jertsy

oops, my bad!

Hi all I have started to get SPAM coming in, in the message at the top it says they can be from [email protected], [email protected] or just plain old banks, HMRC etc... When I look in the message properties they are being sent from another address, usually a legitimate company who I guess have been compromised. I have a fortigate firewall (we are with Schools Broadband) and that does some level of SPAM filtering but these always get through, we dont get any SPAM from the usual sources so I guess they get filtered out. Is there anyway to stop these, we can block the domains on the firewall but they just seem to send from a new address the next time. Would SPAM filter software\subscription stop these? Any advice please?

I did all my group policies from scratch in the summer, if I were you I would decide how you want to deploy stuff for your users, i.e. profiles or folder redirection etc... I then locked down most of the obvious things like cmd prompt, regedit. But I learnt by sitting with a test PC\Uer and making changes GPO changes to see what the effect was. Its a pretty time intesive job to learn them but certainly do-able. I bought this book too Group Policy: Fundamentals, Security, and the Managed Desktop: Amazon.co.uk: Jeremy Moskowitz: Books Dont know about copying from sysvol as I have never tried.

Is it all MSI or just one, if its just one then its likely to be something with that MSI as previously stated. I have 2012 R2 and I deploy software via GPO with no issues, standard stuff really. Just re-read, policy central MSI. I missed that somehow!

Cheers guys, I will follow this approach I think. I will have 3 collections for testing and 3 for production.

Do you have a test group first? I thought I may do one with a non critical server in and another with a few win 7 clients to test the updates before pushing out to the main collections.

So if I set up 3 collections, for arguments sake like yours. I would then create an update package from the applicable updates and deploy to the collection, does that sound about right?

Hi I was wondering how you have setup your collections for windows updates, is it best to setup a collection for one O/S or type of update, I was thinking one collection for Windows 7 32 bit, one for 2012R2, one for office 2013 and one for exchange 2013 etc... Or is there a better way of doing it? Any suggestions greatly appreciated. Cheers, Jertsy

Hi I have Exchange 2013 and i have been asked if its possible to block auto forwarding of emails for staff but not pupils. Has anyone come accross this? Cheers, Jertsy

Yes, basically update 1 on 2012 r2 broke wds so I just used mdt instead.

In my last school the caretakers did PAT testing and in my current school they get a contractor to do it. It's never even been mentioned that me or the IT staff do it.

Thanks for the suggestions. I did some digging on a PC that was exhibiting the issues, I kept getting 1058 and 1129 errors in event viewer. After more digging it turns out DC02 had not received replication of all the GPO's from DC01, so any PC's looking at DC02 could not load the GPO's correctly. DC02 was demoted a few days ago and then promoted last night, replication occurred and so far I have only seen the issue a couple of times and I am continuing to monitor as it may be that a new DC has appeared and things are settling down. If I get the issue further I thing a new DC03 might do it with DC02 being demoted permanently.

Mine is set to %homeshare%\my documents I have checked.

I will check what exactly mine is set to on monday morning and let u know but its something like %HOMESHARE%\MY DOCUMENTS

What path have you set in the GPO for the My documents redirection?

Thanks for the reply MordyT. Do you thinks its a PC issue then? is this a common thing then? Sorry if its a dumb question but im new to this.

Hi all I hope someone can shed some light on this for me. I have 5 GPO's that apply to staff and what I am finding is that when some staff they logon none of them are applying, I have reboot the PC several times and then they apply. Its a user config policy so I cant understand why re-booting the PC should make any difference. Its happening to different staff on different PC's, some staff logon fine but it seems some have the issue. Interestingly when I do GPupdate/force I get a message, something about not being able to see a domain controller but as I say it will just start working on its own. I will get the exact message next time it happens. Any help greatly appreciated. jertsy

why not create 1 new gpo? I have a profile set in AD as \\fileserver\%username% and folder redirection to \\homepath\%homeshare% thats from memory I can check when at work tomorrow if that helps. Hope you get sorted.

Mine is a brand new domain, as we migrated from the council. I have one gpo doing all redirection for students, one for staff etc.. as they have different shortcuts. Yes all gpo's set up from scratch. The fact you migrated sounds like the only difference between our setup. If you want me to compare any settings when im in work tomorrow let me know.

yup it sounds identical. I do use libraries too. Do you have one gpo handling all the re direction for one type of user?

I'm running office 2013 with folder\desktop\start menu redirection with no issues with windows 7. I'm using 2012 r2, what server os are you?

I created something similar for my test network, 1 dc with dns, ad role and dhcp. you can give the ad role via server manager now, and that checks for dns etc...no need for dc promo but it may still work knowing microsoft. I also gave the hyper v role and created a member file server just for testing shares, gpo's etc.. 2012 is really nice and I have it running on a pc thats a few years old, as its only for testing mine is as simple as it comes really, no Internet access so I called the domain .internal. Esentially though under the skin a lot of the old commands\ ms stuff still work.

Hmmm, good point. I will look at what ports said systems need to operate. Cheers

We use papercut here. Is that via file system in GPO?

What I should have done then, is disable the updates in Java in my reference image. I need to tweak some other stuff so I may re-capture in the near future. I have disabled the client firewall, we have a fortigate firewall via our internet provider though. The reason I did this was to get the system center EP deploying and I was advised to disable by our SIMS support people to allow Solus 3 to work. Thanks for the advice SYNACK.