cyr0n_k0r

I'd like to revisit this post after another year of having the Sophos product. We have now had the Sophos product for almost 2 full years and my opinions on this product have not changed at all. I'll address randomguy's post since he seems to offer the most complete point by point of my original post. Incorrect. Support with SSH access still cannot see realtime. I have been told by support that there is a cron job that runs only every few minutes that flushes the logs to disk and it's only then that support can tail the logs to see the traffic. Because I have servers and other devices on my network that don't play well with a 3rd party device interfering with their traffic flow. This was especially a problem with our food service contractors time clocks. The time clocks go out on the internet every night and upload the employee punches to some database in Europe. Our food service employees almost missed payroll one pay period trying to figure out this stupid issue because of the Sophos filter. Yes, I know all about disabling the patience page. what you fail to mention however is that with the patience page disabled, when a user tries to download a 100mb file and they click "download" on the web page NOTHING HAPPENS. That is because the appliance is downloading the file without telling the user what its doing. In other words, the user thinks they accidentally didn't click the link and keep trying. Eventually giving up thinking the download link is broken which is another ticket to my helpdesk. This isn't for our own internal SSL's. It's for out on the internet. However I will admit that turning off this feature has not severely impacted our environment as much as I thought it would last year. See my next response below: This entire answer shows you have no idea what you're talking about. If you don't understand the difference between a Megabyte (MB) and a Gigabyte (GB) then you don't understand the system. Unless variables have been added in any recent version that I'm unaware of HTML pages still cannot contain Sophos variables as of 11/6/2013. Security through obscurity is a foundational security practice and once again you're showing you have no idea what you're talking about. I agree. We have since added over 500 GB (Gigabytes) to the virtual appliance and logging issues are no longer an issue. See comment above about how you don't understand the difference between a MB and GB. After everything is said and done we rebuilt our virtual appliance about 6 months ago and moved it over to a new ESX host with dual octacores and gave the appliance 16GB of ram and a 500GB virtual hard drive partition. Performance is much snappier now, however I stand by my previous statements. As of 11/6/2013 you STILL cannot 1) disable the appliance from scanning downloaded files 2) use variables in non branded block pages 3) support is STILL AWFUL. Every single time we call we sit on hold for 30-40 minutes and every single time we are told "we're having unusually high call volume" It's non unusually high if its every single time. Hire some more people!

We are using the virtual appliance. Hardware and concurrent connections makes no difference. Our "appliance" has available to it dual quad cores with 8GB of ram and 120GB for the HD that I gave the VM. It is the only VM on the physical host. It is more than capable of running an entire district (5 schools). Slowness issues aside, there are still serious faults with this product. Go try and run a real time traffic report (m86 and websense can do this) Try and remove the sophos branding from the block pages Try and turn off scanning downloaded files Try and get the appliance to ignore traffic completely (not just allow categories, but actually ignore traffic) It can't do any of those things.

We purchased the Sophos Web Filter about 8 months ago. We moved to Sophos because we previously had M86 and it was a nightmare. It was so bad we pulled the product out after only 6 months and demanded our money back from M86. From what I've heard they were purchased by another company a while back so I don't know if their product has gotten any better. I highly doubt it considering how bad it was before. We also used to have Websense (a very old version) and we would have liked to keep it but we couldn't afford it. I recently came across this raving review on edugeek about the Sophos filter : [Review] : Sophos Web Appliance and I feel that people should know the issues we have faced with this product Logging is not real time. There is a delay of several minutes before you are able to see traffic in the web gui for troubleshooting. This is also true for Sophos support on the backend when they SSH into the appliance. You sit on the phone with them for several minutes every time you want to test a workstations traffic. There is no way to bypass traffic being scanned by this appliance. You can allow any/all categories, but there are several that Sophos does not allow you to "allow" thus you are never actually allowing ALL traffic through the filter. There is no way to turn off scanning on files that are downloaded. For files that are larger than about 10MB sophos displays this awful "download" page then makes you sit there while it "scans" the file. Then once its finished you have to download the file AGAIN from the appliance. You are effectively clicking download for the file twice every single time. The filter cannot unblock self signed certificates. Sophos' default behavior is to block self signed certs and there is no way to change this. We have had to completely disable HTTPS scanning on the filter. Loading configuration pages takes 10+ seconds for every page. Nothing is snappy in this GUI. Running reports takes between 30-45 seconds every single time you run a report. Doesn't matter if it's big or small. We have had to reduce our reporting down to only keeping the most recent 3 months because the filter fills up it's hard drive. *Sophos' tech supports solution to this is to just keep increasing the hard drive space for the appliance. The block pages cannot be customized to remove the Sophos logo and branding. You can use a custom HTML page but if you do you lose the ability to use variables like username, ip of the machine, category being blocked, etc. If you use the sophos block page the XML cannot be modified to remove the sophos logo and copyright branding. Sophos does not consider security through obscurity a sound best practice. Customer support is terrible. We had the filter stop passing traffic 3 days ago which caused our entire district internet to be unavailable. After 3 calls sitting on hold a combined 52 minutes we were finally able to get through to a technician. The technician blamed the fact the appliances hard drive had filled up with reports on it no longer passing traffic. Sophos apparently has no way to prune old logs if the HD becomes full so as to not completely break the appliance. When calling support (7 times in the past 2 months) for various issues with the filter I have not once every had them say the problem was actually with the filter. They will blame everything else other than their product. They have blamed our network, our firewall, our internet connection, our Hard Drive space, etc. Everything except their product. Because of the inability to ignore self signed certs we had an issue last month with the filter that it stopped allowing Microsoft Windows Activations because of some hiccup with the web filter not liking the way a Microsoft certificate on their activation servers was signed. This caused severe delays in our imaging project for a deployment of 500 laptops. It took Sophos 3 weeks to figure out a solution. Their solution? Add every single MS activation domain to the ignore list. *Screenshot attached I should point out that Sophos has ZERO plans to address any of the issues above. I have brought every single one of them to their attention and I have been blown off. Just hope anyone who sees this will understand that this product is not all that its cracked up to be. Screenshot of our ignore list after Sophos took 3 weeks to try and figure out why we couldn't activate windows.

Call Sophos? 9.7 is kinda old. Why haven't you upgraded to 10.1 yet?

Or just implement the registry changes mentioned in this blog post. Enable SSO for RemoteApp in XP : layer2edu Works with XP SP3, Don't need any CA to sign anything.

This is actually not the whole answer. For anyone having this same problem here is the actual fix. epoch was sort of in the right place, but the answer is only 50% right. You need to check the "mixer" checkbox, but you also need to make sure that "normalize matrix" is NOT checked. And because I don't like GUI solutions and I prefer to fix things inside the registry here are the key changes necessary to apply the fix via the registry. FYI, if you apply this fix via the local machine key it will only fix it for users that have not logged in yet. If you want to fix it for people that have already logged in you will need to apply the key changes to the same path but replace local machine with HKEY_USERS\profileGUID

We are currently evaluating the X130e. It seems nice but I'd really like to hear if anyone else has these units and how they have withstood being in students hands. The lenovo people can "demonstrate" ruggedness all day long, but I'd like to hear actual stories from people that have given these out to students or teachers. Have they withstood being dropped and man handled by kids well?

I'd like to hear how you handle this kind of setup for mobile workstations. Teachers and students that would take a laptop home. Also, what if they don't have an internet connection at home. How would they still be able to work at home with Word, Excel, etc.

Step-by-Step Guide to Bulk Import and Export to Active Directory

I'm actually impressed you are using MSTSC instead of explorer. Can you explain or link to a guide on how you accomplished this? What kind of shells are you looking for? What problem are you trying to solve, or what is MSTSC not giving you that you need?

best practice is to set profile folders as Full Control with the user also being set as the owner. Userfiles folders should be set to Modify with the user also being set as the owner. Active Directory attempts to make userfile folders full control when allowing the ADUC to create the folder but this is not recommended. I can't find it right now, but I swear I remember reading something from Microsoft that said userfiles should not be full control, only modify.

We have our students use our VPN as well. We run the Cisco VPN client and have an ASA. We use IPSec so there was not any additional licensing. We have not had any problems with students and they enjoy being able to work on files on their shared drive while at home.

I'm asking for the option for users who dont find it useful to be able to turn it on in their personal control panel. It's a simple checkbox in the admin panel. It would not change the existing config.

any word on this? It is a checkbox in the admin panel. I can show you where if need be. I've run vbulletin sites before.

which OS are you trying to deploy this to? We deploy scheduled tasks just fine using XP. I'll post my code tomorrow morning with our settings. it works awesome.

I use AutoIt for my silent install, but here is the code just in case anyone wants it. #NoTrayIcon ; TuxPaint with Stamps Installer ; v 0.9.21c $installdir = @ScriptDir & "\library" ; Check if installed If FileExists(@ProgramFilesDir & "\TuxPaint\tuxpaint.exe") Then Exit Else _Install() EndIf Func _Install() ; Run install DirMove($installdir & "\TuxPaint", @ProgramFilesDir & "\TuxPaint", 1) ; install tuxpaint Sleep(5000) DirMove($installdir & "\Stamps\TuxPaint", @ProgramFilesDir & "\TuxPaint", 1) ; install stamps ; Run registry fixes ; Run cleanup tasks DirCreate(@ProgramsCommonDir & "\TuxPaint") FileCreateShortcut(@ProgramFilesDir & "\TuxPaint\tuxpaint.exe", @ProgramsCommonDir & "\TuxPaint\TuxPaint.lnk", @ProgramFilesDir & "\TuxPaint") $sFile = FileOpen(@ProgramFilesDir & "\TuxPaint\tuxpaint.cfg", 1) FileWriteLine($sFile, "fullscreen=yes") ; set tuxpaint to run fullscreen FileClose($sFile) ; Finished ToolTip("Installation Complete", 2000, 2000, "TuxPaint", 1, 4) Sleep(5000) ; display tooltip for x seconds ToolTip("") ; clears tooltip if script continues EndFunc ;==> _Install EDIT: I can create an MSI though if there is enough demand.

Americans do not read dates with the day first. IE 14-11-11 Please allow the option for users to change the date format to their preferred countries standards.

When we migrated from Groupwise to Exchange we had to re-activate the blackberries. Which means a security wipe

Please at the very least allow users the option to turn off thread preview. If you don't know what it is, it is the option that when you hover your mouse over a thread it displays the first few sentences in the "alt" text. It is very annoying. Some forums turn it off, while others at least all the users the option to disable it on a case by case. Can you please allow users to turn this "feature" on or off. Thank you.

I am wanting to setup a shared calendar for our users. The calendar is for a "Training" schedule. In the old exchange 2003 I would create a public folder and do things that way.. but I've heard that public folders aren't really the best way to do this kind of stuff in exchange 2010 now. What is everyone else doing for calendars that need to be shared with lots of users? I don't necessarily need the ability for lots of people to make changes to the calendar.. maybe only 1 or 2 people.. but I need lots of people to be able to see the calendar. Normally I would setup a resource "room" mailbox but I don't need a full blown mailbox.. just a calendar.

I'm not sure how your teachers use their desks, but ours always have loads of papers, and piles of other misc junk. There is not room for external speakers and the like. We are looking for a ceiling or wall mounted professional solution. We are NOT interested in using the phones.

Paging from the phones is not ideal. They have horrible speakers and can not be heard throughout the classroom. We need an actual paging/intercom system.

Morning everyone. Looking to re-visit this thread. We have decided we are interested in trying to move to a VoIP based intercom system. We would already have Cisco IP phones in the classrooms, so we won't need talkback. We are looking for a speaker that can ideally use Cat5e cabling as the speaker wire and supports PoE for any amplificiation needed. Again the big names I know of are Bogen, Dukane and Rauland. But I'm sure there are other companies out there that are doing this. And it seems this entire website everyone on here is based in Europe (not sure why that is) but I am hoping some Americans can chime in and let me know if they have had any success in getting VoIP based intercom systems e-rated. I am hearing different stories about the rules surrounding it.

Currently we are using analog RF distribution equipment with VCR's, modulators, combiners, and coax amplifiers. I want to move to a digital distribution system. Who has digital distribution systems and what are you using? The cheapest route in my mind would be to setup a windows media server, and link to digital content through a portal similar to sharepoint. Then they can just stream it to their projector. (I want to get the old analog TV's out of the rooms since we are moving towards a 100% projector standard)

I've been talking with our A/V vendor and they have said the Bogen Quantum product is great. It can use our existing speakers and wire, the only thing we have to replace is the amps and such at the head end. It's web based zones and scheduleing and can integrate with our Cisco voIP. Does anyone have this system?