Scorpio

Hi Yes, dont forget you wont be able to rename the local profile if you have just logged off from that user, as it locks it, unless you have UPHclean installed. you will need to reboot and then do it via UNC to the machine c$ share or locally at the workstation.

Hi Try deleteing the CSC folder and let it re-create.

Hi I would rename the local profile on the pc and let the roaming one download again, if this still fails rename both local and roaming and let it create a new one to see if that fixes it, if it does, then you can merge the items from the old profile into the new one.

Also in Vista it doesnt lick you double click it only lets you right click and open, and then asks you for the cert and password. You can drag and drop fine without any prompts. I just need to clarify with people if this is standard? Ie the vista Rightclick and Open and also the prompting for passwords when opening directly from the webdav folders. Cheers

Hiya We dont use it through IE just via a Network Place... Using the webclient. Cheers

Guys and Gals We have setup Webdav so staff can get their home drives from home, We have set it up using SSL Comms and also using Client Certificates, to form 2 factor authenticiation for extra security. This works fine we can connect to the webdav folder using the pre setup network place link, but everything the user opens a file directly from the webdav folder they are prompted again for their client certificate and the username / password. Is this by design or is there a way around this? If they copy off the file to the local pc and edit then copy back all is fine. We have installed the XP KB892211 which improve some problems we had, we have tried putting in the port 443 and the # at the end off the webdav location path. We are using Basic auth over SSL which should be ok as its secure and in SSL mode Basic auth is used as standard as far as im aware. Does anyone else have these issues, and how do you implement you WEBDAV folders it would be nice to here, also mapping drives to them what the best way of doing this ? Do you guys point the webdav straight to the folders you want, and leave the NTFS permissions intact ? Any pointers would be great Cheers

With sophos you have to select ON WRITE in the policy as well, the stops the Virus on Write and not after its dropped on the machine when its being read. The option your on about is "automatically clean up items that contain virus's/spyware" Both of these are not on as default.

Use group policy to disable Autorun network wide, thius will provent these Autorun virus's from spreading, and then you can nail them, if you have a tricky one, use the program Unlocker to remove locked files if in use.

Done more testeing on this and indeed my cert works, as if it isnt install on the cleinet the MSI fails, if i reinstall the cert the MSI goes on but still asks for the admin password as a standard user and and as an administrator it goes through the wizard to add new hardware, which doesnt look like the merge module is working. Ive changed the flag to 4 as its now a signed driver in reality, and still the same. Can anyone give me any pointers. Cheers Scorps

Guys and Gals Been at this for a few days tested and what not, got the signed drivers working a treat no problems, normal users can log on and put in the hardware and it installs without the "you must be a member of the administrator group to install hardware" Now onto unsigned drivers, ive used the microsoft tools inftocat and created a .cat file for the drivers, used the MakeCert tool to create a cert and attach it to the CAT file, ammended the inf to point this CAT File, built the MSI merged the DIFXapp module, added the MsiDriverPackages line with flags set to 8 for legacy install. Then tested this MSI on my pc, it installed all the way and says are you sure you want to install this untrusted etc so i know the MSI works. Exported the CER file from the CAT and put this in the GPO Trusted Root Certification Authorities, so it installs to all machines. Therefore this should allow the driver to think its signed and therefore act in the same way as a MS signed Driver no ? It seems to install ok, ie the drivers install, no MSI errors, there cert is in the Trusted Root on the local machine Am i missing something out out as it still pops up the message as a standard user "you must be a member of the administrator group to install hardware" Can anyone guid me in the right way or give how they have done it successfully. Cheers Scorpio

Thanks for the replies So i install Winstall LE on a PC do a Snapshot, then plug in the device and let it install correctly, then proceed to plug in all the ports and then once done do another snapshot and export to MSI and then distribute using GPO?

Get the HP ML110 G5 add some more disks in mirrored RAID mode and a bit more ram you could get a great little server for less that 300. We use them for alot of small schools they are great little servers.

Guys and Gals Ive searched the whole forum and while there are many topics on this subject there is not straight answers. Basically we have some new USB Cameras and other usb hardware to install on 100+ machines, and in the past we have installed them when we have done a new build, where we plug in the device in all the USB ports possible and install the drivers in the image so there are there as a standard USER. But this is not an options at the moment and they want the devices working ASAP, it just asks for the admin password, ive had a small look into this in the past and its down to the fact that i think it needs to write some values to registry in HKLM, amongst other things. How do you go about doing this ? Cheers

@eean that would be cool but we are not on R2 of windows 2003 so pushing printers out is not an option.

Trouble is if the allow or dissallow policy has already applied it doesnt work, you have to enable offline files for the cache to be formatted, then wait for all the machines to be rebooted at least once then enter the formatecache key then turn off offline files again. You still get the sync manager otherwise on logoff My method is easiest i think, turn off all offline files completley this turns off mobsync.dll so you dont get it on logoff, regardless of if there is files synced or not, then use a shutdown script to del CSC, and its gone.

Hi Chris That doesnt work unless you have the policy Allow on disallow the use of offline files turned on. We wanter to clear the cach and disable offline files, trouble is if offline files are off when you enter the format database key, it doesnt do anything, as the mobsync.dll must be disabled completely so can format the cache.

Just to follow up incase anyone else needs info, we used the Winexit screensaver to log off after 30 mins of inactivity, which we controlled by the following GPO: CLASS USER CATEGORY !!AdditionalSettings CATEGORY !!Desktop CATEGORY !!WinExitScr KEYNAME "Control Panel\Screen Saver.Logoff" POLICY !!ForceLogoff VALUENAME ForceLogoff VALUEON "1" VALUEOFF "0" END POLICY POLICY !!CountDownTimer PART !!WarningTime TEXT END PART PART " " NUMERIC TXTCONVERT REQUIRED MIN 0 MAX 900 SPIN 60 VALUENAME CountDownTimer DEFAULT "300" END PART END POLICY POLICY !!DialogMessage PART !!Message TEXT END PART PART " " EDITTEXT DEFAULT !!DefaultMessage VALUENAME DialogMessage END PART END POLICY END CATEGORY ; !!WinExitScr END CATEGORY ; !!Desktop END CATEGORY ; !!AdditionalSettings [strings] Desktop=Desktop AdditionalSettings=Additional settings WinExitScr=Settings for WinExit screen saver ForceLogoff=Force running applications to close CountDownTimer=Warn before logoff WarningTime=Seconds to warn before logoff: DialogMessage=Display message before logoff Message=Message: DefaultMessage=You will be logged off. Press cancel to abort. Then we turned off Hibernation and Standby and used shutdownertron, works great!

Just to add back on this to help anyone else out, we used a shutdown script to delete the CSC Folder and it works a treat, if you renable the offline files policy it recreates it.

The quotes around the domain name worked, thanks Also had to create a bit more on the script to delete a reg entry as there was a ghost printer that this script wouldnt get rid of. Thanks again PS didnt need to do the CAPS on the Year 1 etc

Tried that it doesnt work, it doesnt give and error but doesnt select the correct default (like its not picking up what group the user is in) Heres what i ammended it to: 'Variables Set objSysInfo = CreateObject("ADSystemInfo") strName = objSysInfo.ComputerName arrComputerName = Split(strName, ",") arrOU = Split(arrComputerName(1), "=") strComputerOU = arrOU(1) Set objNetwork = CreateObject("WScript.Network") Set objPrinters = objNetwork.EnumPrinterConnections strUser = objNetwork.UserName strDomain = SPRINGGROVE 'Remove all the Network Printers from the Machine For i = 0 to objPrinters.Count - 1 Step 2 On Error Resume Next if Left(objPrinters.Item(i), 3) <> "lpt" And Left(objPrinters.Item(i), 3) <> "usb" then objNetwork.RemovePrinterConnection objPrinters.Item(i+1), true, true else Echo "No network printers found" end if Next 'Map Global Printers objNetwork.AddWindowsPrinterConnection "\\Spring-svr01\CopierColour" objNetwork.AddWindowsPrinterConnection "\\Spring-svr01\CopierMono" objNetwork.AddWindowsPrinterConnection "\\Spring-svr01\ICTSuite" objNetwork.AddWindowsPrinterConnection "\\Spring-iwb01\Year1" objNetwork.AddWindowsPrinterConnection "\\Spring-iwb02\Year2" objNetwork.AddWindowsPrinterConnection "\\Spring-iwb03\Year3" objNetwork.AddWindowsPrinterConnection "\\Spring-iwb04\Year4" objNetwork.AddWindowsPrinterConnection "\\Spring-iwb05\Year5" objNetwork.AddWindowsPrinterConnection "\\Spring-iwb06\Year6" objNetwork.AddWindowsPrinterConnection "\\Spring-iwb07\EYUClass" objNetwork.AddWindowsPrinterConnection "\\Spring-eyu02\EYUPlay" 'Map Printers Based on Group (Use Actual Printer name for local Printers) (Move below OU Section if you want to apply group defaults after) Set objGroups = GetObject("WinNT://"& strDomain & "/" & strUser & ",user") For Each objGroups In objGroups.Groups Select Case objGroups.Name Case "Year 1" objNetwork.AddWindowsPrinterConnection "\\Spring-iwb01\Year1" objNetwork.SetDefaultPrinter "\\Spring-iwb01\Year1" Case "Year 2" objNetwork.AddWindowsPrinterConnection "\\Spring-iwb02\Year2" objNetwork.SetDefaultPrinter "\\Spring-iwb02\Year2" Case "Year 3" objNetwork.AddWindowsPrinterConnection "\\Spring-iwb03\Year3" objNetwork.SetDefaultPrinter "\\Spring-iwb03\Year3" End Select Next 'Map Printers based on OU (Use Actual Printer name for local Printers) Select Case strComputerOU Case "EYU Class" objNetwork.AddWindowsPrinterConnection "EYU Class" objNetwork.SetDefaultPrinter "EYU Class" objNetwork.SetDefaultPrinter "\\Spring-iwb07\EYUClass" Case "EYU Play" objNetwork.AddWindowsPrinterConnection "EYU Play" objNetwork.SetDefaultPrinter "EYU Play" objNetwork.SetDefaultPrinter "\\Spring-eyu02\EYUPlay" Case "ICT Suite" objNetwork.AddWindowsPrinterConnection "\\Spring-svr01\ICTSuite" objNetwork.SetDefaultPrinter "\\Spring-svr01\ICTSuite" Case "Library" objNetwork.AddWindowsPrinterConnection "\\Spring-svr01\ICTSuite" objNetwork.SetDefaultPrinter "\\Spring-svr01\ICTSuite" End Select

Guys and Gals, I have a scripty that maps printers based on Computer OU or User Group, but the User group Mapping isnt working, it just makes the first in the If list the default, can someone have a look over as im not a scrip genius and just cut and shut scripts together. As i say the OU bit works great but cannot get the Bt group bit to default a printer based on Groups called year 1, Year 2 etc Thanks 'Variables Set objSysInfo = CreateObject("ADSystemInfo") strName = objSysInfo.ComputerName arrComputerName = Split(strName, ",") arrOU = Split(arrComputerName(1), "=") strComputerOU = arrOU(1) Set objNetwork = CreateObject("WScript.Network") Set objPrinters = objNetwork.EnumPrinterConnections strUser = objNetwork.UserName strDomain = SPRINGGROVE 'Remove all the Network Printers from the Machine For i = 0 to objPrinters.Count - 1 Step 2 On Error Resume Next if Left(objPrinters.Item(i), 3) <> "lpt" And Left(objPrinters.Item(i), 3) <> "usb" then objNetwork.RemovePrinterConnection objPrinters.Item(i+1), true, true else Echo "No network printers found" end if Next 'Map Global Printers objNetwork.AddWindowsPrinterConnection "\\Spring-svr01\CopierColour" objNetwork.AddWindowsPrinterConnection "\\Spring-svr01\CopierMono" objNetwork.AddWindowsPrinterConnection "\\Spring-svr01\ICTSuite" objNetwork.AddWindowsPrinterConnection "\\Spring-iwb01\Year1" objNetwork.AddWindowsPrinterConnection "\\Spring-iwb02\Year2" objNetwork.AddWindowsPrinterConnection "\\Spring-iwb03\Year3" objNetwork.AddWindowsPrinterConnection "\\Spring-iwb04\Year4" objNetwork.AddWindowsPrinterConnection "\\Spring-iwb05\Year5" objNetwork.AddWindowsPrinterConnection "\\Spring-iwb06\Year6" objNetwork.AddWindowsPrinterConnection "\\Spring-iwb07\EYUClass" objNetwork.AddWindowsPrinterConnection "\\Spring-eyu02\EYUPlay" 'Map Printers Based on Group (Use Actual Printer name for local Printers) (Move below OU Section if you want to apply group defaults after) Set objGroups = GetObject("WinNT://"& strDomain & "/" & strUser & ",user") For Each objGroups In objGroups.Groups If objGroups.Name = "Year 1" Then objNetwork.AddWindowsPrinterConnection "\\Spring-iwb01\Year1" objNetwork.SetDefaultPrinter "\\Spring-iwb01\Year1" ElseIf objGroups.Name = "Year 2" Then objNetwork.AddWindowsPrinterConnection "\\Spring-iwb02\Year2" objNetwork.SetDefaultPrinter "\\Spring-iwb02\Year2" ElseIf objGroups.Name = "Year 3" Then objNetwork.AddWindowsPrinterConnection "\\Spring-iwb03\Year3" objNetwork.SetDefaultPrinter "\\Spring-iwb03\Year3" ElseIf objGroups.Name = "Year 4" Then objNetwork.AddWindowsPrinterConnection "\\Spring-iwb04\Year4" objNetwork.SetDefaultPrinter "\\Spring-iwb04\Year4" ElseIf objGroups.Name = "Year 5" Then objNetwork.AddWindowsPrinterConnection "\\Spring-iwb05\Year5" objNetwork.SetDefaultPrinter "\\Spring-iwb05\Year5" ElseIf objGroups.Name = "Year 6" Then objNetwork.AddWindowsPrinterConnection "\\Spring-iwb06\Year6" objNetwork.SetDefaultPrinter "\\Spring-iwb06\Year6" End If Next 'Map Printers based on OU (Use Actual Printer name for local Printers) Select Case strComputerOU Case "EYU Class" objNetwork.AddWindowsPrinterConnection "EYU Class" objNetwork.SetDefaultPrinter "EYU Class" objNetwork.SetDefaultPrinter "\\Spring-iwb07\EYUClass" Case "EYU Play" objNetwork.AddWindowsPrinterConnection "EYU Play" objNetwork.SetDefaultPrinter "EYU Play" objNetwork.SetDefaultPrinter "\\Spring-eyu02\EYUPlay" Case "ICT Suite" objNetwork.AddWindowsPrinterConnection "\\Spring-svr01\ICTSuite" objNetwork.SetDefaultPrinter "\\Spring-svr01\ICTSuite" Case "Library" objNetwork.AddWindowsPrinterConnection "\\Spring-svr01\ICTSuite" objNetwork.SetDefaultPrinter "\\Spring-svr01\ICTSuite" End Select

Hi Thanks for the reply.... Has anyone else doen it this way, and does the folder regenerate if tuned back on, as we are not located at the school, so ant to have a plan before we go. Cheers S

Hi All We have an issue at one of the schools we manage, the pupils are leaving the laptops logged in, closing the lids and putting them in the trolley, the next day they are being used, pupils are then either faced with a logon box for the user from the previous day or straight in. We have turned off Hibernation and standy on them, and was wondering if we set logon hours along with the policy: Force logoff when logon hours expire Would this work, that way the laptops would just logoff and the preset logon hours. Is there a better solution that would log them off and shut them down as we obviously dont want them running overnight, is thee anything that would shut tem down remotely, as now we have turned off standy and hibernation, they will be online. An pointers to what you do would be great. Cheers

Guys and Gals We have taken over the management of the IT at a school and we have put in a new server, there are 80 or so pcs and laptops, we want to remove offline files from the computers but leave it on for Staff laptops. Thats easy enough we can just disable the offline files using the following GPOs Computer Config > Admin Templates > Network > Offline Files Allow or Disallow use of the Offline Files feature - Disabled Prohibit user configuration of Offline Files - Enabled Synchronise all offline files when logging on - Disabled Synchronise all offline files before logging off - Disabled Remove "Make Available Offline" - Enabled This removes the Sync Manager on logoff, which is what i want, but this leaves all the Cache in c:\windows\csc sometimes there over 20GB in here, doing the CTRL SHIFT trick on each PC isnt an option really. So we decided to do the registry entry as suggested in KB230738 which involves adding the key called FormatDatabase in the netcache key, we did this with a startu script and on reboot it didnt clear the CSC folder, so i did it as a shutdown script this and it didnt work either, the scripts where running as i made it echo, finally i made a GPO ADM file and ran gpupdate /force and you can see the key appear as it should but this didnt work either. SO i turned off the GPO: Allow or Disallow use of the Offline Files feature And then upon reapplying the policy and rebooing it worked it cleared, so great, it seems that the offline files cannot be off to format the cache (UNLESS ANYONE KNOWS DIFFERENTLY, as i cant find anything the back this up), but now the sync manager shows on logoff, and starts to sync all Redirected folders, so i set loopback polices to set the Policy: Do not automatically make redirected folders offline This worked to stop the files syncing but the sync manager still shows briefly, which can be clicked to setup a few things which i don want. Even options for sync on logon and logoff are ticked even though GPOs say not to. What i really want is to clear the cache and disable offline files INCLUDING the sync manager, does any one know how to achieve what i need to do? Cheers S

No, it doesnt work like that, otherwise there wouldnt be tattooed GPOs they would all be Managed GPOs, its a case of finding if it is a key that can be managed ie in the Polices folder, i guess you could trial it and see and sometimes the paths are the same. This one did have a key that can be managed, it could be possibly buried in a ADM somewhere but its knowing what they have called it, so i did my own.