drive firmware and controller firmware up to date and a solid backup solution and the choice of RAID strategy becomes much simpler.

I'm not really sure on budget, but something I have been looking at recently is Citrix VDI with XenServer and VDI-in-a-box. I have it running bare bones on a few old poweredge 2900's for lab purposes. VM's are dynamically provisioned on-demand from a sysprepped template, joined to the domain and destroyed/replaced at logout. Not sure if this helps at all, but thought i'd provide another angle of attack!

This is what i'm getting at, if both of his RAID-1 drives have failed, he has lost all data in that container, so yes OS reinstall will be necessary, or restore from backup.

Sorry i'm a little late to the party, but if both of your mirrored drives are failed, that container is surely destroyed? RAID-1 can only sustain a single drive failure.

I was looking at cisco acs, which seems to offer the functionality I might need. but seems overkill/complex!

The users will be restricted, but i'm concerned that isn't enough. I would prefer hardware security in form of a firewall/acl between the computers in question and the main network when in use by guests. Basically the same as captive portal, but wired.

This is where my problem lies... I have a computer room that is ordinarily used by teachers/students, which my organisation now wants to hire out for public use. How do I dynamically manage vlan assignment for these computers so they are secure when the public use them, but have network access when teachers/students want to use them?

Yep, we have a similar setup, but how do you deal with hiring out a room of computers, that ordinarily would be used by staff/students? They are not bringing their own devices...

Hi everyone, I am anticipating a request to allow our organisation to provide computer suites for public/guest access and was wondering if anyone had any input on how they would manage this from a network security point of view? I have a public access wifi network which has a seperate VLAN and is firewalled from the rest of the corporate network, but I believe this wouldn't be possible with a wired network that would be shared by guests/public/employees? Any suggestions on a solution to this? I am worried about zero-day vulnerabilities and tools which could easily circumvent software based security, as opposed to effectively having a physically seperate network, which isn't possible in my situation.

Profiles are downloaded from the server and stored locally during logon, then uploaded back to the server during logoff. It's just a temporary storage area for the roaming profile, which will be deleted during logoff if your forcing deletion of locally cached roaming profiles with a GPO?

Can I go ever so slightly off-topic and ask about VAMT... ive installed a KMS key on my server, and VAMT, I am in the process of converting all my MAK activated clients to KMS. When I goto the "install product key" option on a number of highlighted clients, it asks me what key do I want to install. Do I select the option to "Install a KMS client key" or do I enter my KMS key in VAMT and then choose the option to select a product key to install and use that? Whats the difference?

I'm not sure about it being mandatory, although your LA would usually have a policy that if you are connected to their network, you have rules to follow as a responsible party. Encryption of data that is leaving your system I would say is definately classified as "best practice", my point of view is, if one of my staff takes a laptop offsite, with sensitive information on it, leaves it in the back of their car and it is stolen... How long before that data either ends up in the wrong hands or in the public domain? It is your responsibility as a network administrator to ensure safe and secure storage of data. If you hold student/parent contact information in your MIS, and that is portable, it must be protected, surely? This is just my opinion, i'm not sure about what each LA or the law requires? It is too easy to reset the user/password registry hive in Windows 7 with UBCD for example, and gain complete control of the device and the data it holds, encryption prevents that.

Sorry, i don't mean that there is anything wrong with that method of access, I just mean, just by providing that solution, you are not enforcing them to ONLY use that, they still have an option of carrying around unencrypted devices and storing data on them. I think the best solution would be to provide VPN, but also have access control on stored data, so that it cannot be transferred to external devices unless either the data or the device is encrypted. This is a policy option with Sophos, for example. Paperwork in place or not, people will still do things they are asked not to, so data control is necessary.

That's not really a bulletproof solution, and wouldn't be a credible workaround to the ICO, as you are not enforcing a policy of no mobile data unless it is encrypted.

Just to clarify, an exceprt from the TruCrypt FAQ on the rescue disk: "Note that even if you lose your TrueCrypt Rescue Disk and an attacker finds it, he or she will not be able to decrypt the system partition or drive without the correct password." The rescue disk simply provides access to the boot loader for your encrypted volume, in case it becomes corrupted on the drive itself, the password is still required to gain access

I was under the impression the recovery CD is only used to unlock the encrypted drive in the event of hardware failure and needing to slave the drive to recover the data, but the password is still required?

I use DSADD and DSMOD for batch scripting user creation and modification, this would allow you to generate a csv list of users with preferred unique passwords and then export to a batch file and execute? sample DSMOD: dsmod user "cn=Joe Bloggs, ou=13, ou=Students, ou=All Users, dc=domain, dc=local" -fax 1234 sample DSADD: dsadd user "cn=Joe Bloggs, ou=13, ou=Students, ou=All Users, dc=domain, dc=local" -samid 13bloggsj -fn Joe -ln Bloggs -display "Joe Bloggs" -upn [email protected] -email [email protected] -fax 1234 -pwd changeme I have all of this in an excel sheet using concatenate functions paired with data extracted from my MIS to generate the required info.

I don't really have the option of retiring TMG, it's only been in a year and as far as i'm concerned, learning new firewalls is one of the toughest tasks! I saw a recommendation for Citrix NetScaler as a TMG replacement yesterday... not sure on that one

What are you replacing TMG with?

I've been using TMG for almost a year now, yes I had some serious headaches with setup and maintenance for the first 3 months, but after everything is nailed down, its a great piece of kit with some very high level diagnostics/logging capabilities. Back on-topic, take a look at your flood mitigation settings (or equivalent) on your firewall and create an exception for your DC(s) so that they don't trigger a DoS when you have a spike in activity.

Finally some responses on my wavelength!

+1 exactly