shadowx

Here's 2 pence... We set up a windows network last year and went virtual for our service servers, by that I mean everything except the AD servers. We have two virtual hardware servers. Both identical, they run Server 2008 Data center on 52gb RAM with 2 quad core CPUs They are connected via two switches spliced so that each server connects to each switch and the switches are then in turn spliced into the Data SAN. The SAN hardware has two controller boards which each have 8 ethernet ports meaning that you can loose "half a SAN" and still have full data connectivity. Each board is served it's own power and network so they are independent. The way it works out is that server1 is connected to Switch1 and Switch2 which are both then connected to the SAN, each switch is connected to each controller on the SAN (See the attachment) This gives almost total redundancy: If server 1 completely goes offline all the virtual servers auto-migrate to the working server. If SwitchA goes both servers route through SwitchB. If the SAN controller 1 (ctrlr1) goes offline ctrl2 can route all the iSCSI data itself so there is no less there. Essentially we can loose a whole server, a whole switch and a full controller board (IE it's PSU and it's 4 port NIC and it's own dedicated motherboard and on board firmware) and then with the raid we can loose one of the 6 hard drives completely too yet still retain 100% efficiency with very minimal user downtime, something on the order of 5 minutes while each of the servers migrates. Due to the AD servers being on dedicated hardware sessions and logins are all kept so it is just simply things like loss of connection to the SIMS database for a few minutes then it catches up where it left off. The hardware of the servers is powerful enough to run all systems on one set of hardware for (in theory) an indefinite time. This means we can install updates, reboot, change hardware etc.. with little to no impact on staff in the middle of the day. The servers run about 8-9 services including multiple SQL instances for things like SIMS, Sharepoint, SCCM, Biometrics etc.. so they are real workhorses. I can't remember the hardware models we have but I can check if you want. I know they are HP Rackmounts designed for virtualization. There are really only a few threats to uptime, one is fire/flood/physical destruction of the room since the servers all sit in the same cabinet in the same room. The other is power, they do have two UPS's (again spliced so each server is in each UPS) but they are just there to prevent a hard shutdown, they wont keep the servers on for anything more than about 10 minutes and the last is a catastrophic software corruption. We do have backup for that situation of course but it wont be an instant restore. And of course if the rest of the network, EG a switch, goes down then those users loose connectivity. Server 2008 Data center gives us unlimited virtual servers so as we did for the biometrics we can just partition up the SAN and get on with it, no worrying about licensing and what not which is actually a lot more useful than it sounds... With the biometrics the usual process is to install the server stuff on to the school's existing SIMS server, knowing how finicky SIMS can be we just setup a brand new virtual server that just hosts the biometrics. Same for printing, a stupidly small server but as it doesn't cost us anything it has a whole virtual server to itself. Really gives you some granularity when it comes to updates and backups etc... as each server is sandboxed. The AD servers (of which we have two) are each on their own hardware. As they are the backbone of the network and knowing what windows is like it made sense and as it would happen one of our AD servers has been offline for the last 2-3 months until this summer when we are going to rebuild it. Again the hardware is powerful enough that we can provide a good level of service based on just one server. It's not been perfect but it has kept us going. It cost around 30k including all the hardware and licensing. But that price is just for the 4 servers, two SANS (One for data which is user documents, files, DHCP, DNS and the second for the VDIs) and a cheap cabinet. We didn't touch the rest of the network and run our own cabling in the room itself and did everything ourselves. If you outsource any of it then you'll obviously pay for it.

Old thread is old... And full of crap, but nonetheless just to add my 3.5 pence... We got our biometrics last week, aside from my other thread regarding the costs of it I think it is a good system, and believe me, I'm not easily pleased. But let's look at the FACTS of the system.. It stores data as a hash/checksum/whathaveyou, their site (biostore) describe it like putting an overlay over a map of London, putting a dot on the train stations then taking the original map away leaving you with a number of dots. You can't possibly recreate the map based purely on those dots, but obviously putting a map of London underneath and seeing the dots match up would confirm a match but putting Paris under there would give a mismatch. Based on that fact you can have all the fingerprints you want, I wouldn't even hesitate to zip them all up and email them to you (Other than the fact that the borough, government, papers, school etc... would need new pants due to their lack of understanding) The point is that the hashes are useless to you. The only way you can use them is to install the same system with the same readers with the same algorithms with the same salt (I am assuming a salt is used) and then scan the finger print of every student until you get a match (Oh, and scan every finger too) even if you were to achieve that the matching algorithms are too inaccurate to be used in a court of law, so what are you going to so? Set up your own cashless catering system, enrol all of our students against their wishes then force them to buy your overly prices bagels so you can take the money from their accounts? Lolz... It does speed things up, maybe not by loads and loads but it is noticeable. Our card printer takes about 45 seconds to print an individual card, given that in year 7 we have around 130-150 cards to print not to mention the new year 10s who get a new photo (another 130 odd) and the people who have lost cards (20-30) you are saving so many work hours... Oh and cards and ribbon cost a BOMB to buy. When a card is broken or lost a student has to pay £3.50 for a new one (except for FSM etc...) Cards can be stolen by other kids, or shared so that little timmy who is all of a sudden "very big" timmy can spend a fiver a day on sweets using his mates card without his parents knowing Expensive? Well yes. Especially in our case. But if you shop around and plan well I imagine it pays for itself over a few years anyway in the cost of cards and ribbon for a card printer.

Just having a shiny new biometrics system being put in place and the inner geek in me can't sit back and watch! I've already got PHP code that can take a black and white image of a fingerprint, sharpen it up then convert it into a binary string/hash (This is based on the idea of Biostore which turns a fingerprint into a unique and anonymous hash) but now I am in desperate need of a fingerprint reader to pump the image into PHP. Does anyone happen to have one? (pretty please?!) Anything that will pump out an image will be fine even a little finger print usb mouse thingymajig. Happy to pay postage via paypal from my own account but looking for a freebie really otherwise I might as well just buy myself a usb mouse with a reader off amazon or something.

Have you put the moodle server in your DMZ? You might need to setup a port forwarding rule on your firewall too in which case you just want to forward port 80. In our setup we have our external router which is plumbed into the firewall and in turn that is our gateway so assuming you have a similar set up you need to do the following: Reset the moodle server IP to your external convention, let's say we call it 192.168.5.5, it doesnt need an external address as such but let's pretend that you want 11.27.45.222 to be your "External" IP (IE if I type that in to my browser I'd get your moodle, naturally you want to DNS it to be moodle.school.com or whatever but the important bit is that IP, you need to sort out external DNS with your ISP) You then need to setup a port forwarding rule on your firewall. Port 80 is HTTP so you want that and if you use SSL you need 443 too so your rule would be similar to: Forward anything on the incoming IP of 11.27.45.222 which is on port 80 or 443 to the internal address 192.168.5.5 Different interfaces represent it in different ways, check the manual for your firewall (HAH! Manuals! Google it ). All you need to do is take traffic coming in on the EXTERNAL IP on port 80 (and 443 if you use SSL) and redirect it to the moodle server's IP. There are security issues obviously so make sure your LAMP server is up to date and you keep moodle updated and use secure passwords yadayadayada

Try a few logins with the wireless off and connected via ethernet. If it all works then I would look at GPOs possibly. Just try disabling them all and see if it makes a difference. Might not but for what it is worth you can test it in the space of 5 minutes, just remember once you disable the GPOs login to the machine as admin and run "gpupdate /force" in cmd. Do the same once you re-enable them. That forces a refresh of the GPOs otherwise windows holds on to it's cache like a one armed man on a cliff.

You sir are a genius. The documentation for windows commands is crap! If you google a PHP function you get the PHP manual showing all the expected and optional parameters and examples. Google windows stuff and all you get is people showing off the fact they have microsoft certifications! Got there in the end and got this little bit of code for anyone else who is interested in doing something similar: Firstly define the variables, gotta love VBS... -.- Use the info variable to get the logged in user and computer name Set up the http connection object, give it the URL to hit and the method (in this case GET, as all we need to do is request the data rather than POST data to the server) and include the USER and COMPUTER variables in the url for PHP to process Send the connection Then for debugging echo out the HTTP status code. Works a charm for me, so now the fun bit, I get to do some more PHP coding

That is pretty much exactly what I want to do, just trigger a http request, will do some googling on that library/function, thanks! Genius, didn't even think of that... If wget works like we both (now) expect I can simply call it as an external exe and pass it the URL as an argument and bob's your uncle! Thanks to both, will have a google if I get a chance in between cable pulling

I'm going to start work on a quick and simple PHP/Windows logging script that will log every time a user logs in and out of a PC as well as tie the events together so I can see whether or not a student logged off from a particular session. Anyhoo the PHP wont be an issue, the problem is simply getting that login event to the PHP receiver. There are two obvious solutions I see each with drawbacks. Option one is to make a publicly writeable CSV file on the LAMP server and have the batch file echo straight into it. It's the simplest option by far but the drawback is that to make the data "live" in PHP I would need to read directly from the CSV with a database used for archives, the problems with that are two fold. It's a massive security risk opening the whole server to a clever (albeit it VERY clever) user and files are single access so if the login script runs twice at the same time (IE two users log in) one of the sessions will lock the CSV meaning I get no data from the second session or a corrupted CSV. The second option which is by far the best is to have my login script hit a PHP page similar to "log.php?user=auser&machine=XYZ" the php will then error check and make the data safe and insert it into a database safely. This gives me safe, accurate data, multiuser/session support and error checking as well as live data when I view the log. The problem being I can't make a script to hit a remote PHP page. Under linux I could use "wget", I know wget exists for windows but it requires me to deploy wget to all the machines in the school then risk incomplete data if I miss a machine etc... so I am looking for a built in, windows standard for calling a remote webpage without triggering user response or a browser window. I don't need any feedback from the PHP script it will all be silent. Any ideas?

When it comes to the administration of printing itself the Resources department handle it all, they used to do it more manually, collating the reports from the individual Multifunctions and pulling out who spent what, now papercut handles some of that so thankfully I don't have to content with staff who are convinced they need more printing credit and what not. Ultimately though I don't want to get bogged down in silly printing issues which is my main reluctance to get admin access to paper cut. As with most things if I/we have access to it we become the sole operator of it in the staff's eyes and then we would end up with the whole banning kids for printing too much and all that. I have emailed our installer/supporter regarding admin access as it turns out that even the Resources lady who should have admin doesn't actually have true "Operator" status if you like, she has "Account/Budget administrator" type access so as it stands no-one has true admin status 0.o Probably a mis-communication somewhere...

Well it was installed by a third party with no input from us, and we don't have admin access, we could get the password from the Resources people but we are taking a hands off approach at the moment. The key problem is mostly that jobs aren't recognised by the printer devices at all. The setup is a bit strange to me, we have 3 "public" printers, one in the staff room for just staff of course, one in the Library for everyone and one in the office for... Well just for the office really. The idea being all these printers are referenced by the virtual printer "School Printer". When printing to that printer you should then be able to go to any of the public printers, type your PIN in and it will print out your job to that particular printer. It works for the staff room but the library is a different matter... Students don't have PINS, their jobs should just spew out, but that doesnt happen, the librarian has to input her code which then allows the student jobs to proceed. This happens apparently at random. Othertimes she will put her code in and it will display no jobs. The print history and queue on the device show no evidence of the jobs whatsoever. Windows itself is adamant that the job has been printed successfully. As I said, it is almost random in that sometimes a hand full of the machines in the library will show these problems then they will work and others will fail or they all fail etc... We have had the third party installers in who provided the printers and installed the software and on both occasions they happened to turn up at the exact time that it started working temporarily and as we all know if you can't replicate the issue you can't do much with it. The devices are Ricoh branded I believe.

Really?! Perhaps it's time for all three of us here to resign then! We run MF since recently when the school decided to implement the system with about 0% consultation and it's caused more problems than it's solved. Perhaps it's our setup or the guys that installed it but we have sporadic issues with two of the multifunctions just idling away and not printing or even receiving jobs, sometimes the PIN entry doesn't work, sometimes it prints without the PIN sometimes it doesn't print at all. I just doubt the fact that it is as popular as it is claimed to be, but evidently I'm wrong! To me it seems like the kind of software that would be a lot cheaper or even free or at least something that could be hashed together from free products. But then what would I know? We (The network admins) don't have admin access to it so perhaps it is great after all!

You could make one.... Get a touch screen for hundred quids or so and mount it. For the backend use some PHP to pull a list a current staff from the ad, format each staff name into a big touch friendly button. On click (touch) it sends a hidden form back to PHP with the staff member's name, this is then sent to the database, if in the database the user is already "onsite" it sets them to "off site" otherwise it sets them to onsite, therefore if they are signing in it will set them as "on site" if they are already signed in, and hence signing OUT, it will set them as "off site" make a report page in the event of a fire that pulls out all users with "on site" and there is your register. There will be more to it than that, I would probably change the colour of the buttons so when the list is presented to the staff it shows a green button to sign in and a red one to sign out or something and various tweaks such as a "oops I hit the wrong button" function just in case someone fat fingers it and signs someone else in by accident. Saves a thousand pound, you get a system you understand rather than some offsite support and you can hack it about to make it perfect rather than relying on someone like cunninghams to do it for you (if they ever do).

Mainly curiosity... Apparently "loads of schools use it successfully" I doubt this. Anyone else out there?

We spent about 6 months trying to get SCCM to work here and frankly I have done very little with it, but the two guys I work with who dealt with SCCM had to reverse the partitions in the Task sequence, for some reason SCCM was trying to restore the Image partition 0 to the DISK partition 1 (Which actually meant it was trying to whack the full C drive into the partition which is the "System reserved 100mb" partition, hence failing.) The other thing was to partitition the second partition as a percentage, so on a 160gb disk put the C drive at 159.XXgb and then the second, system reserved 100mb partition to "Remaining space" and let it get on with it. But to be honest our SCCM server has been installed about 3 times, randomly stopped working for a few weeks then with no changes made started working again (It's done that twice) and we never got the Build and Capture rubbish working, we found the same guide linked in this post, just making a CD to capture a working machine. Frankly SCCM is not ready for use and my advice is don't buy it. It's pants. Alternatives would be something like Ghost (for imaging, or Clonezilla) Impero has a wicked deployment tool as part of the whole package, GPO (Bit dodgy) or scripts.

I disagree, being a linux user I love scripts and command lines, they are much more flexible than GUIs, more verbose and easier to get an exact action, rather than a more general one which you usually get from a GUI, though if you mess up with a script then you *really* mess up Not to mention microsoft hasnt bothered making GUIs for half the stuff they do, sharepoint server still makes massive use of a terminal as does their licensing stuff.

Google "Cacls" it's a command line utility build into windows (I think it comes built in anyhoo...) we recently migrated from a full Novell/Netware system to a full windows 2008 system and use Cacls and some (admittedly rather good) batch file writing to take the blank folders for home directories and shares and apply user and group permissions to them. Print yourself a log using ">>" in the batch file and you can can skim through it afterwards to check for any nasty folders that didnt take the permissions correctly. It should do what you want

We do the same except we use a windows server 2008 (which is the print server) to do the print management side of it. Install the printer on the server and using the print manager add the relevant drivers for different versions of windows (XP/7) then deploy via GPO and attach it to the GPO we want. Oh, also if you are using the preferences extension of the GPOs with XP workstations you need to install group policy preferences extensions (or something like that... cant remember exactly) on to each XP client. Perhaps you already know that but always worth remembering just in case.

Simplest thing is to give her a new, different brand, laptop to trial for a day, if the issue goes away get an external wifi card for the laptop if it has an expansion bay, otherwise get a new laptop. If the issue remains swap out the AP for a known working AP, if the issue goes then it's a dodgy AP/Setting, if the issue remains with a known good AP then look at your cable connection/POE/Power

Fair point, if it doesnt affect the pricing much then go cat6 but otherwise cat5e would work fine, it's still 1gb prodivded, like synack says, the cabling isnt overly long or badly run (IE crossing power cabling all the time). Personally I would run cat5e because we have loads of it laying around But then if I were buying cable without worrying about price then I would just get the best I could so Cat6. Swings and roundabouts.

Googling the term I can only find info saying that Plenum cable is fire resistant? If that's the case then it's down to the school to decide really. Unless I'm reading something totally different it wont give you any network advantages. How much cable running have you done in the past? I dont want to spew out loads of stuff if you already know it but if you've never done it before then I can talk you through the things we do when it comes to cabling. Like I said, I've only been in the job 3-4 years so Im not an expert and the only qualification I have is a CCNA 1 from college which is expired anyway so no doubt there are other more knowledgeable people on the forums!

Depending on the layout cat5 would do the trick, the only issue will be the cable length but realistically even 100mb/s cable would supply an AP sufficiently. It also depends what sort of trunking and loft space you can run the cable through, we run all our own here and since i've been here (3 years) we have run loads of cables, mostly for wireless APs. Just make sure you measure out your runs properly, we dont usually cut the end of the cable, we just bunch up 6 or 8 or however many cables, wrap em well in insulation tape at the cut end so it can push through trunking as one unit and wrap a bit of tape around the cables every couple of meters, pull the cable from the boxes through the trunking then once we have the run complete pull a few meters spare and chop the box end. It also helps if you keep a count of how many meters roughly you pull. The boxes have a label for writing down what you pull so you know if you have enough for your next run or not. Usual stuff, avoid power cables and avoid fluorescent lighting like the plague. If you have to go near power cables get shielded, otherwise standard twisted pair would do the trick. Make sure you have a reliable cable tester, a mask might come in handy, trunking gets pretty dusty! And decent tools make it a lot easier and more pleasant than fighting with a drill or balancing on a dodgy ladder

If I understand what you want correctly then you just need to put the Sharepoint server in a DMZ and port forward it. We host our own external services here so our DMZ is already set up, depending what firewall you use just google around for DMZ instructions and put your server into the DMZ and make sure the correct ports are passed on to it and you should be golden. You would also need to setup external DNS entries so you'd probably need to talk to your ISP and get a subdomain routed to you. we use https://school.ourschool.sch.uk and although I haven't tried to use an app we know it works externally as a sharepoint sitel

Thanks for the reply, what I am hoping to do with the extended star is to give us loads of expansion, currently if media wanted 15 macs we dont have the capacity to wire them in so we would have to either daisy chain a new switch from the existing one in that area of the school using cat5e or run a whole new fibre link down a pretty tough corridor, and whack a new switch on that. If we do what I want to do then we would have our fibre termination point in that corner of the school anyway so we can easily patch in a new switch directly on to that fibre and be done with it. It makes sense to me anyway... To be honest we arent sure what causes the occasional slow down on our network, the server side of things is all brand new and running over multiple 1gbe lines so I reckon it's purely the dodgy state of some of the cabling (bad trunking, kinked cables, interference) and the huge subnet we have. You answered my questions anyway so thanks!

Afternoon chaps and chappettes. After a fair big of ear twisting it looks like SLT are ready to look at an infrastructure upgrade in the near future, possibly starting as soon as the end of this year. I've been in the job 4 years with no previous experience so I'm looking for some advice and hopefully if there is anything stupid you can point me in the right direction, but I think I've got this... My CCNA1 came in handy Right, we have around 350 workstations including laptops which are wireless (The wireless system is a whole different issue though...). We have two virtual hosts supporting 7 or 8 virtual servers, the most intensive of those network wise will probably be the SQL stuff which ultimately provides data for Sharepoint and the SIMS server and finally a microsoft RDS server providing remote desktops outside school for staff use. We also have two physical AD servers in a failover cluster handling DHCP/DNS/AD and file sharing. We have a massive subnet at the moment (255.255.0.0) so DHCP and related services do take up a chunk.... That's the background info anyway. So, firstly why should we use fibre? I fully intend on using it but if someone asked me why I wouldnt know an answer... Properly terminated and placed in theory cat5e and 1gb fibre have the same bandwidth but I have a feeling this is more to do with latency, signal quality and signal speed meaning fibre gives a more reliable and speedier signal from one end to the other. The higher signal quality reduces lost packets at the receiver and gives an illusion of faster speed...? Google hasnt helped so far with that one...... Secondly is toology. Without writing a life story I am leaning towards an extended star topology with a 10gb fibre backbone connecting servers and the "primary" switches, then 1gb fibre starring out from the primaries to "secondary" switches which just spew out cat5 to the desktop. The theory behind it being that if the secondaries are connected by 1gb fibre and we have say, 7 of those, then primary switch is only dealing with 7gb worth of data and putting that on a 10gb line to the server, hence bottlenecks will be very few and far between. We are not going to get anywhere near to the 10gb limit any time soon but as it stands media are trialling some Mac desktops and if they get the go ahead they could end up with 20-30 macs all streaming HD video footage at the same time as everyone else trying to logon, use SIMS etc... at the start of a lesson. Anyhoo, that's enough for now! Would really like an answer as to why to use fibre instead of copper (aside from distance limitations). Cheers

Old thread is old, however I'm reviving it so you know Im not alone... I have the exact same error message as above with file names ranging from 1-6 and probably higher if i sat there and tested each room. The user is trying to do an asset report using Finance to show assets per location (room) when double clicking a room or selecting to view a room the error pops up. As far as i know everything else is fine in that the user hasnt mentioned any other part of SIMS/FMS playing up. Is there any info on this at present? All staff users are local administrators and the rest of finance works fine. Im pretty sure it isnt a permissions thing since if it was then finance would error at logon due to access/modify rights on the PDOXUSERS file and since the user is a local admin she should have full access to the C drive. (Only selected machines have this level of access purely for the finance module, its not ideal but it works and with workstation images the damage is limited.) Anything? Google says no