Blue_Cookeh

Has anyone managed to get AD auth working on it yet? I'll have a play, hoping to replace TMG with a CentOS box

Who's missing something here? I'm new to Powershell so if I'm wrong please let me know!

Had to update proxyAddresses today since we use different usernames on premises compared to Office365, used this Powershell on a DC to do it in a particular OU. It gets the user's first and last name from AD then sets their SMTP proxy address. Might be useful to someone. It should all be on one line. get-aduser -searchbase "OU=test,DC=domain-internal,DC=co,DC=uk" -Filter * -Properties ProxyAddresses,GivenName,Surname | foreach {set-aduser -Identity $_.SamAccountName -Add @{ProxyAddresses=“SMTP:”+$_.givenname+”.”+$._surname+”@domain-external.co.uk”}}

Look into using Maintenance Windows on specific device collections. This will force SCCM to push application deployments and updates out to your devices during predefined times (for e.g. I set our wall displays to do maintenance between 1am and 4am once a week, including AV scans etc). I'm fairly new to SCCM too... have you got Windows updates deployed yet? Mind sharing your Automatic Deployment Rules etc? How to Use Maintenance Windows in Configuration Manager

Hi Guys, This is a Folder Redirection issue with both 7 and 8.1... we redirect all our users to \\fserver\UserHomes$, which means docs etc should be \\fserver\UserHomes$\username\Documents. But what I've noticed is across a lot of machines Sync Center is complaining about failed file syncs on the desktop.ini and $RECYCLE.BIN files, both of which it is trying to write to \\fserver\UserHomes$ rather than inside the user's own directory. Does anyone have any ideas on this, or something stupid I've missed? Thanks

Sorry for the bump. Just to let you know, I've ended up not bothering with the BitLocker pre-provisioning in SCCM, rather I deployed MBAM today to a couple of test devices (W8.1, one with TPM and one without) and it seems to have been successful. I'll be looking at rolling this out to our staff soon... a bit overkill for the amount of laptops we have but heyho!

It's the support contract that knocks it out of the park, the hardware cost only seemed to be about 1/10th of the quote.

Not got a specific price range, but I'm willing to be a little generous with these things. At the moment we have Forefront TMG for staff and Squid/Dansguardian for the kids which upstreams to the TMG box. We've got a typical AD environment (2012R2, 7 and 8 clients) with about 75 devices. TMG is finished as far as Microsoft is concerned, Squid+DG has too much overhead (and seems REALLY slow, but could be poor config) and ideally I'd like to condense the two solutions down to one for both user groups. There just doesn't seem to be anything out there for smaller schools with decent IT provision Admittedly our Smoothwall quote is from January 2012, maybe @tom_newton could get in touch for a more up to date one?

Hey guys, I moved a member of staff to our Folder Redirection group around a week ago and now she's getting this error message intermittently when she tried to save. Has anyone seen this before, or got any ideas? She's in an OU alongside the rest of our staff now which are all working fine for FR across Windows 7, 8 and 8.1. When I moved her over I completely rebuilt her Windows profile at the time to actively try and avoid any conflicts. (sorry for small text, it's off an e-mail, the text reads "Windows cannot find '%USERPROFILE%\Downloads\rounding_dp (1).docx'. Make sure you typed the name correctly and try again.".) Many thanks

Hey, How do people deal with web filtering in small primaries? Everywhere I go to seems to be completely out of our price range (looking at your Smoothwall :'( ). I'm looking at either a Hyper-V appliance or something we can install on our own hardware.

Hi guys, We're trying to ditch our ancient phone system and get something a bit more up to date... our requirements are x2 PSTN lines (we're UK based), somewhere in the region of 6 - 10 IP phone extensions, a power failure phone, voicemail for these extensions, and a menu (1 to go to a voicemail box, 2 to go to reception, 3 for IT sort of thing). Bearing this in mind, does anyone have any ideas as to what we should go for? Ideally I want to stay away from a server-based solution like Asterisk, I want the stability of an appliance. I was thinking a Cisco router with CME and necessary modules, but I don't know where to start on the hardware side of it (config is fine) but it seems a bit overkill for our school. Many thanks

This is the first I've heard of this?! I can't imagine our Y1 - 4 classes having individual logons... I suppose I can just bamboozle HMI with some Squid logs...

Have you looked at a wireless solution? Using some gear from Ubiquiti you could actually get better performance than fibre assuming you have line of site. I think you'd be looking at their AirMax range for this sort of thing. UniFi wouldn't be enough, but I think airFiber would be overkill. airMAX | Ubiquiti Networks, Inc.

Thanks, I'll give it a play around in a VM. Our county is our ISP who use E2BN with Protex. We can't match their price since we're on 4 bonded ADSL lines (no access to fibre)... I hate Protex with a passion, maybe it's the county's implementation but we have absolutely no control over white/black lists. The reason I have in house filtering is so I can put everyone on the 'Staff' profile for basic E2BN filtering and do the rest ourselves. The only thing our county provides is ISA 2006, so we can upstream to their proxy.

Hey guys, I'm sure this gets asked a lot but can I get some recommendations on filtering? We're a kinda small primary school (120ish pupils) with a fairly advanced IT infrastructure (compared to other primaries around us) and I'm in the need for some kind of firewalling and URL filtering solution. The problem is they all seem to be over our budget by a fair amount, or free and kinda crappy. Any one sitting on any golden gems? I've had quotes for Sophos and Smoothwall but are far too expensive for our small school. Coupled with this, I'm not particularly interested in a "4 hour pro support" type thing Sophos force upon you (Sophos looked so perfect!). Unfortunatly, MS TMG was perfect but unfortunately we've renewed our EES licensing and thus lost it. I think I'm gonna end up using Dansguardian/Squid and IPTables at this rate... Many thanks

You're correct, to access the MS store you can't use local or domain accounts, you have to use a Microsoft account, it works a bit like iTunes/Apple ID or Google Account/Play Store. We don't allow access to the Windows Store in our primary school. You can disable it via GPO: Disabling the Windows 8 App store | New Signature

Hey guys, Relatively new to SCCM and have a fairly simple question... I have a VBS script I want to run on a number of machines using an SCCM deployment... how would I go about doing this? I understand I need to create a Package, and include the VBS script in the 'source' folder... but how do I go about running this? Do I simply use "cscript xyz.vbs" when creating the program for the Package? If not, how do I go about this? Many thanks

Did you fix this? I seem to recall having this problem when we went from XP to 7 a long time ago, IIRC an update from MLS fixed it.

Hey guys, We have the Sherston Mega Pack and I'm trying to repackage individual apps as MSI installs... all seems well until I try to run a program (in this case, Crystal Rainforest v2), where it moans about not having a CD in... any ideas? The Mega Pack initial "portal" program allows us to install software without this issue (from an exe, but I don't want teachers doing this, I'd rather deploy individually through SCCM rather than a 25GB package). Thanks

AFAIK you cannot use Internet-based management for software deployment unless those machines are domain joined, since the SCCM management point has to be able to authenticate the users to AD.

Hey Guys, Just reinstalled ADSync on a different server after decommissioning a different one it was running on but now got a slight problem... Some users' e-mail addresses are being changed to [email protected] address, rather than our .xxx.sch.uk address it was previously set to. Now, I tried going into the Exchange Admin Console and setting our .sch.uk address as the "default reply-to" address for the users but then we get an error telling us to do it in AD... so I did. In AD I set the user's mail address to their correct one and set the proxyAddresses attribute to "SMTP:[email protected], smtp:[email protected]" but still no go, I forced ADSync to sync. Any ideas?

Hey guys, I'm getting Critical errors in our SCCM monitor for our SUP. Looking in the WCF.log file we're getting the following error: Supported WSUS version found~ $$<01-20-2014 19:45:34.836+00> Attempting connection to WSUS server: vm-sccm.school-domain.co.uk, port: 8530, useSSL: False $$<01-20-2014 19:45:34.899+00> System.Net.WebException: The request failed with HTTP status 403: Forbidden.~~ at Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer(Object[] args)~~ at Microsoft.SystemsManagementServer.WSUS.WSUSServer.ConnectToWSUSServer(String ServerName, Boolean UseSSL, Int32 PortNumber) $$<01-20-2014 19:45:34.961+00> Remote configuration failed on WSUS Server.~ $$<01-20-2014 19:45:35.008+00> Any ideas why we might be getting Forbidden?! Running SCCM 2012R2 on Win 2008R2.

We're on E2BN Protex through our LA and it's the biggest pain in the ass I've had the misfortune to come across, now I don't know if this is because our LA are managing it and not passed anything on to us or what, but the control we have extends to which of their proxy servers we use. In the end I stuck the entire school on the unfiltered proxy and filter everyone in house. Aside from this, all Protex is underneath is Dansguardian and Squid with huge block lists.

Why don't you set a firmware password on them all? (equivalent of a BIOS password, but not removable without changing the EFI hardware). Most thieves try to sell machines but if you can't wipe or domain login to it, they become pretty useless to anyone but your school... and for the tracking to work generally you need to let the thief login via something like a Guest account. I know this doesn't solve your problem, but at least it makes you a pain in the ass for the thieves.

We're using a T410 on Hyper-V 2008R2, have been for a while now and it's been running great. I run a few VMs on ours and I'll be getting another machine for failover soon. We're a small primary school. VMs are: 2012 DC 2008R2 SCCM 2008R2 Forefront TMG CentOS Linux Never had a problem and aside from failover, it's worth it even if it's just for snapshots, quick and easy remote rebuilds and backups. So much simpler to manage than our physical DC. Licensing is quite nice, IIRC if you license the host for 2012 Standard you can run that (as long as you don't install any other roles, only Hyper-V) and 2 virtual instances of the same license for anything else. Might be wrong on that one though...