william-swc

Hi, I've been having major issues with deploying a Windows 7 snapshot to a pc using Altiris Deployment Solution 6.9 sp4. Basically it's my first time trying to create and reinstall an image with Win7. I want to create a snapshot before dabbling in sysprep but I can't even get that far. I have also posted in Altirigos forum to see what responses I can get there but Edugeek has been excellent in the past so I thought may as well try posting it here as well. I have created and ran a create image job with the following settings: - Imaging tool: Rdeploy - Pathname: I:\win7\%COMPNAME% (I'm using a token as I'm experimenting on one particular pc) - Disable image path is unticked - Prepare using sysprep is unticked - Do not boot to production is ticked - Automation preboot environment is WinPE 2.1 64bit (I am creating an image of win7 64bit operating system) The create image job runs fine, Altiris detects the job as being finished successfully. I then try to deploy the snapshot to the same pc I took it from using the following settings: - Disk image file points to the correct path and disable image path validation is ticked - prepared using sysprep is unticked - Automatically perform configuration and boot to production are both ticked - Use deploy anywhere hardware independant is unticked - preboot environment is winPE 2.1 64bit The deploy job runs fine until it needs to reboot to configure the pc. After reboot it tells me that there is no active partition! I suspect it's related to the fact that Win7 installs two partitions and none of them has been marked as active but I was under the impression that since sp3 this problem had been resolved? Thanks to anyone who takes the time to read this, I know it's a bit of an essay!

Hi Toby, That's sounds like a plan! The subdomains are on two different internal servers and then http://www.ourdomain.ac.uk is on a different server again on the DMZ. If I have picked you up correctly you would recommend bringing the server on the dmz back in to the internal network, forward the current public ip address to the ISA server and let the ISA server decide where to send the traffic? What about security? how will that work? The Sharepoint servers on the subdomain use integrated authentication to validate users, the website on the dmz uses anonymous. Also is the ISA server on the dmz or is it also internal? Sorry for all the qu's, Thanks for your help so far William

Hi We already have a public ip address which points to e.g. http://www.ourdomain.ac.uk. We don't want to purchase additional public ip addresses as: 1) we've been told we don't have to by our sharepoint engineers 2) we have to purchase them from our supplier in blocks of a certain number We have created internal subdomains in the example sharepoint.ourdomain.ac.uk and staff.ourdomain.ac.uk. Both of the subdomains point to websites on internal webservers. The domain http://www.ourdomain.ac.uk points to our webserver on the dmz. Is it possible, using host headers and DNS to allow the subdomains to be accessible from the internet without purchasing additional public ip's, and if so how do we go about implementing the solution? We use Microsoft servers running the latest version of IIS. Thanks

Most of our computers are still on Office 2003. Some of them have certain components of Office 2007 installed, eg Outlook 2007. We need to deploy Infopath 2007 but I get a message saying that you can only use MSP's on first time deployment, I'm assuming this is because the computers affected by this message already have some component of office 2007 installed. Is there any way to upgrade office silently to just install infopath 2007? thanks

Thanks for the advice, I ended up finding a way to get this to work. I Delegated control in Active Directory to the user just to allow him to reset passwords. I then installed RSAT on his computer under my administrative account. I copied the shortcut for active directory users and computers to all users desktop, so now when he logs in he has access to AD on his desktop and the only thing he can do is reset passwords. Hope this helps someone else.

I have a bit of an unusual problem. During the day our college has a team of IT technicians taking care of the network inc menial tasks such as resetting students passwords etc. In the evening the Technicians take turns to stay on a late shift to cover classes till 8pm. About once a week we have a non IT staff member stay to cover the late shift as there isn't enough technicians on rotation. This person only carries out tasks such as replacing print toners and resetting passwords. We would like to get Remote Server Administration Tools installed to run under his normal user account, at the moment it is installed but will only appear on start menu on admin accounts. Is this possible? This particular staff member currently uses remote desktop to log onto the domain controller to reset passwords (using a seperate admin account), which is an inconvenience and could be done away with if RSAT is working under his account. I have also delegated control to his user account in AD. It may just be that it's not possible for this to happen unless he has an actual Admin account but that's why I'm asking the question. Hope this makes sense and someone can help. BTW the user runs Windows 7 on his computer

DNS is set to secure updates only. that tick box is unchecked, the only one ticked is discard PTR and A records when lease is expired

Hi, We cleared out the PTR records in reverse lookup which seems to be working so far. My settings are as follows: My DNS settings on reverse lookup zones are: Scavenging time 7 Days (actually another technician has just changed this to 1 hour for testing) refresh interval 15 mins expires after 1 day Minimum Time to Live 1 hour Under DHCP settings the DNS tab is Enable DNS Dynamic updates (tick) Always Dynamically update DNS A and PTR records (tick) Discard A and PTR records when lease is deleted (tick) Everything else unticked However the iMacs are still experiencing problems but they aren't on my campus so can't say exactly what problems they are having. I was speaking to them yesterday and the guys are rebuilding the xserver for the iMacs. The problem with the iMacs initially was that when the Apple specialists were over they couldn't update the AD schema to work with the xserve so they had to configure work arounds, I think that is the root cause of our problems with the iMacs. Sorry I can't be more specific. If your mac issues are directly related to DNS reverse lookup, then I would say delete the PTR records in the evening, then when staff/students turn on the computers in the morning DHCP will automatically populate the PTR records. I didn't have any adverse effects on my network by doing that and if nothing else it will ensure your reverse lookups are accurate. In my view it's win win.

Just a quick update, have deleted all PTR records relating to my campus apart from server records. Also did it for another campus. Will see the what effect, if any, it will make on Monday. Cheers for everyone's help and advice so far!

Doh! Schoolboy error right there! lol Note to self.... static ip's don't use DHCP!!!

Thanks, yea I know not to delete them. Considering that DHCP is set to update the PTR records, not the client, will the registerdns command still work when run from the client?

Thanks for you contribution, DNS is set to dynamically update from secure sources only and the DHCP server is set to update PTR records not the client. Deleting the PTR records is all there's left to do.

are there any repercussions of just deleting the reverse lookup zone PTR records in one go? surely for accessing network shares the computers use forward lookup? My plan would be to delete them all this afternoon, then when everyone logs in again on Monday DHCP will update the PTR records

Ok what I have done now is test on my own PC. I looked up DNS and found 2 DNS PTR records for my pc name and also the PTR record associated with my ip address...3 PTR records in total!!!! I deleted them and did ipconfig /release /renew. DNS automatically updated with the correct details!! At last we are getting somewhere! I think the only option we have now is to delete the DNS PTR records gradually throughout the site.

Well, we don't have a rogue DNS server. I used Wireshark and found that it was requesting DNS lookup from our Domain Controller which is also our DNS server. We are really down to the final option of deleting PTR records.....

Doen't seem to, any computers I've tried at least. It is an option just to delete all PTR records in reverse lookup but it still doesn't really fix our problem as when we move computers or change names it still won't update dynamically. I haven't had time just yet but am going to investigate the possibility of a rogue DNS server first.

I understand what you're saying. We have very few Mac's on the network, in fact there's none on my campus at all. We have recently setup a suite of about 20 iMacs on another campus and none of the iMacs are dual boot. The DNS problem was there before we got the macs, we just didn't have the time to look at it, it's only now when we are trying to perform more frequent audits on internet use and since we got the macs that it has become important to resolve the issue. We had specialists come in to setup the Macs but they didn't know how to update the Active Directory Schema so had to perform work arounds on the Macs which are seperate issues. I knew how to update the schema but as this was taking place on a different site I was never made aware of the issue until the Mac guys had left. If I can get the DNS working perfect on the Windows computers then we can start to look at the problems on the iMacs. Cheers

Good suggestion! will try that thanks. I'll look for rogue DNS servers, we do have about 6 different DNS servers across 4 geographical sites which replicate frequently over Fibre Optic lines. I'm pretty sure the client is sending the DNS request to the correct server ip address as configured by DHCP but will still follow your suggestion as I'm fast running out of ideas!

Hey Hodge, thanks for your suggestion. We tend to move our computers about quite a bit and that means they get assigned different computer names according to their location. It's also the reason why we don't want to go down the static DNS route. I've just notived something interesting..which maybe implies that there is something completely wrong with my DNS settings. I set a computer with a static PTR record in the reverse lookup zone yesterday. I've just performed NSlookup on it's ip address and it has returned a completely different computer......and that's a static record! What could be causing this?

Well, I arrived in at work this morning and tried nslookup on the IP address, still returning a different computer. Any ideas?

Ok, I've set scavenging automatically for all zones to 2 hours to see if it clears it up, I will increase this value if and when this is proven to work. I could probably increase DHCP lease if necessary as well, we have loads of IP addressess available.

Hey, thanks for replying. Yea I hate DNS too! Unfortuneatly we can't use Plan B to use a script to link usernames to ip address as we have ercently got a suite of iMacs and have had issues connecting them to our AD structure. According to Apple they are very sensitive to DNS so we need to get this issue resolved to rule out that being an issue there too!

Hi, We are having issues with reverse lookup on DNS. The scenario is this: When I run nslookup command in the format "nslookup computername" eg nslookup ot11-wks01, it will contact the primary DNS server and return the correct IP address for that computer, in this example I will use 10.50.23.20 as the returned ip address. If I then run nslookup on the IP address eg nslookup 10.50.23.20 it will return the FQDN of a completely different computer. I believe this to be a reverse lookup problem. It may not seem important but we use 8e6 iR3000 as our web filter and review the websites students are viewing regularly. the r3000 returns IP addresses used to access websites and we need to be able to resolve the ip address to a computer name in order to locate the offending user in the college. We had an occasion recently where a student was falsely accused of accessing a computer in a staff area because nslookup returned the wrong computer name My DNS settings on reverse lookup zones are: Scavenging time 7 Days (actually another technician has just changed this to 1 hour for testing) refresh interval 15 mins expires after 1 day Minimum Time to Live 1 hour Under DHCP settings the DNS tab is Enable DNS Dynamic updates (tick) Always Dynamically update DNS A and PTR records (tick) Discard A and PTR records when lease is deleted (tick) Everything else unticked There's alot of information there so thanks for anyone who took the time to read it and I hope someone can help.

Hi, We are having issues with reverse lookup on DNS. The scenario is this: When I run nslookup command in the format "nslookup computername" eg nslookup ot11-wks01, it will contact the primary DNS server and return the correct IP address for that computer, in this example I will use 10.50.23.20 as the returned ip address. If I then run nslookup on the IP address eg nslookup 10.50.23.20 it will return the FQDN of a completely different computer. I believe this to be a reverse lookup problem. It may not seem important but we use 8e6 iR3000 as our web filter and review the websites students are viewing regularly. the r3000 returns IP addresses used to access websites and we need to be able to resolve the ip address to a computer name in order to locate the offending user in the college. We had an occasion recently where a student was falsely accused of accessing a computer in a staff area because nslookup returned the wrong computer name My DNS settings on reverse lookup zones are: Scavenging time 7 Days (actually another technician has just changed this to 1 hour for testing) refresh interval 15 mins expires after 1 day Minimum Time to Live 1 hour Under DHCP settings the DNS tab is Enable DNS Dynamic updates (tick) Always Dynamically update DNS A and PTR records (tick) Discard A and PTR records when lease is deleted (tick) Everything else unticked There's alot of information there so thanks for anyone who took the time to read it and I hope someone can help.

hey, thanks for that, it worked