TheScarfedOne

Simples, single Task sequence for our main machines. Only have different ones for laptops which do bit locker related stuff. Then there are AD groups which are tied into collections which fire of other task sequences. Agreed, set up right it is a genius piece of kit. You do need to invest the time in setting up a collection and TS structure.

Hehehe, puuuuuuuuurfect

Good spot @witch :-) thanks

This sounds like a plan. I'm sure some stand will have an appropriate toy we can use

This post is a continuation of my battle to compelte a cohesive intranet; and some more ramblings about Sharepoint. Its turned into a monster of a project this one. The external single sign on (SSO) was a breeze - thanks to Forefront Threat Management Gateway (TMG) - but this presented an issue - internal or external, you would be faced with a logon screen. Not ideal - internally we wanted a double SSO which would use your Active Directory logon session to SSO with the TMG HTTP session. Lets pick up that story.... A quick review Where did we get to? We had just finished with creating our Split DNS infrastructure - and Id outlined the need to then play with your web publishing and listeners in TMG. We need a new web listener, which will be waiting for incoming requests only from the internal network. As you probably already know, a Web Listener is a software component that is used by Web Publishing Rules. The Web Listener accepts incoming connection requests for published Web servers. Web Listeners define the authentication methods that can be used by the TMG firewall to authenticate users before the connections are allowed to the published Web server. This is often referred to as “pre-authentication”. There are many security advantages to pre-authentication and if your site requires authentication, you should always take advantage of this option. TMG Configuration - Step by step... 1. On the New menu, click the Web Listener option - which brings up the Welcome to the New Web Listener Wizard page 2. Enter a name for the Web Listener here. In this example, we’ll name the Web Listener HTTP Listener, with the intent that this Web Listener will be used for accepting incoming connections to using HTTP Authentication. 3. To match up our external to internal (really just to not confuse users - and think here, we are using HTTP authentication; you should really use some kind of encryption for security) you should ensure that you choose "SSL". 4. This will need HTTP authentication not forms authentication (which our external network will be using) - this allows it to use the same details that TMG/ISA itself is using to recognising our clients already for things like proxy (if you are using it). NB-Image from the "Edit Properties" version, rather than the Wizard screen - so your screen may look slightly different) 5. Next up is telling this listener to only wait for traffic from our internal NIC. So - in the image below - you will see Internal network is selected only. Your other external listener needs to have Internal de-selected, which you can change by editing its properties. That finishes off your listener configuration. We than also need to change our existing rule so that it only listens on the external network. That's not where it ends though - as we then need a load of new publishing rules for our services to match up to our listener. This should be relatively simple though, as you can copy (select rule, right click and choose copy, and then right click and paste. I would then disable the copied rule while you do the editing. Your new "internal" rules should be above your external rules so make sure you move them up. You also need to change the listener used in the new rule, and the authentication delegation. When you change to internal http listener services, you cannot use ntlm as your authentication method. For things like Sharepoint and Exchange, this means moving to Kerberos. Now, from the Application point of view, this is quite easy to do. You will need to set up several srv records, and also allow TMG to act on behalf of your Sharepoint and Exchange servers when it comes to credential delegation. Sounds scary? Well, some of it can be if you haven't done it before. It also gets a bit more complicated if you are running a farm for these services, as you cannot authorise a server which to all intents and purposes doesn't exist. The rest of this article will cover the TMG steps, the next one will cover the Sharepoint/Exchange and Kerberos side of things. Kerberos Constrained Delegation (KCD) is a primary functionality of the Kerberos protocol introduced in Windows Server 2000 domain environments for authenticating users, services and computers. If a published Web server like the SharePoint needs to authenticate a user that sends a request to it and if the Forefront TMG computer cannot delegate authentication to the published Web server by passing user credentials to the published Web server or impersonating the user, the published Web server will request the user to provide credentials for a second time. ISA Server 2006 introduced support for Kerberos constrained delegation to enable published Web servers to authenticate users by Kerberos, after their identity has been verified by the ISA Server using a non-Kerberos authentication method. The same continued into TMG 2010. When used in this way, Kerberos constrained delegation eliminates the need for requiring users to provide credentials twice. To get Kerberos Constrained Delegation to work, we must change the Authentication Delegation method to Kerberos Constrained Delegation in the Forefront TMG Management console for the SharePoint publishing rule. The Service Principal Name (SPN) is host/InternalDNSFQDN of the SharePoint Server. So, on the properties of the rule (make sure you are still working on your internal rule here, and don't break your external one), on Authentication delegation, choose Kerberos. You will then need to enter/amend the Kerberos SPN name. Next up, in Part 3 will be the SETSPN tools you need to use to allow the delegation to work; how to check this - and also making the changes in Active Directory.

No problem, drop me a message if you have a dll you'd like me to test

Just got myself some shiny Overland kit from @Net-Ctrl 12tb (8.9 usable) DX2 snap server, and a Neo200 LTO5 library (IBM underneath) with 24 slots

Running Jellybam on my Sensation for exactly this reason. Custom roms ftw

No Faronics?? That means no polar bear silliness this year @Ric @vikpaw

Using the same code as posted earlier bookcharging(booking.NextLesson().NextLesson()) bookcharging(booking.PreviousLesson().PreviousLesson()) The booking gets made, and the emails sent (including Admin one, but it doesnt perform the actions in the rule - the error above is posted twice to the event log)

Heard similar hit and miss with HP models; but the Dells are supposed to be good. AV wise...using System Centre Endpoint, part of Microsoft System Configuration Manager. If you already have an existing volume licence agreement - then System Centre may be an option for you.

More Ruckus love here...just unboxed my nice new ZoneDirector 3000 today ahead of @Net-Ctrl installation at the end of the week. Removing an old Meru system... :-p

Same on the new DLL as well.

Right, before I change the DLL to the one above - heres some info from the event log for you... Failed Action: bookcharging(booking.NextLesson().NextLesson()) System.NullReferenceException: Object reference not set to an instance of an object. at HAP.BookingSystem.BookingCondition.processCondition(Object o, String Condition) at HAP.BookingSystem.BookingCondition.processCondition(String Condition, Booking b, Resource r, BookingSystem bs) at HAP.BookingSystem.BookingRule.ExecuteRule(Booking b, Resource r, BookingSystem bs, Boolean IsRemoveEvent)

Thats all fine now - somewhere along the lines, something must have stuffed in the install probably different compiles of DLLs. Ive got some bits on those Booking Rules as well which will post in the other thread.

I will see if I can get a new web server built today - theres quite a few other shared bits on this one and I cant see anything immediately wrong with it . Would it be becuase of the previous HAP Event log installation do we think?

A bit more info...im pointing the SMTP at a different server now, with logging on it - and according to it - there isnt a message going out to the admin users. I just wanted to make sure exchange wasnt dropping it.

Its been a long time since I last wrote about Sharepoint - the platform for our Intranet; but now with the rest of the ongoing projects nearing completion - I've been able to return to this monster of a project. Introduction So, lets go back to the start and show what the end goal was. 1. Intranet Portal - containing Departmental, Staff and Student Areas. Department areas would have staff and student storage as well as news, events, discussions, blogs and all the usual suspects 2. Booking System - does what is says on the tin, web system for booking rooms and resouces 3. Helpdesk System - does what is says on the tin, access to our existing online ICT helpdesk system 4. SSO (Single Sign On) - enter username and password once for all services, and transparently log in to all the others Progress to date Progress was good! The web based helpdesk (GLPI) was installed and has been in use for over a year now. Sharepoint was installed as a farm, and branded up with custom designed Academy theming. All the departmental and staff areas were added, and the supporting Active Directory groups put in place. The excellent Home Access Plus is being used successfully for bookings - and we work with the team to tweak the development. Forefront TMG was installed to replace the out of date ISA 2006 software. This gave the SSO we wanted - but also presented a challenge. Externally - we wanted the logon dialog presented; but not internally. This actually started to become a bit of a barrier to adoption... and thats where this blog post picks up the story. Split DNS So, some of you may have seen this term "split dns" banded around before. Well - that is what you need here. In simple terms, split dns allows your dns server to respond and act as if it was authoritative for a domain other than the name of your Active Directory domain. Take the following example: Domain Name: school.internal External Name: school.authority.sch.uk Now, your external access will likely come through an address such as webmail.school.authority.sch.uk or gateway.school.authority.sch.uk. What you need to do is add the domain "school.authority.sch.uk" as a forward lookup on your dns server. Once we've created the zone, we can then add the hosts that we want to internally resolve. Any hosts that we don't add to our own copy of the "school.authority.sch.uk" domain will have their requests sent out onto the upstream local authority/internet provider dns servers as normal. If you want to find out a bit more about this, and what it all really means - then there is a great write-up of it here http://www.isaserver.org/tutorials/you_need_to_create_a_split_dns.html. Lets create a new dns zone for "school.authority.sch.uk"... 1. Load up the DNS administration snap in, and browse down through one of your dns servers followed by "Forward Lookup Zones". 2. Right click on "Forward Lookup Zones" and choose new zone. This will start the wizard. Click Next. 3. We will be creating a "Primary" zone, so select this. Also, ensure that the "Store in AD" check box is selected. This will ensure that all AD DNS servers will respond to requests for the site. After clicking next, you should also select the option for all DNS servers in the domain for the same reason. 4. Next up, its time to enter the DNS name itself. If you are wanting your internal network to resolve webmail.school.authority.sch.uk; then the dns name is "school.authority.sch.uk". Enter this here. 5. We all know about DNS security (don't we?) - so the obvious choice on the next screen is "Secure transfers only" - back to how dns gets updated in step three. Only secure updates should ever be used on AD domains. Choose it, click next and then finish! That's it... simples?? Well - yes, but at the moment - our split dns doesn't actually do anything. We haven't got any hosts in yet, so all requests still go out to our isp. 1. Choose our newly created zone, and right click. 2. From the popup menu, choose "New Host (A)". This will present the new host entry screen. You will need to know the internal ip address of your host to publish at this point. For me - that was simple - its our ISA/TMG server. Why? Well, remember right at the top of this article.... all our services are published via our ISA/TMG box. Ensure at this point you also enter the name as used externally too (so this would be webmail or gateway in our example... nb, you don't need to put the rest of the address in as that is the dns domain). Internal SSO without logon dialogs So, the last bit needs some changes on TMG. We need a new web listener, which will be waiting for incoming requests only from the internal network. This will need HTTP authentication not forms authentication (which our external network will be using) - this allows it to use the same details that TMG/ISA itself is using to recognising our clients already for things like proxy (if you are using it). We than also need to change our existing rule so that it only listens on the external network. That's not where it ends though - as we then need a load of new publishing rules for our services to match up to our listener. That will be the subject of the next post - as will the playing with the three-headed dog that is Kerberos! Also in the writing is my BETT preview post; and following that, some interesting interviews from BETT 2013 itself.

A Home Access Plus + key is created at hklm>system>ccs>services>eventlog>application but can't see anything else

There's no sources node under application.....?

Dense question...how would I know? There isn't a separate log file shown if that's what you mean? I did used to have the old install able one from the v7 days I think? Could it be some leftovers of this causing problems?

Nope, still nothing. I'm going to create a new app pool and iis site in case something has gone weird...

Ok. Yep. Found that entry. Removed. Recycled pool, saw it get recreated. Tried to book a resource that should generate an alert to admins, on laptops... Email generated to bookie but not admins. Created book a resource that should generate an alert to admins, on equipment.... Email generAted to both. Cancellations sent in all cases to admins and bookies. There are no entries in the app event log.

Regedit search to the rescue. All gone, but nothing logged to app log. No change in behaviour either :-s

Ok, where in the registry am I looking. I've got a separate home access plus + log in event viewer