TheScarfedOne

+1 for Notepad++ here, awesome for code writing I find too

Yeah, they are all ok - once you give it the auth details. Differently to you, I set the proxy config on all machines by GPO - and don't use the client. I found it oddly to get in the way more often than not! I provide a custom written app to disable proxy when they are at home.

We have turned on basic as well as Integrated Auth - so that non domain devices will get a logon prompt on internet access. You know when you are at hotspots and under Win7 you get that popup - "May require additional credentials - click here to open browser"... it seems to work fine. Are you using the ISA client, or using GPO to point to the proxy, or using autoconfig?

Time to poke @rpwillis me thinks... Richard, anything that you have seen or been working on?

And doing my bit to play devils advocate - the helpline did say all day that "there was a service wide issue being addressed as a top priority by their engineers"

It was up and down again all day from the far South West. From my snooping - DNS again...

Some better output for you... Receiver a:InternalServiceFault String cannot be of zero length. Parameter name: oldValue String cannot be of zero length. Parameter name: oldValue at System.String.ReplaceInternal(String oldValue, String newValue) at System.String.Replace(String oldValue, String newValue) at HAP.Data.ComputerBrowser.Converter.UNCtoDrive(String dirpath, DriveMapping unc, User user) at HAP.Data.MyFiles.Properties..ctor(DirectoryInfo dir, User user, DriveMapping mapping) at HAP.Web.API.MyFiles.info(String Drive, String Path) at SyncInvokeinfo(Object , Object[] , Object[] ) at System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs) at System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage41(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage4(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage31(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage3(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage2(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage11(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage1(MessageRpc& rpc) at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet) System.ArgumentException

Welcome to Part 4a of my System Centre Configuration Manager (SCCM) series! So - here is probably the most anticipated post - how to get started with OS Imaging! Im going to show you how to get SCCM ready for building your first Windows 7 image - and then in 4b, how to deploy that (with a load of extra options and fancy stuff!) to your estate. In the mean time, if there is something specific you need, or that you think Ive missed, please comment or send me a PM. Alternatively, you can find me on Twitter @TheScarfedOne. So... introductions over with, lets get started! First things first, lets get into the SCCM Console. Im going to assume for the purposes of this guide that you have followed the rest of this guide (or have a basic functioning setup); and that you are Remote Desktop'd to the SCCM Server. Add the PXE Service Point (PSP) role to SCCM So, before we can get started - we need to first activate the PXE role in SCCM. This will enable our machines to boot through SCCM. Want to know more - or see the best practice stuff - head over to Technet http://technet.microsoft.com/en-us/library/bb680753.aspx You must be getting used to where we need to go in the Console by now - yes that's Site Database/Site Management/Site Code/Site Settings/Site Systems and highlight your server. Right click on it and choose New Roles, which will give us that nice wizard. Get ready for a load of Next, Next, Next! On the "New Role" screen, highlight the PXE role and select it, click next. This will want you to confirm, so say yes. Up next, the PXE - General options page. For your testing, I would suggest that you remove the password requirement - but in production, you will want one of these. It stops little monkeys getting into your deployment system by mistake. Now - if your server already has been used for WDS - and you are still using that actively whilst testing out SCCM - this bit is for you! By fiddling with the PXE server response settings - you can swap between which system you are using. For SCCM, this value should be less than the value listed in your Windows Deployment Services PXE delay, you can verify the WDS pxe delay by right clicking the WDS server and choose properties/PXE response Settings. What we want to happen here is that SCCM answers the first PXE boot request(s) from a client and if they are not associated with a Task Sequence then let WDS take over with the PXE boot routine. Now - sometimes SCCM and WDS can get themselves in a tangle. If you find things arent happening in the right order, then this is what you need.... Installing the PXE Service point adds a service to the machine and a registry entry for WDS so WDS knows what to do with a boot request. If you open regedit and browse to HKLM\System\CurrentControlSet\WDSServer\Providers\WDSPXE there is a "ProvidersOrder" key with some values in it. These values represent the boot order of WDS. - SMS.PXE.Filter - The PXE filter script added by MDT. - SMSPXE - Configuration manager PXE service point. - BINLSVC - WDS and RIS legacy menus. If you change the order of the ProvidersOrder key you should be able to switch between which device answers the PXE call first.. The above is rare though - but hey - its a useful insight into what is going on behind the scenes! Now, where were we? Ah yes, SCCM's PXE role - lets finish it off. Unless you can think of any real reason (I cant), then you will want to accept the PXE-database settings and click next. When dealing with the Certificate used for PXE, set the expiry to a long long long time into the future. The last thing you need is in a year is to have to renew it. Chances are, you will have forgotten about this setting by then - and will be head scratching why PXE booting isnt working! Save yourself the hassle then!! Last up, that summary screen, so click next and then click close to finish. Ta da! Done! Next up - configuration time: thats boot images, operating system setup files and other lovely stuff! You will need your Window 7 Enterprise / Professional DVD to hand... Create the SCCM Client Deployment Application Now we are going to get to know a new bit of the console! It will be the bit you will actually get to know pretty well, as everything you do in the future in SCCM will be done here, rather than in the Settings bit we have been in so far! So... in the console, go to Computer Management and select the Software Distributions node. You then want to right click on packages and choose New Package from Definition. We need to give SCCM a copy of the client, which it uses to manage systems; and it helps out in our build and capture also! You use the Definition option where you have a pre-build package - like MSIs. You dont have to, but SCCM creates all the install and uninstall options for you which makes life a bit easier. You will get another wizard, aptly called the Create package from Definition wizard! Click next, and since SCCM is relatively clever, it already knows about its client. Select the package called Configuration Manager Client Upgrade, click next and choose the second option "Always obtain files from a source directory". You will then need to choose the Network Path (UNC name) as the type and click on browse - choosing your sites SMS directory (SMS_xxx where xxx=the SMS site code) eg: \\SERVERNAME\sms_xxx\Client Time for the usual Summary screen, and click Finish. Right-click on the new package you've just created and review it's properties - just to make sure it matches what we have done, and while you are at it rename it from Upgrade to Installation. I have no idea why the package is called Upgrade and not Install! Create and Update Distribution Points Now you have created a package - here is a concept to get used to. Once you make one, you have to distribute it. No - that doesnt mean install it - it means make the setup files for it available. Until you do this, you will get an error "Source files not available on any distribution point" error. Not good! So, we need to select the Package we have just created (Configuration Manager Client Installation) and expand it. Right-Click on Distribution Points and choose new distribution points - select the standard distribution point only and click next (I will go into the difference between the two later on in the Boot Images section). Now that you have created the distribution point, right click on Distribution points again, and choose Update Distribution points, answer Yes when prompted. What you have done is create a reference point on the server for your installation files (step 1), and then populated it (step 2). Windows Boot Files, getting your SCCM PXE to Boot In your basic installation, there will already be x86 and x64 bit boot.wim images, however we want to create our own and then distribute them to both the standard share and the PXE share. This is generally better, because then at least you arent faffing with the default ones! In that trusty console, select Operating System Deployment under Computer Management, and expand the boot images node. Then right click, and choose Add Boot Image. Browse to the network share where SCCM stores it's boot.wim files, first off for the 32 bit one (then repeat for the 64 bit one later) eg \\SERVERNAME\SMS_xxx\OSD\boot\i386\boot.wim Now you can fill in some details for the boot.wim and call it something sensible - like x86 Windows PE boot environment for SCCM Summary time, just check it - then click next to apply the changes. Now that you have done the 32 bit boot.wim, I hinted at it a min a go - you know whats coming next! Repeat the above actions for the 64 bit (X64) boot.wim file by using the 64 bit path (\\SERVERNAME\SMS_xxx\OSD\boot\x64\boot.wim). You should now have two new boot.wim files listed in the Boot Images section. Now - when you boot SCCM normally - you would get the default Microsoft corporate background. Looks fine, yes - but why not look like a pro where you are, and put your own background in... its so simple. In explorer, browse to \\SERVERNAME\sms_xxx\OSD\bin\i386 and locate a file called WINPE.BMP, open it in Microsoft Paint and paste in your own company Logo, save the file (after backing up the original) and repeat this action for the WINPE.BMP file stored in the x64 path, this background will appear during the Deployment of Windows Vista, 7 or Windows Server 2008. Once done, right click your chosen Boot.wim file in the console and choose properties and then the Windows PE tab, select the Specify the customer background bitmap (UNC Path) and browse to your newly created WINPE.BMP file, apply the changes and answer NO to the Distribution points update reminder as we'll be doing that shortly. Remember what we did for the SCCM client installer - the whole distribution points jazz. Well, it applies here too - actually, it applies to all installs - client, OS, setup.... everything! So, we need to select the x86 Windows PE boot environment for SCCM boot image and expand that node, right click on distribution points and select New Distribution Points - which will give us that wizard. Now, heres where things are a bit different. When the Copy Package screen comes up, make sure to select BOTH of the distribution points listed, one being the normal one and the other is the PXE distribution point, both are required for this to work properly. As at this point, we are in PXE mode for the boot - the files need to be on the PXE point too. You need to repeat this for the x64 as well. Now you need to Update the distribution point, so right click on Distribution Points and choose Update.... Next up - its Operating System setup time. So... really, last warning for those DVDs!

@FN-GM images should be sorted now. Looks like ZH has put a new uploader in since which has dealt with it

Congratulations Shaun and family

Any ideas on more testing I can do for you so we can track down this one?

Software restriction policy. Create a GPO and apply it to the ou containing your rds servers. You can also restrict it to user groups. Create the settings to deny the exe you dont want running.

Nope nothing showing there Im afraid

Grrr! Will get ZH to have a look at the blog area - as its not brought the images though either like it used to. Thanks

Firefox gives a useful error... String cannot be of zero length. Parameter name: oldValue And firebug says... [] GET https://webmail.marineacademy.org.uk/HAP7/api/MyFiles/info/U/ 500 Internal Server Error 83ms jquery....min.js (line 6) HeadersResponseXML XML Parsing Error: no element found Location: moz-nullprincipal:{5bbc185f-c794-4069-9d72-27d36e5b44d4} Line Number 1, Column 1: ^ Cache-Control private Connection Keep-Alive Content-Length 2346 Content-Type application/xml; charset=utf-8 Date Thu, 09 Feb 2012 09:41:59 GMT Server Microsoft-IIS/7.5 X-AspNet-Version 4.0.30319 X-Powered-By ASP.NET Request Headers Accept application/json, text/javascript, */*; q=0.01 Accept-Encoding gzip, deflate Accept-Language en-gb,en;q=0.5 Connection keep-alive Content-Type application/json Cookie logondata=acc=0&lgn=wilkies; mycompv=sl; c27aa272ea804fc9a42b5f124897ce18MAP%5Cwilkies=0; logondata=acc=0&lgn=wilkies; cadataFEA59DF42DFF4EDF91956373266BA0F1="579266ac7-9f40-4e14-915e-99d04f07d829S8M0rGcL+pHsTLerGYdxcoGeRVlGQr1uJnVTw7iKqDTdBpSPQvPfQZ18C1gVarBJmSZ90ChPnt//FWkaEV6zUuwnHnVIFw5pucVprzhZtT8ruRd/jyjKnkd9MK9pyTz7"; ASP.NET_SessionId=bj3od31tdahxju345gkvzpg5; ISAWPLB{B5998F0A-8D39-4431-9D47-410CEE50BF36}={89822C4C-C7DF-47B3-8C6F-FDA00E162968} Host webmail.marineacademy.org.uk Referer https://webmail.marineacademy.org.uk/hap7/myfiles/ User-Agent Mozilla/5.0 (Windows NT 6.1; rv:10.0) Gecko/20100101 Firefox/10.0 X-Requested-With XMLHttpRequest

OK, have put that in correctly manually now. Getting the drive indicator (and the space use on the home page) - but its not showing files still.

Hmm - despite selecting Drive Space in the setup.aspx - it is still writing the wrong thing the the config xml. What should it be writing?

Ok cool on the ad name - will wait and see on that one. On the MyFiles issue - Firefox throws a "Quota Server" error - which is odd, as I don't have one, and haven't enabled that on the My Files setup page. Receivera:InternalServiceFaultCan't find quota serverCan't find quota server at HAP.Data.ComputerBrowser.Quota.GetQuota(String username, String share) at HAP.Web.API.MyFiles.Drives() at SyncInvokeDrives(Object , Object[] , Object[] ) at System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs) at System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage41(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage4(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage31(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage3(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage2(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage11(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage1(MessageRpc& rpc) at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)System.Exception is shown in FireBug

Hi Nick v7.9 working great here. Also got the AD browser issue fixed in this version too! Two wierd errors for you though... MyFiles: Just get two rotating red arrows on any user. The old MSCB works fine though Login: We have one user with a ' in their logon name - which throws an Invalid token error. THis happens whether using forms based logon or basic (which we are using as we have TMG onsite). Any chance we could fix these two?

Welcome to Part 3 of my System Centre Configuration Manager (SCCM) series! I know its taken me a bit longer to get this lot sorted, and I hope that Im covering the mailbag of questions Ive had - but if there is something specific you need, please comment or send me a PM. Alternatively, you can find me on Twitter @TheScarfedOne. Part 3 is going to deal with your initial configuration. Im going to take you on a whistle-stop tour to get your basic SCCM system ready to do a Build and Capture in Part 4 (which will be a 3 parter itself I think - 4a: Build and Capture, 4b: Deployment and 4c: Advanced Deployment Options [already published based on questions]). So... introductions over with, lets get started! First things first, lets get into the SCCM Console. Im going to assume for the purposes of this guide that you have followed parts 1 and 2 of the guide; and that you are Remote Desktop'd to the SCCM Server. Boundaries Clients are assigned to SCCM sites based on the boundaries defined for the site. Even though you are likely to only have one Site in a School Environment - you still need to set this up. SCCM boundaries are used to identify a roaming client's position in the hierarchy, which in turn facilitates locating the nearest distribution points that host the content requested by clients. When a change in network location results in a client being outside its assigned site's boundaries, it relies on roaming behavior to locate content. More information about Boundaries can be found on technet - http://technet.microsoft.com/en-us/library/bb632910.aspx. Boundaries can be defined by IP subnets, Active Directory site names, IPv6 prefixes, IP ranges or a combination of these. We need to configure the Site Boundaries in order for auto-site assignment to succeed (the clients network location must fall within one of the configured boundaries for site assignment to succeed). To set our Boundary, click on the + beside Site Management. Then, click on your SCCM Site Server name, and underneath that we have the Sites Settings node. Next, click on the Boundaries node, right click the node and select New Boundary from the context menu. We need to change the type to Active Directory Site - which you can select from the drop down list. AD Site is by far the easiest to use here. Click on the Browse option, and select your AD site name. In most cases, this will be Default-First-Site-Name, but you can check this from your Domain Controller (or your machine if it has the Windows Server Administration Toolkit installed) - using the AD Sites and Services tool. Management and Distribution Points Technet: How to Configure the Default Management Point for a Site (http://technet.microsoft.com/en-us/library/bb632897.aspx) Next up, time to configure the Distribution and Management Points. Hopefully – you’ve still got the console open! Highlight your SCCM server, which should be listed under Site Systems, under Site Settings. In the right pane we'll see the roles we've already installed – as part of the setup. Now, double click on ConfigMgr distribution point and place a checkmark in Allow clients to transfer content from this distribution point using BITS. That will help speed up your installs, as it enables the “trickle-feed” option; like Windows Update uses. You can leave the rest alone. Click on Configmgr Management Point to bring up its' properties. If you are planning on managing mobile devices (phones) put a checkmark in Allow devices to use this management point and click Apply. Client Agents This basically does what it says on the tin. It will control the way in which the various components of the SCCM Client work. Select the Client Agents option, under Site Settings. Lets start with the Hardware Inventory Client Agent – choose it from the list on the right side and verify that it is enabled. Set the inventory schedule to 7 days – unless you really need to gather your hardware specs more often. The more regularly you do this, the more beating you do of your SQL DB and your network. Click ok to close. Next up is the Software Inventory Agent, again, a schedule set to 7 days will do fine. Theres a few more options here though - click on the inventory collection tab, and delete the default scan listed. It’s a bit OTT going through every HDD looking for exe’s! We are going to create one to just look in Program Files – as that’s where you install your Applications….right?! Click on the yellow star and add files of type *.exe, then click on Set beside location, select Variable or Path name and enter %ProgramFiles%\ as the program path; and make sure you remove the tick from the windows directory as well. Next you can enable the Advertised programs client agent. This is the one you will want to use to allow users to do “self-installs” of registered safe software – and you also use it to do push installs as well. Enabling it is simple – open up the General tab and check the box for Enable software distribution to clients. Getting the hang of how easy it can be? One other setting you may want to do is change the New Program notification icon opens Add or Remove Programs option. If you are planning to use AppV, then also enable Allow virtual application package advertisement. From the notification tab – you can choose whether to tell your users about new software. I tend to turn this off or your get popups every time and you generally don’t want this. You will have other ways of letting users know you’ve put new software out – like bulletins? Next we will configure the Computer Client Agent properties. Health warning here - Failure to configure this correctly or failure to configure it will lead to a failure in Operating system deployment. Under Network Access Account we need to enter an account to be used by Configuration Manager 2007 client computers to communicate with network resources. You should be careful about what account you use as the Network Access Account - it only really needs enough to connect to your distribution point shares. It should never have domain admin rights. You can then also change the text on screens shown to the user, via the Customization tab. On the BITS Settings screen, make sure that it is set to All Clients, and unless you want to get clever with throttling settings and time windows – you can leave the rest alone. Click apply and ok. For Remote Tools, set your Remote Assistance settings to Full control for both solicited and unsolicited remote assistance and add Domain Admins to the Security page. Client Installation Methods From the menu list to the left select Client installation methods. Unless you really need to – don’t enable Push Installations. The best way is to build your machines and include the client there. If your don’t have that luxury, then enable it by double clicking it in the right pane – and selecting Enable Client Push Installation to assigned resources. You will get a warning message. Click OK, and then check the options for Workstations and Enable to Site Systems. You then need to specify an account to install the client under. To successfully install the Configuration Manager 2007 client, the Windows user account used must have Local Administrative rights on the destination computer. If the install fails with all accounts in the list then the installation will be attempted using the computer account from the Configuration Manager 2007 site server. If the user account does not have Local Administrative permissions on the destination computer then the Client will not install. Next click on the Advanced client tab and set your Installation Properties string to something like this “SMSSITECODE=SITECODEHERE SMSCACHESIZE=8000” Configure Discovery methods Now we need to set up how SCCM will find your machines! This can be in terms of finding agents that are out there; or new "unmanaged" machines which then our Client Push will deal with. So, a bit about it first... taken from Technet (http://technet.microsoft.com/en-us/library/bb633276.aspx) Active Directory System Discovery – Discovers computers from the specified locations in Active Directory Domain Services. Active Directory User Discovery - Discovers user accounts from the specified locations in Active Directory Domain Services. Active Directory Security Group Discovery - Discovers security groups, including local, global, and universal groups from the specified locations in Active Directory Domain Services. Active Directory System Group Discovery – Discovers additional information about previously discovered computers from the specified locations in Active Directory Domain Services. This information includes the OU and group membership of the computer. Active Directory System Group Discovery does not discover information about new resources that did not previously exist in the Configuration Manager site database. Heartbeat Discovery – Used by active Configuration Manager clients to update their discovery records in the database. Because it is initiated by an active client, Heartbeat Discovery does not discover new resources. Network Discovery – Searches your network infrastructure for network devices that have an IP address. This allows you to discover devices that might not be found by other discovery methods, including printers, routers, and bridges. In the Discovery Methods section, select Heartbeat Discovery, and set the discovery to something like an an hour or 2 hours to start with. This will help ensure all clients get connected quickly. Once you are all up and running – you can then set these to be a bit longer. I usually use 4 hours. You can use the same setting for the other discovery methods - Active Directory System Discovery, Active Directory User Discovery, Active Directory Security Group Discovery and Active Directory System Group Discovery. I tend not to enable Network Discovery. To give things a kick start - you should also check the Run discovery as soon as possible is ticked for all of the above. For all the “AD” related discoveries – you can target where abouts in your OU structure you want to look. To do this, open the properties and click on the Yellow star to add an Active Directory container. You can use the Domain, or a custom query if you want to tie down to an OU (or multiple OUs). That's it you are done. The basic configuration is ready – and if you have enabled Push Client Install, you will start to see your machines “check-in”. Add the PXE Service Point (PSP) role to SCCM More Technet Bedtime reading....Planning for PXE Initiated Operating System Deployments (http://technet.microsoft.com/en-us/library/bb680753.aspx) - no seriously, read this one. It will save you a whole world of trouble later. Ok – so Im guessing one of the real reasons you want SCCM is for the uber OS deployment handling that it does. This section will walk you through that – from installing the role down to getting your basic OS Build and Capture image made ready to deploy. So, first things first – what you need. You need to have the Windows 7 DVD ready, and also Remote Desktop access to your SCCM Server. Open the Console, and go down to Site Database > Site Management > Site Code > Site Settings > Site Systems and highlight your server. You need to then right click on it and choose New Roles. When the New Site Role Wizard appears, click Next – and then highlight the PXE role and select it. You will be prompted about “incoming PXE requests” which you can accept. Next up is the PXE - General options page. For texting you might want to remove the password requirement – but in production, definitely set one! Choose a delay for your SCCM to wait before answering a PXE Request. This is useful if you currently have another deployment method in use – such as FOG or another WDS/RIS server. Now let's continue with configuring SCCM's PXE role – and you will need to accept the PXE-database settings. You will also be setting up a Certificate for the PXE server. Make sure you create this with an expiry way into the future. You don’t want to go around having to redo that in a years time! The usual summary screen will be show, then that’s that done. If you have any problems with getting WDS to start once the PSP role is installed then please take a look at http://blogs.technet.com/b/configurationmgr/archive/2011/01/05/troubleshooting-the-pxe-service-point-and-wds-in-configuration-manager-2007.aspx. Next up in Part 4A (yes, its got to be that big an uber topic that Im now breaking it down a bit more) - we finish off with our boot images, set up the actual Config Manager client installer; and then lastly our OS install. Then, we will build a task sequence - and watch as SCCM sets up Windows, then captures that for us ready to use.

If you are able to upgrade to TMG SP2 - this has a built in Safe Search rule now...

Part 2 is live, Parts 3 and 4a will be live by Wednesday.

You probably can. I dont see any reason why not. It would just be a read in the variable, and do a compare against another variable taking the date to disable.

CS 4 and CS 5 both run fine. The only thing is make sure you sequence for the appropriate platform - ie. the 64 bit Adobe bits on Server (we use RDS a lot for Thin Client); and 32 bit Adobe bits else where.

My recommendation from experience is to create a new sub OU structure for your Win7 machines. Set up new GPOs for the workstation/machines, and also set up new Win7 User Config GPOs too, using loopback mode. That way, you can start to test and then build/deploy your new network segment, without any policies from the XP side getting under foot - or any changes you need to make affecting your legacy setup. Ive done this a few times now as well - so any questions ask away. I think there are plans to release a set of basic GPOs that most of use - to help people get started. Test, test, test and test again. Good tip is to involve a pilot group of users as the testing. They will like being involved, and you get the feedback before letting it loose on everyone.