Slartibartfast

I've just been playing with this... For the purposes of this example, we'll assume that the student group is called 'Students'. Students - Traverse Folder/Execute File (This Folder Only) Students - Read Attributes, Read Extended Attributes, Create Files/Write Data, Read Permissions (This Folder, Subfolders and Files) CREATOR OWNER - Traverse Folder/Execute File, List Folder/Read Data, Read Attributes, Read Extended Attributes, Read Permissions (Subfolders and Files Only) I have access based enumeration enabled on the share so any folders not accessible by the student in question do not appear in Windows Explorer. Students will be able to see their own work but not make changes to it or delete it.

Incorrect share permissions? To clarify: The share permissions should be set to Everyone:Full Control. The NTFS permissions should be changed to give students 'Write'. Depending on the application used to save the file, they may need a few other permissions such as 'List Folder/Read Data' or 'Read Permissions'.

This is possibly not entirely relevant to this problem, but gpupdate /sync will force *all* group policies to reapply. gpupdate /force will only force the application of settings which have changed.

Remote Desktop Web Connection needs port 3389....which the Norfolk LEA won't open. SSL Explorer is an option for remote administration between schools, but Neoteris is the only 'reasonably' priced option for remote administration from home. The other option is even more expensive: http://eficts.norfolk.gov.uk/NSIX/ThirdPartySupportAccess.asp

The Group Policy Management Console (available for download at Microsoft) has a rather handy reporting feature that will list all of the settings in a policy. Quite why it wasn't included with Server 2003 as standard is anyone's guess.

This programme was desperately short on real facts, but I've prepared a statement to pre-empt any fallout from parents and sickly teachers. I found the presenter's use of a wireless keyboard and mouse amusing, and his IT'S A VIDEO CONFERENCE, I NEED TO SHOUT voice.

In the group policy editor, make sure that 'Move the folder to the new location' box is ticked under the Folder Redirection settings. This will not solve the problem of these large folders roaming with the profile. They should be redirected to a location *outside* of the profile (to another network share, for example). Personally, I would not bother to redirect 'Application Data'. It always seems to cause more problems than it solves.

I'm a stingy git when it comes to disk quotas. Students have 50Mb initially, rising to 100Mb if necessary. Staff have 250Mb initially, rising to 500Mb or 1Gb if necessary. Certain members of staff have cried to the Senior Management team and have had quotas raised to stupid levels or removed.

Live Communications Server requires additional CALs which can be rather expensive. I have been trialling Jive Software's Wildfire for a few months. It's open-source and supports LDAP/Active Directory authentication.

Nope. It shouldn't be too hard to knock up an .adm template. The setting does not hide the 'Log on using dial-up connection' box, but it does grey it out.

There's a registry key for this. http://www.pctools.com/guides/registry/detail/794/

Same problem here. It *may* have been fixed in the latest build but I haven't tested it yet. (Incidentally, the Serco representative in the room with me is not aware of an issue.)

Windows Deployment Services seems to be the only major new feature. RIS is automatically upgraded to WDS when SP2 is installed.

The vbs checker script is extracted to c:\windows\system32 by default, in case anybody is having trouble locating it. WSUS has picked up the service pack, but I haven't tried approving it yet.

You would not be able to simulate certain policy settings that can only be set in the 'Default Domain Policy'; password length and complexity for example.

*deleted* Double posts over ten hours apart? Bizarre!

We currently use OTRS (http://www.otrs.org) but it can be a bugger to set up.

I was under the impression that the VLKs for Office 2007 are still VLK 1.0 and do not require activation. :?

I'd suggest using using group policies to enable local profiles with folder redirection and offline files on the laptops.

Fantastic script! Thanks!

Were the machines in the suites imaged? Delete the HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate key on the affected machines. Then run wsusadmin /resetauthorization /detectnow from the command prompt. This problem can occur even if the machines have been sysprepped.

Congratulations! I've got 70-297 (Active Directory Design) coming up in a couple of weeks, then I'm MCSE 2003.

We pay an obscene amount of money (over 26000) for a crippled RBC broadband connection. No public IPs, and a variety of restrictive practices by the LEA make even simple tasks difficult.

Does the machine have access to the original Office installation source? If it is on a network share, make sure that the relevant groups have read access.

Have you tried running RSoP in logging mode using the Group Policy Management Console? Also, try gpresult /v /scope:user from the command prompt whilst logged on as one of the users.