_Adam_

A quick search found this website which looks the cleanest way: My vision on future workplace and datacenter: Default program opening file on RDS/TS The more complicated way is to update the registry key under HKLM.

The 4100 series switches from a quick scan of their manuals seem to be edge switches, not core. I may be incorrect here, but routing does not seem to be a strong point which any core needs. Hence the forward-protocol commands I gave you will not work as you found. When switches do not support PXE across VLANs, then you may need to revert back to DHCP options (minimum options 3, 6, 66, 67). I am not familiar with the Juniper device at all, so TheScarfedOne may have better advice here. If you're seeing the gateway IP of the 192.168.0/22 to 192.168.0.72, then I think the route command needs to be ip route 192.168.0.0 255.255.252.0 192.168.0.72.

The simplistic answer is ADR and NAP do not work well together, unless you manually catch new updates and apply NAP Evaluations to them, or design a script to do this. Going to scrap the ADR configs and revert to static update groups which is less admin.

Is there a route between 192.168.68.x and 192.168.0.x? If so, add the following commands to the 192.168.68.x vlan: ip forward-protocol udp 192.168.0.12 tftp ip forward-protocol udp 192.168.0.12 4011 I have not tried this directly with WDS, but with SCCM which manages WDS.

We have successfully been running NAP now using NPS and WSUS for some years. To consolidate and treat SCCM as a one stop shop we have brought WSUS under its roof. By association this means NAP will also be controlled via SCCM. Enabling NAP on updates is straight forward enough, but does anyone have any experience with ADR groups and NAP? When a new critical update is automatically deployed I suspect it does not get the NAP Evaluation enabled and therefore not get checked. Do we need to revert back to static update groups for NAP, or can someone offer some insight as to how ADRs handle NAP? Thanks.

After several days with the aid of a MS ticket it has been resolved and working well. Too many changes to list here for others unfortunately.

Asking here before raising an MS ticket, but has anyone published Exchange 2013 through Forefront UAG 2010 SP3 (with Rollup 1) and limited it to NTLM authentication? For me, it works for everything except passing RPC through UAG which breaks OA. I followed this guide without issue: Download Publishing Outlook Anywhere Using NTLM Authentication With Forefront TMG or Forefront UAG from Official Microsoft Download Center The Remote Connectivity Analyser throws an error at: Attempting to ping RPC endpoint 6001 (Exchange Information Store); The RPC_S_SERVER_UNAVAILABLE error (0x6ba) was thrown by the RPC Runtime process. Telnet to the 6001 port internally works fine. I am hopeful someone is running a similar config and I can compare key components.

Although I agree with the comments of the ease and quickness of applying applications in a task sequence, I do believe with a slight change of your thinking user/device affinity would give a similar result. The only other option I can think of is if the applications are advertised (sorry deployed ) to collections for automatic silent installs, run a script that at the end of your task sequence it auto logs on and sits there for a predetermined amount of time. The SCCM client would then carry out the installs (you can even trigger this event). After the set time expires a second script can clean up the auto logon settings and reboot.

Your explanation of the setup is full of inconsistencies, however based on your post #7 I would either suggest using another patch lead or set the interfaces back to auto as a test and see what they negotiate themselves to, which could show an issue if it's not 1000/full. Although your config could be better (not your fault as you say) nothing in it should cause the drops.

A witness or quorum is only needed if there are an even number of hosts. Although I run 4 x 10Gb fully redundant in our environment, the principles are the same, so going back to the OP setup it looks good for your environment. Clustering is only really used if direct access to your storage is not available from a host (traffic is redirected over the network). This should rarely happen so it is safe to pair it with live migration, but if it does occur and you migrate a server you will see a big slow down. You can create separate networks for clustering and live migration or use the same, with management as the secondary in both cases. Both are in different areas of Hyper-V with tick boxes for selecting the networks to use and then ordering the priority. In 2012 you no longer need to set the metric (well I have not, always seems to be correct when I check). I would probably take the spare NIC and add it to the cluster/live migration team.

There are many examples available both from HP and general searching. A good example is from this very forum - http://www.edugeek.net/forums/wireless-networks/69614-vlan-config-procurve.html As gshaw states, it is understanding what is "in" is the greatest hurdle to understanding ACLs. Have a go and if you get stuck post the config.

By giving vlan50 an IP address you're adding it to the route table which is why guests can access everything. You have the right idea, keep the guest network 100% isolated from your inside network and I would usually achieve this by using a dedicated port on your firewall device and let that be the DHCP server. However if you're stuck on using the switch, you may have to throw in an ip-helper and tight ACLs to achieve a similar result. Use your ISPs DNS servers, ip-helper for DHCP, and lock down access to your other subnets with ACLs as well as traffic outside down to 80, 443 and other required ports (such as DNS). Can the Cisco router take on this role?

I do not have Toshiba experience but both HP/Lenovo notebooks are a system board swap for forgotten passwords (as told by their support teams). If it was not the power on password you would have a better chance.

Big picture only - VLAN 1 - untagged - 1, 3, 5, ... , 23 VLAN 2 - untagged - 2, 4, 6, ... , 22 VLAN 3 - untagged - 24 (not sure where you got port 26 on a 24 port switch, but have not looked up this particular model) - for the server VLAN 1 - create a deny ACL to VLAN 2 range VLAN 2 - create a deny ACL to VLAN 1 range Enable IP routing, make sure VLAN 1,2 have ip helper set up for DHCP server. Get this working before you worry about tagging ports which overcomplicates things.

There is a bit it could be, but just basing it on what you wrote have you updated your subnets under AD Sites and Services to include the new VLAN subnets?

1) NAP is effectively controlled by the NPS role. This can be on a DC but in our case we found NPS was peaking the DC due to the number of authentications and so we moved it to its own server. 2) I think there is a Linux NAP client but I haven't really looked. I would lean towards no for OSx, etc. NAP is tied very strongly to the Microsoft Security Center and so it's natural it is not on other platforms. 3) NAP can tie in with 802.1X, DHCP, VPN, etc. Essentially it is easy if you make good use of the Event Viewer on the NPS server, but this is based purely on your skill level with whatever form you choose. 4) Assuming you mean 802.1X (this is not NAP), NPS tells the switch to set a port after authentication to the chosen VLAN for that user. The IP comes from your DHCP server. As for 'foreign' devices, if they fail you can put them to another VLAN such as Guest or leave them in what I call the Remediation VLAN which gives them very little as a non-domain user. If you build a test environment, make sure it works as expected prior to introducing NAP to keep it simple (ie. if 802.1X is your choice, get this right before adding NAP components).

Same problem experienced here. I am interested to see if anyone works it out. We do a quick fix of Internet Options -> Advanced -> Reset. Get's it going. It's not group policy, not the cache server, most likely something in the latest image.

We set up some OPACs for catalogue searches on old PCs with a light weight linux, works great. Not only is it fast all round but so locked down anything a student tries with just restarts the browser. So I will join the above linux camp as the best option, there's also an open source client "VMware View Open Client". I agree linux can seem daunting if you have not touched it before (or any UNIX/BSD), but consider a trusted student who has an interest in it to help you.

Just to address a couple of points. Let's say the DC is 10.10.1.1 and this hosts your DHCP server, in your other VLANs where you want DHCP available to clients use the following console commands: conf t vlan xx {xx is the VLAN ID} ip helper-address 10.10.1.1 Exit and write mem. That's it. In your DHCP server you will create a scope for the subnet you have created and under options place the DNS server IPs, this is how clients learn where to find DNS servers when in other VLANs, or else they would have to be static entries. You were also correct asking about Sites and Services, under Sites / Subnets you must tell AD about the extra subnets you're introducing. One entry is enough, for example I use a lot of 10.10.x.x subnets so I have 10.10.0.0/16 to catch the lot. For me each VLAN is /24 (Class C) or less. Originally I started larger, but a network audit taught me /24 is as large as I want to go to avoid excessive broadcasts. Also only trunk the VLANs you need at each edge switch, don't trunk the lot for the sake of it. For VMware there are two ways with vSphere. Tag each port (with more than one tag if you like) to each server NIC individually as you write, or trunk them as a whole. I went the former but a recent VMware paper on the subject means I am going to swap to the trunk. There are advantages to both ways so I recommend reading up on it. Your last question about stopping access to certain servers I believe has been covered with ACLs.

Having run 8, 9, X as standard users (with SEP and without) and having no real problems, I suspect you're running 9.0 which did not support roaming profiles. The reason for this is you say you have escalated students to admin rights and it is still an issue but the Administrator account (which is local) works fine. v9.1 onwards fixed the roaming profile issue. I know you mentioned you tried the latest version with poor results but I put that down to either a quirk with your image or another issue masking itself under the first. If you want to do minor testing, just create a new local user with user permissions and log on, pretty sure it will work for you.

Ultimately it all comes back to Windows NPS (802.1x) for both WLAN and LAN. This requires significant setting up so think carefully before going down this path. I should mention that this works for us more so as we're a secondary school with a 1-1 program, every student has a school notebook. But if they were to walk into a pool or use a spare with NPS they would still be assigned correctly. For us pools are dying out, next year we will have none so we're very reliant on the WLAN infrastructure. There are also products from Cisco, HP, etc that do the same role as Windows NPS but a lot more expensive.

We have a similar setup to what you're proposing. Only major addition/difference is a per year level VLAN for students (each fits in a Class C) and a VLAN for staff. For your thin clients I would consider a device VLAN for them and other miscellaneous devices (such as projectors). For the guest sessions it is up to you.

Everything SYNACK says I agree with, though since budget is an issue and you're only needing to store files a NAS device might be a cheaper fix, even an older model on eBay might give improvements. Of course if the budget allows look to a SAN. Keep in mind a good RAID controller alone will not give great results unless you match it with the right number of spindles. Just noticed the 2nd page, the ReadyNAS device looks like a great place to start. I could not find how much cache the controller has, but is a nice platform for testing.

Basing my judgement of your file server SATA/RAID controller on your current switches, I doubt it would deliver enough data to stress the 1Gb NIC and you would not see any improvement to your end users (those on 1Gb already) by adding more NICs. Just a thought before you spend big.

The never ending story, well it ends with your budget. HP or Cisco, 10Gb is expensive once you add modules, cabling, etc. Price it up to help your decision making. If you do go all out consider the 8206zl in place of the 5406zl as it provides redundancy you want in a core switch as your customers come to rely on IT more. As mentioned previously trunking is probably fine, are the students loading their work from the same file server? What is the available bandwidth from the server? If it's trunked also what is the speed the data can come off the disks? And so on. Two 48 ports trunked directly back to the core sounds good, just go with what the budget allows and aim to get a true core switch, not an edge that can route.