ajbritton

Something for the real hardcore Windows geeks out there... Active Directory Blog : How Windows Communication Works Could be very useful for troubleshooting.

It would be a fairly simple matter to set up a 'startup' script which uses robocopy to update the local mandatory profile from a network location whenever the laptops are connected to the network. You could then maintain a central profile and have it pushed out automatically.

I would agree that what is being described sounds like an evolutionary step, but I still think using 'zero' is misleading for IT people, when it's really just a 'thinner client'. From a support perspective, when an end user rings the service desk, one of the first questions might be 'are you using a PC or thin client?'. Do we now need to include 'zero client' in the question as well? Of course not, because it's essentially the same technology. If the user has a device labelled 'zero-client' it might be confusing for them. My point here is that no matter what you sell them as, they are likely to be referred to as 'thin-clients' within customer sites for the sake of simplicity.

There are numerous Microsoft suggestions for good practise, but the one I tend to remember is U-G-DL-P. The idea is to assign users to Global 'Role based' groups, which are typically descriptive of the role that those users have e.g. 'All Staff' or 'Senior Managers' . When securing resources, you create Domain Local 'Resource' groups specifically for that resource and the permission levels you want to assign e.g. 'PoliciesFolder_Read' or 'PoliciesFolder_Modify'. These groups are then assigned the appropriate permissions on the resource in question. Finally, the Global 'Role' groups are added as members of the Domain Local 'Resource' groups. This seems complex but has the advantage that it is self-documenting. Separating the groups out in this way means that it is always a simple job to find out what a user has access to, or who has access to a particular resource. There will be occasions when it makes sense to add individual user accounts to the Resource groups, but this does not break the model. The key thing is never to use the 'Role' groups to directly assign permissions on resources. If you do this, there is no way of tracking what resources a user has access to. The one notable exception to this rule would be permissions on a user's home and roaming profile folders.

We seem to be debating what is or isn't an OS. If that's the case then I would say that if the code that hosts the network stack and video interface only exists to support a single application (e.g. RDP), then that's firmware. An OS is about providing a platform for multiple applications to access the hardware etc. I do think the term 'zero client' is misleading though. I can't see any difference between a device that has firmware built in but that can be updated over the network to one that boots part of its code across the network. Using this logic, a PC is a zero client until you switch it on and it loads its OS off the hard disk. Surely what matters is where your applications run. If they run on the device, then it's using an OS and is therefore NOT a thin client. If the device cannot run applications other than a remote desktop, it's a thin client. Everything else is marketing or system management mechanism.

mjs_mjs makes a good point. If you are relying on a combination of share and file/folder permissions for your security model, you need to be careful if introduce an additional share at another point in the tree that this does not weaken the security. If you need to do this, then it might be safer to have a simple and standard share permission model and do the trickier stuff with NTFS.

AFAIK (and without doing any research), Change and Modify are essentially the same. This may be useful: Windows 2003 NTFS and Share Permissions Here's another: Share Permissions - This suggests that best practice is to set share permissions to Authenticated User: Full Control and then control access using NTFS perms. though, which I still disagree with. This article: Share versus NTFS Permissions makes a good point which is that share permissions (and any restrictions you apply using them) are only effective when the resource is accessed across the network. Hope this helps Afterthought: The way I tend to think of permissions is like this. Change/Modify is all anyone (or any application) should ever need for normal (ie non administrative) operations. It lets you read/write/delete files & folders. That's the baseline. The most common restriction is to make files available for viewing only ie Read. That's one level down. If you are an administrator and need to actually change the permissions, then you need Full Control, which is one level up.

This might be of use. Best Free PDF Writer

Just wanted to point out something that I've learned the hard way about these things. All of the free PDF printer apps that I have tried share a particular characteristic which is that they don't convert hyperlinks in the original document to PDF hyperlinks. If the document has a hyperlink that says 'http://www.google.co.uk', some (or possible all), PDF readers will translate this into a hyperlink, but this will fail if the hyperlink is of the form 'Click here to go to Google' with the URL hidden. In this instance you will see what looks like a hyperlink in the reader but it won't do anything.

I too used to work on the basis of controlling permissions using NTFS alone, but would say now that using the share permissions provides a useful safety net. NTFS permissions can be complex things and it is not unknown for them to become incorrectly set. If you set up share permissions correctly, it's possible to limit possible security issues caused by incorrectly set NTFS permissions. For example, imagine a share which Students were allowed to read from and staff could update. If the share permissions were set to Everyone:Full, then a mistake setting NTFS permissions could result in students having write access to the files. If the share permissions were set as follows; IT Techs: Full Control Staff: Change Students: Read then students could never be accidentally granted any access higher than Read and staff could never be granted any access higher that Change.

In theory, AFAIK, there's no rule that says a mandatory profile has to come from a network connection. We used to use what we called a 'shared' profile, which was essentially a roaming profile stored on the C: drive. This was a rather crude method of giving the same settings to all users on that PC. We occasionally had problems with this approach, but we weren't setting the profile is mandatory, so you may be more successful.

It seems you have the advantage of me but yes, I do remember those days !! Good call with the Hayes Smartmodem. I remember them well. I also remember hand-coding Epson command codes on the BBC Micro to print out custom inserts for the BBC function keys.

Concur with above suggestions. 9 times out of 10, this is a permissions problem within the registry.

I was clearing out some junk the other day when I came across an actual Novell NE2000 network card. It struck me that here was something that lived on through being a compatible standard, long after the device itself ceased to be available. Can anyone think of any other hardware that can claim this sort of longevity. I put forward the following; Novell NE2000 Network Card - Many NICs NE2000 compatible for many years HP LaserJets (II, 4) - Many printers compatible with these standards for many years Anything other bits of hardware that if you suddenly found one in the back of the cupboard you would say to yourself 'Wow - here's something that was really important in some geeky way'

I have some Google Wave invites available. Send me a PM with your email address if you are interested.

I'm surprised to find that anyone would leave their computer switched on just to send out-of-office messages. I wonder how much electricity that uses. It's often the case that you can set an out-of-office messages using the web interface provided by the email account provider. The trick would be remembering to turn it off again.

It sounds to me like a 'zero client' is just a 'thin client' that boots over the network. What is the advantage of this?

Michael, perhaps I'm mis-understanding the requirements. Will your users leave their computers switched on and logged in with Outlook running so that it can send out-of-office messages when they are not there?

Would I be right in saying that you are using Outlook to send via SMTP and manage mail via POP/IMAP? If so, you can't really blame outlook for having no out-of-office support. AFAIK, there's no provision for out-of-office type functionality in SMTP/POP/IMAP protocols.

Can I also suggest a test; Create a new Access database Create a single table with a couple of fields Put a couple of records into the table Ensure the database is saved on a share where all users have Modify access Try connecting two users to the new database The purpose here is to eliminate the Access configuration and decide if it is something specific to the database that you are using.

Are you sure the Tools, Advanced, Shared settings is done for each user?

Nice thing about iTunes in conjunction with iPod is that podcasts that have been listened to are automatically removed from the iPod and eventually deleted altogether. It's a very simple process.

I maintain an Access FE-BE database system that is accessed via Terminal Services. The way I addressed this was to write a small 'loader' stub in AutoIt which maintains a cached copy of the latest FE DB in the users profile under Local Settings\Application Data\MyDatabaseName. This was necessary as the FE DB was not designed to be used by multiple users. In theory, I cannot see why a properly written FE DB should not be accessible by multiple users. As long as any code running in the FE DB does not assume it 'owns' the session then all should be well. I have never tried this however.

Are you talking about Staff or Students here? If it's staff, then I would say that there should be a policy requiring staff to check their email on a regular basis. Leave it up to them.

Depending on your needs, this may be overkill, bet I find ThinkingRock GTD very useful for tracking personal projects / work items. If you need to share the tasks with others then a service desk type solution makes more sense. Also, http://www.rememberthemilk.com/ is popular in the Web 2.0 world and integrates with lots of other systems. Probably an app for it...