GeeDee

Run your FTPd on another port? You can usually FTP via a HTTP proxy too - although IEs FTP client sucks for this (well, ok, it just sucks).

iirc (and tbh, i'd rather not be corrected on this - could be pricy! ) that's not the way it works for education. That is correct for some of the MS Volume licensing schemes, but under the education licensing system you don't need to re-license a box that's already licensed with the same product. i.e. A box with an OEM XP Pro license, you should be fine to run XP Pro on as is and in addition; IF you volume license other machines in your school you can also use the volume install media on your OEM licensed boxes (as in the doc I linked to a couple of posts ago). Where the waters are muddied a bit (and what the software licensing houses don't always make very clear) is that the education Windows license prices are actually for upgrades only, so you would need another license (OEM or retail) in order to be able to 'upgrade' to XP under education pricing per box. So if you had machines with Win98 OEM stickers, or XP Home OEM stickers, you could buy education XP Pro licenses on the ~£32 pricing, use the volume media and as a bonus, use the volume media on your XP Pro OEM licensed boxes too. What you couldn't do is build your own machines, or buy machines with no OS license, buy the ~£32 education XP Pro license and run XP Pro. You need something to upgrade from (although Win95 does qualify - keep those old licenses ) That's always been my understanding anyhow. Plus, our old admin network which was a Hampshire CC managed jobbie were all OEM licensed but installed with volume media and no volume licenses were ever purchased. I always thought it rather odd that any VL scheme would require re-buying licenses you'd already paid for via the OEM anyway. :/

No worries. If you want to image OEM pre-activated machines under an OEM license or want to know more; this page might be useful to you.

1: You can't use VLK media unless you are a Microsoft volume licensing customer BUT you can use VLK media on OEM licensed boxes, providing you are a volume license customer. I.E. You don't have to re-buy a volume license for an OEM licensed box to use the volume media, providing you have volume licenses for other (presumabely none OEM /retail licensed boxes). 2: The Dell (and most other OEM) recovery / Windows install CDs use what's called OEM pre-activation. The Dell XP CD will check for a flag in the machines BIOS and if it finds it, won't ask for activation. Same applies for the XP disks of other OEMs who take part in pre-activation. If you use the Dell CD in a none-Dell PC, it wont find the flag it's looking for aks will ask for activation. 3: You can't activate using the OEM COA sticker numbers over the internet. Microsoft switched that off some time ago. You CAN activate the sticker number via a phone activation, just not online. Apparently too many people were stealing COA sticker numbers and using them on other machines or something (the COA numbers were never getting used for most OEM boxes, as they are all pre-activated either using pre-activation or as part of the factory install). Hope that helps.

- More offensive content - Ric_ To answer your question, i'm sure it's possible to write a quick script to do the necessary mass imports for qmail. Have a Google, read the documentation and have a play. That said it's hardly ideal to have to maintain a totally separate user infrastructure for mail when (I assume) you already have Active Directory running as your primary authentication mechanism. Educational licensing for Exchange is really very cheap and mdaemon from alt-n is a very powerful e-mail server that will integrate with AD (for an alternative to exchange). There are also plenty of ways to integrate most of the major *nix mailserver apps with AD via LDAP (or plain old NTLM I guess :/); but it will be a bit of a steep learning curve. Enjoy.

Post removed due to offensive content - Ric_

No, not on XP Home. IIS with XP Pro is also only designed for testing purposes - not live sites. I assume you realise that *nix / Apache isn't going to be all that much help to you for hosting ASP too?

gallery2 should be the only choice really. It's brilliant software. Not only does it integrate with a lot of CMSs 'out of the box' (and has a world of docs for integrating with it something yourself) but it's the best gallery i've seen that "just works". Can literally throw a zip file of 3000 images at if if you want and it'll extract, create thumbnails, create midsize version, add to a gallery. You can then edit, comment, rename, rotate (although it'll auto rotate if the camera supplied the appropiate exif data) and you can set as granular permissions as you want on the gallery, albums (,photos, comments). There's also various plugins that integrate into a Windows shell for quick n easy publishing without even needing to open a web browser if you want.

Sure, and that's the primary reason for deploying vlans in this kind of environment usually - but you really don't need many. Running Windows clients, you could happily shove ~350 - 400 machines in a single vlan, even with 100meg uplinks & clients using el cheapo switches. And you don't need to mix subnet masks (nor should you) just to provide a 'simple' way to select a logical group of machines. The machines can run on a /24 (or whatever), but when you tell your proxy to deny on a /26, only those logical machines will be affected. It's just an easy way to select part of a network. It's actually pretty easy to get your head round, at least at this sort of level. All you need to remember is that a /24 is your typical "home network" block of 255 addresses, using a subnet mask of 255.255.255.0. So 10.10.1.0/24 would be a single network of 10.10.1.0 through 10.10.1.255, using a subnet mask of 255.255.255.0. You then just work from there, so a 10.10.1.0/23 would be 10.10.1.0 through 10.10.2.255 (and 10.10.1.0/25 would be 10.10.1.0 through 10.10.1.127). So, if your network runs on a big network of 10.10.1.0/24, but you tell your proxy to please ban 10.10.1.0/25 - that would be 10.10.1.0 through 10.10.1.127. Likewise, banning 10.10.1.128/25 is the other half of the network. You can of course go deeper, a /30 is a network of 4 machines.

You can assign each room it's own network as part of a larger single subnet without arsing around with a small world of vlans. vlan'ing everything off just creates so much unnecessary load on the switches that have to do all this extra routing. Why not just assign each room a /24 of part of a /16 network (or a /26 as part of a /23 or whatever). You can then do your room blocking by network to get just the same result without all the overhead. Glad you managed to solve it though.

Considering how easy it is to spoof a mac address (they even give you a nice field in the GUI with most driver sets these days) that's hardly going to bring you any security benefit. If ensuring ports aren't swapped is a priority for you, just enable port security.

It might be easier to just read the manual for ffmpeg (or install windows media encoder if wmv is your thing) rather than run code from a site that looks like that.

....The point of this being what exactly? What are you imagining happening in this scenario?

For the purposes of 'making it work'; you probably haven't tagged the vlan on the uplink. Aside from that though, why on earth so many vlans? Seperating by room seems a little more than overkill! You can happily run several hundred machines on a single network even over 100meg uplinks. The only thing you're going to cut down on over all those vlans is broadcast traffic - which really won't be an issue (at least not in the average environment) until you hit ~400 odd machines. Seems like extra overhead on your switches & technician time for no good reason really.

What exactly are you trying to achieve? Unless you have a 'special' setup, you want to configure all the ports for your new vlan as untagged; except for the uplink port(s) which will need to be tagged. The switch at the other end of the uplink will then need the vlan creating & tagging as well as untagged on any other ports with machines in the new vlan on. Then same on any other switches elsewhere. That will create you a 'new' network, across multiple switches - but unless you have either another router or you configure ipforwarding (or whatever HP might call it - assuming your switches are layer3) to forward layer3 traffic you won't be able to talk to anything except your new network. Are you sure you actually want a new VLAN? What's the purpose of it here?

Ok, but that still doesn't answer my question. What exactly is it that the licensing companies are giving to their education customers at the moment?

Ok, not that I have the slightest intention of running Vista for as long as I can possibly hold off (volume activation and insanely ridiculous DRM being 2 of the main reasons, aside from it not being worth the money) - but if software licensing companies have single keys they are issuing to their education customers; what types of key are these? If they're MAK keys, surely there should be seperate keys for each customer - or else it's pretty easy for 1 school to over-use more than they have paid for and knock the activation count down for other schools. If they're not MAK keys then what are they? As I understand it, there's no such thing as a KMS 'key' - if you're a volume licensed customer, you can elect to either use MAK or KMS on a per-machine basis. Surely that leaves only retail / OEM? Have I missed something or has nobody actually thought the whole process through here?

That's correct - it will execute commands in the context of 'you' by default but there's no (authenticated) network access there. Short of copying random scripts out to each local machine however (no thanks) you'll have to specify a username to run said scripts from a network resource and that's what is sent in the clear. You are correct though - I should have qualified.

I use some random command line mute / unmute app I found coupled with a permissions change on sndvol32.exe to deny the 'Students' group access to volume control to un-mute. The result of this is master volume muted and double clicking on the volume control (or running it by hand or whatever) just doesn't do anything. The whole lot is then reversed for 'sound on'. It's all run via a batch file while is psexec'd as part of our home grown remote shutdown / reboot / logoff etc app; with check boxes to select machines to target. Not entirely happy with it tbh, as psexec sends users / passwords in the clear and that's never good practice - and it's reasonably easy to find another way to un-mute the audio (Windows Media player volume options or whatever); but it does work pretty well all the same.

Like these? CPC are great for 'bits' like that. I seem to remember them being a little cheaper when we bought them; but we've had a few sets of those / similar speakers from them in the past.

All the printui method does is change the registry value - and less reliably in my experience (especially if the printer connection has very recently been created). If you want to use that method (on an existing printer) the syntax is: rundll32 printui.dll,PrintUIEntry /y /n\\UNC\path\to\printer Registry hacks generally fit into existing envrionments better though - and it works very reliably.

I don't see your thread on this elsewhere; but if you're just talking about DHCP reservations, then it's ridiculously easy under ISC DHCPD. Lmk if you want a sample config or something, or ignore me if that's not what you mean. Apologies for minor thread hijack.

It's an awful lot easier to just set: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Device That key is what defines the default printer and is a per-user setting (I never got the logic of making printers per-user by default - why would you want your printer to follow you round in any environment?) Log on as yourself, set the default printer, then export that registry value - so you've got the correct syntax. You then just have to set that reg key to the right printer for each machine. We do it here with a .reg file in %windir% that just get silently imported on logon; but there's a million other ways of setting that key on logon.

Absolutely - if the service is poor, you should be complaining - and even louder if it's a none-dsl circuit! My point was simply that there's a lot of 'OMG you get internet at £25 per month and we pay £12k for our 2mb circuit from the LEA' type talk around these boards; and people should know the difference between the different products. If the service from your LEA is dire, then I suppose it's possible xDSL might be the only option for some schools, but personally i'd think long and hard about reccomending that any school drop their LEA service and go it alone with DSL. I'd also make lots of loud noises at whoever is responsible for my LEAs service - but i'm sure you've done that already. Luckily in Hampshire I can't really complain about the service we get. Don't know how other counties compare, but the service is almost entirely managed by the county itself and not a 3rd party company and they do a reasonably good job of it. It's just the physical network they contract out I believe, but individual sites never have to deal with the contractors once the service is live. You get the usual levels of bureaucracy; but that's par for the course with government and they are more than a little paranoid with their firewall policies, but again I can see the logic. Our 10meg circuit generally copes with a high level of throughput throughout the day though and there's almost never downtime. Do a lot of other LEAs farm everything out to private companies then or are they just crap at managing their own services?