srochford

If you look in the file %windir%\windowsupdate.log you'll find blocks starting: 2008-10-10 12:53:02:001 1144 708 AU ########### AU: Initializing Automatic Updates ########### 2008-10-10 12:53:02:001 1144 708 AU # WSUS server: http:// and this will tell you which server is being used for the updates. If that's an internal server then someone must have configured windows update to push out IE7 - it definitely won't happen automatically but I think it is flagged as a high priority update. If the server is the MS server then it looks as if your netpilot is not blocking access to that site. The Microsoft website has details of the IE7 blocker toolkit to prevent it being installed and it might be worth installing this. Unless you have particular software which needs IE6 I would recommend that you try and get IE7 working properly; support for IE6 will end before long and it would be better to not get forced into IE7 (although that is kind of what's happening ...) You can uninstall IE7 (although not sure about doing it after updates have been installed) and I think it happens silently.

The trouble is that it doesn't make it secure. There's endless research on passwords and how to make them secure; regular changing is not a way to do it - all you do is annoy people and you end up with them writing the password down. Making everyone change password just because a few haven't done is also not a good idea - it's like putting a whole class in detention because one child has done something wrong. It's seen as not fair, not sensible and it brings into question your professional capabilities. Start talking to staff about using passphrases rather than passwords - most people find it easier to handle a phrase (which naturally includes upper/lower case and punctuation) than a string of random characters.

Things like this only work on small networks; my last place had c. 15,000 users in AD. I haven't counted them here but it's easily twice that - selecting them all from a list is non-trivial :-)

I would have thought that just before the summer holiday is almost the worst time to do it! It means coming back to a new term (when it really matters that you can get class lists etc) and having a new system which may not work properly and, even if it does, will be different from what you're used to and possibly confusing!

If you get error codes starting with 0x8007 then the last 4 digits tell you a useful error code. Start calculator, put it in scientic mode and then click Hex. Type in 0641 (in this case) and click Dec to convert to decimal - this gives you 1601. Open a command prompt and type net helpmsg 1601; you'll find that the error message means that there's a problem with the windows installer service. This is needed in order to install the updates so if it's not there, all bets are off! If you can't quickly see the problem with the installer, try downloading it from Microsoft and installing it. One other useful trick when updates keep failing is to clear them all out. Stop the automatic updates service (and BITS if it's running) and then delete the folder C:\windows\softwaredistribution and c:\windowsupdate.log - restart the service and it should download whatever's needed.

What email system? I'm guessing not Exchange because that does it for you (you specify the default form of email and the recipient update policy does magic) If it's just storing data in the email address field (not creating mailboxes) then it's easy to script it or admod from Joeware can also do this for you - there's an example here to do exactly what you want.

You also can't count :-) if left(compname,6) = "RESOURCES" needs to be if left(compname,9) = "RESOURCES" - you're checking the first 9 characters

Take 6 characters from the left of the computer name. I'm guessing your PCs are named something like suite10, suite11, suite12 etc?? Provided you have got a good naming convention then it's easy to take part of the name and work with it to do things like deciding where a machine is and which printer it should get. Other things to look for are the mid and right functions which can extract other bits of the name (eg mid(compname,3,4) starts at character 3 and takes 4 characters - "ite1" and right(compname,2) would return "10" from the first name above) Dan's batch file works fine but you can probably imagine that it gets a bit longwinded if you have more than a few computers - picking the fragment of the name which identifies the room often keeps things simple!

Depending on how fast you need responses, you could do something reasonably easily by having a web server running on one machine and other machines making requests from that/passing responses back to it. Downside is that http is relatively slow (there's a lot of overhead just to request the status of an object, pass back co-ordinates etc) A quick google finds this example - it's to do with secure message passing and it's the sort of thing which I think you need to do. Obviously, you have to work out what's going to be passed and you don't need the GUI setup but it might get you started.

This kind of thing is often built into contracts and if it is then I think it's actually irrelevant if you sign an extra piece of paper before or after you go on the course. It would be nice if you were reminded of this at the time you booked the course ...

To be fair, if you're going to mount a cuboid black box on the back of a flat screen then it's going to look pretty much like that :-) At my last place, we had about 1000 of these Viglens (although almost all just standing on the table rather than monitor mounted) and they worked well.

So you make the desktop part of their home directory, you put a quota on the home directory and that prevents them from keeping too much stuff. The organised person who wants to keep stuff on their desktop can do it without it being a problem for them (or others on the network - if your network design means that everyone's desktop is being copied across at logon then even 50Mb multiplied by lots of users can be a problem) The disorganised person gets a message saying "disk full" when they try and put another CD on their desktop - at that point the person causing the problem has to deal with it and it doesn't impact on other users.

No. It will move it from the local desktop to the server desktop. If you have lots of users with huge desktops then this could really knacker startup times if they all do it together. What I did when I last implemented this was to set up the redirection policy and apply it to a group called (say) desktopredirect. Put half a dozen people in that group and make sure it works. Over a period of time, add more people each day until they're all done.

I keep reading this and I keep wondering why people set their networks up to allow this to happen. This Microsoft article gives the basics of how to use folder redirection. Roaming profiles only need to contain a tiny amount of data (the biggest file will probably be ntuser.dat) - everything else should stay on the server but should appear to roam because the pointers to the shell folders roam. Configure your network so that desktop, application data, my documents (and its subfolders) are redirected and 90% of the problems with roaming profiles will go away. There's no reason at all why a user shouldn't have all their files stored on the desktop - it's our job to make that work for them and it's stupidly easy to do (one folder redirection setting in one group policy).

In standard ASP, you can use the file global.asa and run code based on session_start and session_end to track the start/end of a sesion. this code could (eg) write the name to a database table at session_start and then remove it at session_end. What are you trying to do? there might be a better way of achieving it.

"big" manufacturers are doing it on anything they call a business PC. In the past year I've worked with Dell, Viglen and HP equipment and they all offer AMT pretty much as standard. My comment was kind of tongue in cheek but for someone who's just starting looking at managing the hardware remotely then it's probably worth making the effort to find out about AMT.

You know when people say "It's not rocket science"? Well, MS licensing might not be rocket science but I reckon most people would find it easier to build a rocket for a trip to Mars than understanding MS licensing for something like this! Good luck - I'm afraid you'll need it.

What you really want to make it "future proof" is to use AMT/vPro - much more robust than WoL in the way it crosses subnets etc but also just a bit more difficult to get going.

Do you still need to remove the software or is it just that you want to get rid of the error messages? if it's the former, can you put back the MSI to let it uninstall? If it's the latter then you can use the Microsoft Windows Installer Cleanup Utility This has a GUI which allows you to cleanup the installer database but it also installs MSIZap.exe which is a command line tool that does the real work. You can use it in 2 ways - either with the Product GUID (get it from HKLM\software\microsoft\windows\current version\uninstall) or if you have access to the MSI msizap TWA! {product code} msizap TWA! Note that this doesn't uninstall the program, it just removes all info about the program from the installer database so Windows thinks it's been uninstalled. It is potentially destructive so use with care!!

proxycfg sets proxy settings for applications using WinHTTP but that shouldn't affect Internet Explorer. It's useful when you have apps (other than web browsers) which can connect to the internet but cannot be configured to use a proxy server

the "redirected" printer is because you're connecting using remote desktop and telling MSTSC to redirect the printer - ie your workstation has a printer (network or local) and RD is allowing you to run a process on the server which prints to the printer connected to your workstation. When you go to connect with mstsc, click the "options" button, go to local resources and untick printers - this will stop the printers being redirected. Don't see why connecting to a printer like this should stop the spooler - is there anything in the event log about a printer problem (it's conceivable that when the server installs the printer driver something is going wrong). The other thing you can do to stop this being so much of a problem is to set the recovery options on the print spooler service - basically, you can say "when the service stops, restart it" and that way at least the printers keep on going while you try and find what's wrong.

Can't see the error message here - the image doesn't seem to be accessible. Can you just copy the text of the error and paste it (if it's a message box then clicking on the title bar and pressing CTRL C will copy the whole text of the box to the clipboard - you can then just paste it in. I generally find this much easier than faffing about with bitmaps of errors!) Line 1 should say: set objnetprint=createobject("wscript.network") if it doesn't, then that's why it's not working

I think you need to get lower in the device driver hierarchy! I haven't looked at copy protection methods for CDs but I know some of the things that used to be done on floppies (remember them? :-)) When you look at the listing of a disc you can see that there are a set of files; you can easily copy those files etc. What a program running can do, though, is not say "show me the list of files" but "read sector 9 on track 5" etc. Old copy protection techniques would do things like not formatting a particular sector; an attempt to read it should fail. If it doesn't fail, then someone has just formatted a disc normally and copied the files onto it. Similarly, it's possible to store "fake" track/sector numbers in the sector header - this means that if you do a "raw" read of the sector at (say) track 20, sector 5 you will get 20/5 as the data from a normal disc but the copy protected disc will show track 96, sector 52 (or other physically impossible numbers) I'm sure something similar exists for reading CDs - you can store data on the optical disc which is not accessible through the normal file system but is accessible if you can directly control the CD. Daemon tools (and some others I think) replicate this functionality; accessing the set of files via a network share (even if that share is provided by Daemon tools) does not - there simply isn't the low level communication channel in place. It's probably possible to do something like this over a network - years ago, RML (as they then were!) used to ship Optinet CD ROM software (which appears to still exist) - this made it look as if the networked CD was actually a local CD and could cope with some CDs that wouldn't run by being copied to a server.

the other thing is that if the server is somehow waiting for 6 (or more) computers but it should say that on screen.

The way I've dealt with this kind of thing before is to create the GPO to do the installing but change it so that it's not allocated to "authenticated users" but to a specific group. Add (say) 5 computers to this group, let it install. Once those are done add another batch of PCs and so on until all done - like this, you don't stress out the network too much but it does mean it can take a few days to get everything done.