karlr

You can configure proxy settings from the command line using the "networksetup" util. E.g. networksetup --setwebproxy Ethernet smoothwall 8080. You could do this from a script as part of your deployment if you use Munki/DeployStudio or similar. For convenience we only set the "setautoproxyurl" setting, which allows us to simply pull a proxy.pac from our smoothwall rather than deploying each individual proxy setting. Still a bit daft that this can't be done from Profile Manager tho

We are looking to fully integrate a set of iMacs into our network, with a user experience that is as smooth as possible. Thus we are seeking feedback from anyone already successfully running OSX clients that behave themselves in a mainly Windows environment. Any knowledge or rundowns on how you have your OSX clients set up would be appreciated. Below is an overview of the set up we have and what we are trying to achieve and the problems we have encountered with doing so. We have a mac server with the latest server components, and both server and clients will be running Yosemite 10.10.4 (or newer). We have profile manager set up and working on the server. The clients are bound to both AD and Open Directory, and the profile deployment seems to work as expect, similarly to group policy (within reason). The bit we are now looking at is how to get the user experience to be consistent and at least attempt to have some familiarity with our Windows desktop experience. The first thing of note is user profiles; where/how should these be stored for OSX? We have attempted the network home directory method, which seems to run the user's profile directly from the network. To some extent this conflicts with our Windows folder redirection - for example we redirect Documents to the root of a user's home directory, whereas OSX would create a Documents subfolder under the root. More worryingly, some of the ACLs that OSX sets (e.g. the ones that prevent "Documents" from being deleted) seem to result in bizarre NTFS permissions being set on the file server, preventing anyone from getting into these folders, whether it be a domain admin or the owner of the home directory (and this is the case on OSX or Windows). With this behaviour I would be tempted to force the profile to be saved to the local hard disk, and simply create a symbolic link (or "alias" ?) for the Documents, Pictures, Music, Desktop folders to appropriate locations on the user's network home directory. This would likely be achieved with a logon script that would remove the protective ACLs from the special folders, and then simply run a ln -s. A benefit of this would be that all of the miscellaneous OSX profile data would not be stored on the network and at worst would persist on individual workstations. A problem I can see with this is if the user saves files directly to their local home folder - at this point they would not be stored on the network and could thus be lost. The second aspect is how to give the user's a consistent experience; On windows we use mandatory profiles (that get erased at log-off on desktop machines) and a set of group policies and logon scripts so the user gets a fresh experience each time they log on. We set the desktop background, push a set of desktop icons, set the contents of the start menu, set the pinned items on taskbar, map appropriate network drives etc. We would like to do something similar for the OSX clients, ideally using profile manager as much as possible to keep things simple. With profile manager it looks like we can mount network shares, so that should be covered. We can also manage the contents of the dock, although we currently push down shortcuts based on group membership and PM doesn't seem to like multiple profiles controlling the dock (one "dock" might overwrite the other etc.). The other major thing we would want to get right is exposing the mounted network shares cleanly to users; creating a dock icon for the shares seems to be a non-started as they are just icons and expose the actual share name (e.g. staff-share$) rather than a friendly name like "Staff Share" or "T: (Staff Share)". The finder seems show network shares on the per server level which is also not very friendly for our users. Another option would be to push down desktop shortcuts, but I do not believe we can do this using profile manager and would thus need to write logon scripts.

Just wondering if anyone has managed to do this or if they know if it is even remotely possible. We would like to allow pupils to use OneDrive to sync files between school and home. At home, the OneDrive configuration will generally be up to them. However at school ideally there should be zero-config required - the client will already be running when they log in to a school computer, they will be logged in to OneDrive automatically (authenticated via Kerberos and ADFS) and files will automatically be syncing up and down to a folder in their home area (let's say a folder called "OneDrive"). Is this even remotely possible?

What happens if you try assigning the license to a user manually? Does $account.licenses return anything? Are you sure your logic for determining whether the user is a staff member or a pupil is working correctly? (e.g. so it's not trying to add both faculty and student licenses). I noticed that your code checked $PupilList when checking both staff and pupils... tho you have of course also obfuscated the school domain etc. so that might not be the case in your actual code.

I think your best bet is to invest in a USB Ethernet adapter. We have a StarTech USB 2.0 Gigabit Ethernet adapter for scenarios like this (it was bought specifically to handle imaging a Dell XPS 13 that simply does not have Ethernet). Note that the USB Ethernet is not perfect however - we were unable to get it to properly PXE into MDT, so we still need to use a USB Stick to boot into MDT (this just contains the LiteTouch ISO, so a 512mb memory stick is sufficient).

The Veeam client executable (Veeam.Backup.Shell.exe) is marked to run as admin via it's manifest file. I imagine this is for good reason and it won't work without admin credentials. Do you happen to have "Veeam Backup Enterprise Manager"? This is a web based console for Veeam that would let one view the status of jobs, and should respect the permissions you have set. Edit: Infact, see http://helpcenter.veeam.com/backup/80/vsphere/required_permissions.html "The account used to start the Veeam Backup & Replication console must have the Local Administrator permissions on the Veeam backup server."

Of course all of the guidance will change when there's a test case (a major child protection issue involving school e-mail). The challenge is making sure that you're not the test case.

E-mail is really the main thing we're concerned about. The best solution for us seems to be to amend our user archiving script to the following: * Reset the pupil's password (Set-MsolUserPassword) * Download all of their e-mails over IMAP (hopefully via a Powershell/.NET compatible library) and store in a location covered by backup * Revoke Office 365 licenses We would at least then have a record of the e-mails on our own storage system and thus under long term backup. However the place where this (and other solutions) seem to fall flat is if a pupil has deleted e-mails. Without spending a considerable amount on Plan 2/archiving licenses it seems there is no way to prevent an e-mail being lost after 14 days when it has been deleted.

Can you also un-link it from AD when you change the license though? Obviously we'd rather have it not be deleted after the 30 days.

That seems like it could be an option.. though of course we'd still be trusting Microsoft to keep the data and it would depend on their generosity when it came to renewal each year. Presumably one can add additional licenses for this at will? I was of the understanding that Microsoft can be a little picky about the number of licenses you sign up for, and will start asking questions if the number of licenses you've asked for doesn't match the numbers you're talking about for volume licensing (e.g. I can't just sign up for 5000 alumni licenses and be done with it). Edit: Another concern is how this works with their Active Directory account. We are currently syncing Office 365 with our Active Directory. When a pupil leaves, their AD account is automatically disabled and moved to an archived OU. Of course it is likely that we will eventually remove these accounts from our production domain (as it will all be on archive tapes).

We are in the process of configuring Office 365 for pupil use (both the apps and Exchange Online). Something that I am concerned about is Microsoft's attitude to data retention - as far as I can tell, a pupil's data and e-mails will be immediately lost the moment the pupil's licenses are revoked. In general use I would expect that we would revoke a pupil's license on or shortly after their leaving date, which essentially means that their e-mail is wiped out on the day they leave. I believe this creates a number of problems for a school. The first being general data retention - as I understand, there are guidelines that suggest keeping pupil data for 7 years. This isn't a problem for us in general as we have a robust backup/archival infrastructure. However, it appears that Office 365 simply doesn't have proper support for exporting/backing up mailboxes (I'm aware that there are a number of hacky workarounds, including some commercial solutions but it all still seems far less than ideal/practical). Following on from data retention is child protection - keeping a long-term record of a pupil's mailbox, even after they have left the school, is arguably an obligation as far as the school's duty of care goes. While there are additional tiers for Exchange Online that would allow some form of archiving/legal hold, the per pupil price point of these tiers just doesn't seem viable compared to hosting Exchange on-premise (which we already do for staff, and back up using Veeam). So, I have two questions for other schools: * What is your general attitude towards pupil data retention? Do you consider it important to keep pupil data for a number of years? * If using a cloud service (especially Office 365), what happens to a pupil's data after they leave the school? If the data is wiped, what happens if a child protection issue is raised that could be related to the pupil's use of school e-mail?

Classic Shell - Start menu and other Windows enhancements Ok, ok. What was wrong with using mklink again? I'm assuming that the start screen is resolving symlinks and thus still refusing to display duplicates. Hard links should be OK though.. They don't actually use any additional disk space, since all links will reference the same bits on the disk. It will just *appear* to be using more space, depending on which application you ask. I think you will double up when it comes to backup/copying over the network however. Is this going in an image? or do you have devices with low disk space (tablets, SSD, etc.)? Assuming the dummy command line arguments idea works (questionable, since apparently two distinct executables in different directories were hidden simply because they have the same name?) you will probably be fine in 95% of cases but there could always be one app that throws an error on invalid arguments. Be careful with things like "-derp" though, as some apps will accept a "-d" and successfully match to "-derp", taking "erp" as the argument (think java's -D).

Do you have "Move the contents of Documents to the new location" enabled for your redirection policies? I have seen cases where this will fail when copying for example "My Music", with an error about security descriptors Anything that is going to affect their first logon experience should be baked into a mandatory profile. You will still be relying on GP for the vast majority of things however. I'm wondering if "User Experience Virtualization" (UE-V) is any good. Roaming profiles may be bad, but not having personal/app settings synced for roaming users also isn't great..

Ideally it would be a full image that you are using in production.. in reality you're probably going to want at *least* your core applications (esp. office). No, don't put any shortcuts/favourites etc into the profile. It should be purely things that can't be easily controlled via GP or will affect first logon. You can push start menu shortcuts down using GPP - the targeting options mean you can configure it to only create a shortcut if that particular piece of software is installed on the computer. I have seen cases where creating shortcuts via GPP can cause slowdown however, mainly because Anti-Virus wants to scan the target of your shortcut (which can be quite bad if it's a network location that you haven't excepted from scanning). An alternative is to use folder redirection (or use GPP to just *copy* a folder full of pre-configured shortcuts).

You won't go too far wrong with Oracle VM VirtualBox, yes. There is also VMWare Player, but technically this is for personal/non-commercial use only.

You'll have fun trying to get the libraries feature to function as you want it as well... not much in the way of group policy for those. Oh well, at least you don't have to configure the Start Screen or anything like that (yet). I think you are going to struggle to get everything tweaked nicely though, without having virtual machines or at least some spare boxes you can rebuild as needed. The whole CopyProfile/sysprep thing being a great example of such a time.

As I have understood it, one of the main motivations for using mandatory profiles as opposed to local profiles (e.g. leaving the profile field blank in AD) is to prevent all of the extra bits and pieces running the first time a user logs onto a machine. These can significantly increase the login time, and of course the user might get nagged about settings things up (or invited to take the Windows Xp tour, etc). Since it appears that your students will be logging in to all of the computers with shared logins, this likely isn't an issue as all of the computers should have a cached profile for each login anyway (assuming you don't clear out profiles on a regular basis). Even with well baked GPOs and everything set up with preferences however, there is still a chance that something could creep into the local profiles; the benefit of mandatory profiles here would be that the registry hive would be restored on each login - you could also zap the cached profiles once a day to try to keep things clean (do mandatory profiles delete files that shouldn't belong at login, or do they just copy down the profile and overwrite as needed?)

@iberium Thanks for that, Remote Utilities seems like a strong option. Only little niggles I have with it right now are the screen blanking/lock remote input can be a little flaky (although this seems to be the case with the majority of remote control apps sadly..). @zag We have given Abtutor 7 a spin and found the remote control to be virtually unusable across Windows Xp/7 desktops - mirror driver doesn't seem to make much differences. This is a bit odd as I have used version 6 at a previous school and gotten on reasonably well with it.. @jbailey Think you're quite right on SysAid.. just overall a bit clunky and some nasty suprises in the invoice if you want to have for example more than one remote support connection at once! (Using little more than a customized UltraVNC of all things) Any OPSmartDesk users out there by the way? If so how are you getting on with it?

Noticed some of you aren't too keen on the asset management/auditing side of Spiceworks. Can I inquire what you don't like about it? I'm reasonably impressed with it myself so far, although this is just running in a small virtual environment so it's only picking a few VMs..

Have any of you guys opened up the portal to end users? If so, how do they seem to be getting on with it? We're currently looking at using Spiceworks as a helpdesk, but the portal side of things doesn't look too great, particularly for staff to view the status of their tickets. Have made some attempts to customise the portal but not sure how much mileage there is going to be in that (I can see future Spiceworks updates breaking everything..): User Portal - Custom Open Tickets/View Ticket Widget - Spiceworks

Any other recommendations for remote support? We have looked at the VNC variants (TightVNC, UltraVNC, RealVNC Enterprise) as well as classroom management software like Impero, ABTutor, NetSupport. Just given "RAdmin" a spin too, but unfortunately none of these seem to deliver quite what we want by themselves. Core features for us would be decent performance (something UltraVNC doesn't seem capable of), proper authentication (not just a single connect password), ability to lockout the remote input, and the ability to blank the remote screen of the client. The latter two seem to be quite difficult to get right, and many implementation fall a bit short (you can get around the lockout using ctrl-alt-del, or the screen blanking doesn't work if also using the mirror driver).

Another big concern is user profiles; We currently use roaming profiles for staff and this leads to an awful lot of problems. No doubt Win 7+ will handle this better, with increased support for redirection etc, but it's still a worry. I'm also not able to find any proper, clear guidance from Microsoft on this. Edit: Actually I did bookmark and plan to read through http://www.grouppolicy.biz/2010/08/best-practice-roaming-profiles-and-folder-redirection-a-k-a-user-virtualization/ - but what are you guys doing in terms of profiles?

@Out_of_Sync see .local - Wikipedia, the free encyclopedia @burgemaster Our current GPOs are set up similar to this. Each individual software package has its own GPO object, and even individual settings like "always wait for network" seem to have their own dedicated GPO. I can certainly see some of the appeal to doing this, but I believe it goes against Microsoft best practise. IIRC you should avoid having more than 9 GPOs active on a single scope. In a previous school I created GPOs containing all of our general settings, and then assigned to them to the root of the Computers/Users OU. Then each layer down would contain a GPO containing the more specialized settings (e.g. "Student Computer Policy"), and so on. Software installation can be done from a single or maybe a few high level GPOs, and then computers added into security groups to enable that software for them (another big thing we want to do is have all file server permissions controlled by groups, e.g. "Student Share RW" or "Student Share RO" rather than granting permissions to groups like "Students" or even directly to users). @psydii hm, that doc does seem to suggest that two DCs are the recommendation for a single domain/site.

Using a sub-domain of a publicly registered domain name does seem to be the recommended option these days. Local domains based on "fake" TLDs aren't guaranteed to be unique (though in theory they shouldn't need to be). Another more serious problem is that major CAs these days will only sign certificates based on real domains that you own. Again, maybe not the end of the world since you can push your own root certificate out to domain managed clients. Any thoughts on the number of domain controllers and FSMO role setup? I'm currently planning on having three DCs - the first will take on the forest roles (Schema Master, Domain Naming Master), the second will have the domain roles (PDC Emulator, RID Master), and the third will house the unused Infrastructure Master role but be available to transfer/seize other roles if there is a problem with one of the other DCs. All three would run DNS + Global Catalog. Currently playing around with DHCP too. We do currently have two DHCP servers, but I have no idea if they are properly load balanced or anything. 2012 & R2 support proper load-balanced DHCP servers and will even let you sync reservations and exclusion ranges with one click too, so probably going to go with DHCP running on the first two DCs if there's no downside to that.

We are going to be installing a brand new Active Directory environment. This will be based on Windows Server 2012 R2 domain controllers (all virtualized under ESXi/vSphere), and hopefully all clients will be Windows 7+. We will still have all of the data from staff/student home drives, along with things in shared areas, but these will need to be copied and sorted out on a new file server. What I'm interested in is how others currently have their AD set up - and, if they were able to recreate it from scratch, what they might do differently. This includes everything from how domain controllers are configured, through to OU structure, groups, NTFS permissions, Group Policy, etc.