maniac

I have around 20 Dell GX260 machines I'm getting rid of, Pentium 4 2GHz with 256-512mb ram depending on the machine. They're a bit tatty, but most of them work. I have 17" CRT monitors to go with them. They are all security marked, however I don't think this is a problem as long as the transfer of assets is recorded with a receipt from yourself detailing the equipment we've 'donated' If you want them, let me know ASAP as I'm arranging the collection of them soon. Mike.

We've just been lucky enough to be donated 60 17" 4:3 TFT screens from one of our sponsors, so we're 'upgrading' some of our older machines with these, as well as doubling the RAM in them to 1GB to make them last that little bit longer. (If I can get another 2 years out of them I'll be pleased!) Our newest machines we've just brought with 19" wide-screen monitors because they were a lot cheaper than their 4:3 cousins. For teachers machines we try our best to buy laptops with 4:3 screens, but these are getting rare now, so we're going to have to upgrade our ageing projectors at some point which is annoying as most of them still work more than adequately, but such is life. Wide-screen monitors are here to stay whether we like it or not, so we may as well get used to them. I don't think it will be too long until 4:3 screens don't exist any more, or become specialist items of kit. Mike.

Software restriction policies is the way forward here, you can deny access to specific programs by using a hash of them (so even if they renamed it it still wouldn't run) as well as stopping batch files being run from their home areas by denying executables on anything except the C:\ There is also a GPO 'deny access to command prompt' which if set should stop it being run as well. Mike.

The problem with that setup is if Server 1 dies for whatever reason, you lose the ability to resolve external addresses. I'm aiming for a high fault tolerance here, so want them to both resolve external addresses independantly if possible. I'm going to remove and re-setup DNS on the second server I think, see if that makes any difference. Mike.

Best of luck, it's been fantastic to see the way this site's grown since I've been here, and I'm sure it will only get better from here on in. Mike.

We're currently setting up our new domain, and everything is going fairly well except I've been noticing problems with the internet hanging recently so decide to investigate. First thing I do is test DNS lookups, and I notice that anything external to the school is timing out quite frequently so I ring county support to see if they're having any issues with their DNS servers (as it's only external addresses affected) they say no, but have a look into it with me anyway and discover than my first DNS server is resolving external addresses intermitently, and my second isn't resolving external addresses at all! I look into it a bit more and discover the reason that the first one is intermittent is because one of the forwarding DNS addresses is entered wrong, I correct that and it all springs into life. My second server however had the correct forwarding addresses, but is still refusing point blank to resolve any addresses external to the school. It's set-up as a secondary DNS server taking its data from the first, but I'm wondering if it should actually be a primary DNS server in its own right - could this be where I'm going wrong? I've checked all the other settings, and everything else is absolutely correct, the only difference is one is a primary DNS server and the other is a secondary DNS server. It resolves internal addresses absolutely fine. Anyone shed some light on this? Mike.

I would seriously look at Xerox printers. We brought a Xerox 4500 last year (because it was end of line and going cheap) for our staff room, and it's the only printer that we've had absolutely no bother with this year, dispite it receiveing a lot of absuse from teachers. I'm also amazed at how economical this printer is, the current page count is 23764, and it's only on it's second cartridge! In my opinion HP's build quality has gone right downhill in the last 2-3 years and I will be looking at other makes myself, dispite buying HP loyally for the last 5 years. Xerox gets a big vote in my book! Mike.

I've just written my software restriction policy and did the following. Disallow everything by default, then created a rule which allows everything on the C:\ this stops anything from memorysticks etc. being run. I then added in specific deny rules for certain programs like regedit, windows messenger, microsoft help and support centre, command prompt, mmc and a few others to stop those being run (although our GPO should stop most of them anyway) I find this is the easiest way to set it up so it works reliably. Ideally what you should do is deny everything then allow the programs you want one by one, but we run so much different software allowing the C:\ as a whole entity is a much easier option and it still stops execution of programs from memorysticks which is the main idea of the policy in the first place for us. One big tip if you do it this way is to make sure you stop the execution of programs from the Temporary files directory, as there's a loop hole that will allow programs to be run if they're in a ZIP file and double clicked, as it extracts by default to the TEMP folder. Mike.

Just what I'm looking for, need to get my staff details updated with proper names, looks like this will do the trick nicely Mike.

Not an expect with VB script and LDAP, but I have had issues in the past when OU's have spaces in them when using login scripts that read the OU information. It might be an idea to try renaming your OUs so they don't have any spaces and alter the script accordingly just as one possible thing to try. Mike.

The only time I've had issues like this is when roaming profiles remember certain drive mappings, and for some reason these get mapped AFTER the logon script has run. Solution to the problem I was having (Where my S:\ was still mapping to my old SIMS server on some peoples profiles) was to have a logoff script that ran to delete these drive mappings before the profile was saved. I also do the same with printers that are mapped by logon script. Remember the user hive of a roaming profile can save all these things at logoff. Mike.

A bit like this Set objShell = CreateObject("Shell.Application") objShell.NameSpace("N:").Self.Name = "My Documents" objShell.NameSpace("P:").Self.Name = "Public" objShell.NameSpace("S:").Self.Name = "Sims" I have it run as part of my logon script. Mike.

Shame, I've just finished doing this on my system Will still give it a look thou Mike.

I have a VB script which changes the Drive descriptions to hide that information. Very handy, also means I can rename N:\ to "My Documents" to try and get the message to staff that they are actually the same place on our system! Mike.

I would take a methodical approach to solving this one involving; Plugging the server into different network ports if available plugging them directly into the switch (if possible) Trying another machine with a gigabit card on the same ports as the server is using Trying different patch leads Looking at the error logs on the switch and the machine to see if anything's logged Trying the server on a totally different gigabit switch Mike.

I've published all my network shares using DFS on my new network. Not sure how it's going to cope yet, but we'll see. The main idea of this was to prevent certain students seeing the server names - now they only see the domain name for published shares and it also gives me the flexibility to move shares around between servers, but not have to make any changes to logon scripts etc. So far with a handful of staff on it it's working quite well. Mike.

Actually funny enough after this thread, I had another go and also got it working, although I forgot to feedback to you all. Download LDAP browser from softerra, it connects to you AD and allows you to copy the correct LDAP syntaxes straight out of the program, which is dead handy. Mike.

Check the batteries carefully against the website below. I'll place money that they match up to one of the yuasa standards, probably in the NP range - they nearly always do. APC ones certainly do, and you can save a shedload by buying them directly and not through APC, and they are exactly the same battery! NP Range Mike.

You could read up on RADIUS and set that up for your wireless authentication if your access points support it. It isn't as hard as you think, takes about half a day to do and the best bit is it means you can distribute the wireless settings via Group Policy. Mike.

All worked out well. All the domain controllers were running DNS luckily, so I was able to power on one of the others and get the domain functioning again. Exchange is working so I can migrate the mailboxes which was a great relief. Backup tape was OK, put the AIT drive in another server installed backupexec and away it went. It's currently restoring, 22GGB done and another 6 hours of time remaining. Mike.

Our brand new file server is in the following configuration. 2 x 74GB drives in RAID 1 exclusively for the OS 9 x 300GB SAS drives for the storage, which are setup in a RAID5 + 1 array, which gives the array a spare drive which will automatically step in in the event of a drive failure and the array automatically rebuilds which is dead handy. This is partitioned into 4 - students, staff, shared areas and a separate partition for shadow copies to use for its data. This is divided roughly 50% for students home areas, 25% for staff home areas and profiles, 15% for the shared areas and 10% for shadow copies to use. I like to keep the students and staff on separate partitions so one can't use up the others space, and it also makes it easier to manage quotas, shadow copies and other such systems. I like to keep the shared areas on separate partition as I don't use shadow copies on the shared drives, and you can only specify this on a per drive basis. Mike.

I checked everything I could check inside the server, there doesn't seem to be anything obviously loose. The 6 disks were running as a single RAID5 configuration (courtesy of RM) all my new servers have seperate arrays for the OS and the data. The other servers I've decomissioned are significantly older than the one that's gone wrong, so the drives are different capacities. I was planning to keep this server and re-use it on the new domain as it's only 18 months old! I'm still really intrigued as to how 3 disks can fail in one go, I was extremely careful with the server as I always am when moving them around. I've been remoted into work this evening, and luckily for me the credentials for administrator were cached on the exchange server so I am at least able to log onto it. I've also reset the local admin password so I can't get locked out of the server now - This should allow me to migrate the mailboxes, as I'm pretty sure the migration tool will work without the directory services although I can't run system manager at the moment, so we'll have to see on that one. I'm sure they'll be a way round it somehow. I've also been told by one of my techs that Server 2 may have also have been running DNS even thou it wasn't actively used, so I'll be powering that on in the morning to see if he's right, this may give me a functional domain again if I'm lucky. If so then I think we'll be OK - just have to hope that the backup tape works, and we'll emerge relatively unscathed from this incident! Mike.

Can someone edit the title please! Comain should be Domain! DONE We're in the middle of migrating to our new domain at the moment and It was going quite well until this afternoon. I'd copied across some data from the old to the new and managed to decomission 2 of our existing servers. So I removed them from the rack today and had a bit of a re-organisation which involved most of the server being removed from the rack in the end and moved to new positions to accomodate everything in some sort of logical order. Came to powering everything back on again, all the new servers started up fine, I then started up server 1 for our old RMCC3 network and it started loading windows fine, so I switch on everything else. Come back to check on them about 2 or 3 minutes later, and notice that the old server 1 is just displaying a gray screen, looks like it got stuck on startup somewhere. So I leave it another ten minutes and still nothing so no other optiont but to hit the reset switch. Here's where it goes horribly wrong. Server won't start, and the RAID controller is reporting 3 disc failures! Yes that's 3 discs out of a possible 6, absolutely great! So now it's officially dead. It's not a major major problem, as the backup completed sucessfully last night so I have all the data from it safe which happens to be all the staff files (Tape currently residing in my house for ultra safe keeping!) but it is a problem in that I still need to migrate exchange except the old exchange server can't authenticate to anything because that server was performing DNS for the old domain. Would I get away with renaming the old Server 2 to server 1 and changing the IP number, then installing DNS onto that to replace the now missing DNS server? Would that work and allow exchange to log on (there are still 3 other domain controllers from the old domain, so there's servers there for it to autneticate to if it can find them) Or could I add the old servers 1's IP number to my new network domain controller then add the old networks domain to that DNS server so it can resolve names? Would that work? I only need it running so I can log onto the exchange box and migrate across all the e-mail, once that task is complete, then the old domain can be trashed - two more days that's all I needed! Looks like staff won't be getting their laptops back as early as I hoped! Any help appreciated! Mike.

There's an ADM template on systernals website which allows you to change the necessary registry key to stop the drop shadows around the icons, i remember now this was a pain in the backside to sort out - I'd forgotten about that issue. We have active desktop enabled, but no wallpaper specified - that seems to work for us. The wallpaper is then applied by BGinfo which is run from a login script. Mike.

We have several adminitrative accounts on our system. The main Administrator account is never used, the password for it is ridiculously complex, and it is on a piece of paper inside a sealed envelope in the school safe, together with all the other service account passwords that may be needed in the event of an emergency when there were no other IT staff in the building and they had outside support in for whatever reason. There are 3 of us here, and we all have an admin account each. It can't do absolutely everything, but it can do everything that is needed on a day to day basis. They are specially taylored so they can only reset the passwords of accounts below them in ranking, so there's no danger of one of us going mental and locking everyone else out of the system or something like that. These admin accounts are different to our normal day-to-day accounts and are used speicifically for administration tasks and logging onto servers with. In my experience it is unusual for a teaching member of staff to have adminitrative privileges on a school network, there's a lot of issues surrounding this, data protection being just one of many that would need to be addressed. The other major difference between a member of technical staff and a member of teaching staff is the teaching staff are much more likely to leave the machine logged on, or accidentally without realising it give away the password to a whole class of students by typing it into the user name box instead of the password box while being displayed on a projector (oh yes it has happened) incidents like that do need consideration when deciding on appropriate rights to give someone on a system. Start with the minimum needed and add bits as necessary, not the other way round. Mike.