TheScarfedOne

See you all soon - and @GrumbleDook - I hope you have the obligatory face paint at the ready lol

Not really no. The only issue I sometimes see is a failed launch of the Rdp file resulting in a blank screen. Loopback is used to prevent the full user settings applying to the thin pc. It doesn't need to, as the Rdp session is what they actually use. I will be posting the actual group policy exports next week

The last article covered some of the rationale and an overview - this is a bit more of the "how to". Remember, there are two elements to MySite – the first showing your feed, all activity from your linked people (a la friends). The second, your profile. Now – the problem comes with the logic behind setting this up. In Education – we tend to like everything being accessible through one entry point. This will usually be though a firewall or gateway device. MySites - the standard config issue However, by default when you create the MySite, according to the main documentation - the location is under a different web application (URL) to your main Sharepoint site. I think an example is required… Your organisational portal site is on http://portal Your MySite must be on another URL domain or port so let say... http://Portal:12345 What this will mean, by default, is that your users MySites are at http://OrgsIntranet:12345/personal/<username> As you can probably imagine, this is not ideal - In fact for most that will only ever have one main portal this is really not ideal. The reason we host MySites on another web application is so that no matter what site you are on, when you hit the "mysite" link at the top of the page, it will take you to the right place and that place is not dependant on any individual portal. In an ideal world you would have an address like http://my or http://mysites as a DNS name for your MySite … so that the address makes sense and you could run it on port 80 like everything else. It makes the URL look nicer I guess. Anyway – this doesn’t apply to our use of Sharepoint - so for with only one main portal we want it to look something like: Main portal: http://portal MySites : http://portal/personal/<user name> So how do you go about configuring this, when all the main documentation centres around the separate website model. And then worse than that – how do we get Alternate Access Mapping (the way that Sharepoint translates your internal http://portal used internally to https://gateway.org.uk outside) to behave. Well – that one will be the next article, but setting up MySites is now… Setup MySites Some assumptions for this article. You have an intranet web application named: 'http://mywebapp' it has it's own Content Database named "MyWebApp_Content". You want to setup and configure My Sites to be used via the URL 'http://mywebapp/mysites' and you want all your My Sites content to be stored in it's own new Content database named "MySites_Content" The following steps outline how to configure your existing web app 'http://mywebapp' to host ‘My Sites’ to be stored in a separate database (a screenshotted walkthrough is here: http://www.bybugday.com/Lists/Posts/Post.aspx?ID=22) 1.Go to “Application Management” and select “Content Databases” under “SharePoint Web Application Management” 2.Select the ‘http://mywebapp’ web application. And select “Add Content Database” 3.Create a new DB and name it: "MySites_Content" 4.Once this DB is created select the existing database named: MyWebApp_Content. 5.In the “Manage Content Database Settings” for 'MyWebApp_Content’ select Database status to “Offline” This will ensure that no new site collections are created in the default content database 'MyWebApp_Content'. Taking this content database offline only prevents new site collections from being created. Users are still able to create sub sites and items and use the existing sites1.First you have to make sure you have 2 managed paths set up in the http://OrgsIntranet web application. To do this jump into central admin, "Application Management" tab, "Define Managed Paths". Make sure you are working on the right web application once you are in that screen. 4.Go to Application Management and select “Define Managed Paths” under “SharePoint Web Application Management” 5.Select the 'http://mywebapp' web application and create a new path named ‘mysite’ and select “Explicit inclusion” 6.Create a another managed path named ‘personal’ and make it a “Wildcard inclusion” 7.Go to “Application Management” and select “Create Site Collection” 8.Ensure that the path selected is 'http://mywebapp/mysite' <Important - chose the same name> , and select the “My Site Host” template from the templates list on the “Enterprise” tab. 9. Now, configure the My Site Setup from Central Administration > Application Managment > Manage Service Applications > User Profile Service. Click the Setup My Site link under “My Site Settings”. You need to configure all the settings in this page like the preferred search center, “My Site Host Location” and “Personal Site Location”. Set "Personal site provider" to "http://mywebapp/mysite/" and "Location" to "personal", click OK. Done! Now when your users click on the "mysite" link their MySite will be created in the right place.

When I first started writing on Edugeek, many will remember me as one of the Sharepoint gang. My more recent writings may have convinced some of you that I was less interested in it now…but that couldn’t be further from the truth. Sharepoint 2010 is a brilliant product – and one which could be put to great use in Schools and Colleges. The Rationale As IT Professionals, we are constantly battling against the students (and the staff in some cases) with Social Networking. We are also in a battle to bring some kind of information organisation. When I joined my new Academy – the traditional old-school “shared mapped drives” were the mele you would expect. The problem with these areas is that they are difficult to make dynamic. They are also open to all kinds of abuse – and bar some serious messing with ACLs and NTFS permissions…it is basically unmanageable. Just try searching for a “lost” document in there too…I dare you! A Home page A picture says a thousand words...! Well - heres a screenie of my "still in development" environment. A central landing page with new items depending who has logged on. Here - you can also signpost other services. Improve Staff Access So, what can we do about this? For a start, at its most simplistic level – a single Sharepoint site with Document Libraries per Learning Area or Department. That’s a start, with the Document Libraries set with permissions “Contribute” only set for members of those areas. No more general dumping grounds, and also management of the area is under the Learning Area or Department. If you configure Search (by default, you will get this out of the box – I will go into more advanced settings at a later date) – you can search for anything. The terms you search for can be in the title or within the actual body of the document – and it will still be returned (so long as you have permissions!). Lets take that one stage further – a Site per Learning Area. Now, it is not just a Document Library they can use. The users now have a News Board, Discussion Forum, Calendar and Task list too. So – we have extra functionality for them – take for example department meetings – linked with their agenda and minutes. This is becoming cohesive. Still want more features….why not! Those documents that you have added, well lets say they are Microsoft Office documents. Most of them will be. Add the Office Web Apps feature to your site (details here) and you can now view and edit these documents in the browser (IE, Firefox, Opera, Safari) – and even better, multiple users can edit at the same time and it will live update! Genius…think collaboration now. Student use? We have so far just been talking staff, but extend this now to Students. We have the separate “Staff Areas”, so lets add sites for the Students by Learning Area too (or have the Learning area, but with a private area for Staff off that – the architecture layout is up to you!). All the same functionality exists, and you can group the permissions around your exisiting AD groups. No reorganising required – why reinvent the wheel? Now – the title said Social Sharepoint…and Ive not touched on that yet. But, I wanted to start with a little intro to what would get you to this point in the first place. Enter MySite - The Social Network MySite has been a feature of Sharepoint since 2003. Back then, it was a bit of a pig to manage to say the least. With 2010 – not only has it got easier to manage and implement, but it has gathered some extra killer features. MySite is basically what it says – a personal site for each user. It actually really consists of two – a profile and a storage area. You have a news feed – a la Facebook – and a document library. All files on Sharepoint are essentially stored in Document Libraries. Here are two images of the entry point to MySite – the first showing your feed, all activity from your linked people (a la friends). The second, your profile. [ATTACH=CONFIG]12582[/ATTACH] The next post will cover how to set this up...

This article has now been updated Remote Desktop for Thin Client… Part 2! - Blogs - EduGeek.net

Introduction This article is a continuation, and update on the changes made since the original article published earlier in the year. A bit of background to start with… in Summer 2011, I started a big modernisation project at the Academy I took over at. When I started, we were still on Windows XP across the desktops. To take us to Windows 7 presented a problem – the specs of some machines prevented it. I had a significant number of Celeron 1.6’s and 1.9’s. Although I tested Windows 7 on these successfully, the performance once loaded with software was poor. Rethink time. The Client End Following some early work with Microsoft – we got access to Windows Thin PC (Windows 7 Lite). This was perfect for our Celerons – and gave them a new lease of life. Being based on Windows 7, it didn’t take much to have these deployed via System Centre Config Manager. I also needed a new solution for the Admin machines – which I had just stolen to refresh an IT suite. Here – we used a Wyse terminal solution based on Linux. The Server End The solution… a Remote Desktop environment. This was built from the same Server platform as I used for the rest of my new network. There will be another post on the new network architecture in full. It was summarised in an article here, and more to be published over on the Microsoft Schools Blog (link to follow). This would be the “actual machine” that the users of the Windows Thin PC and Wyse terminals would see. How is it laid out then? We start with our main HyperV Host server (known as HV3). This contains 4 Windows Server 2008 R2 installs. The virtual machines were stored on my SAN, meaing I could user Clustering. The next step was configuring them to be Remote Desktop Session Hosts, done by adding the Remote Desktop Role from the wizard, and choosing the role service Session Host. http://technet.microsoft.com/en-us/library/dd736539(WS.10).aspx http://technet.microsoft.com/en-us/library/ff710434(WS.10).aspx Then, I added that HyperV server to the HyperV cluster – which was made up of the other two main HyperV servers for the system (see separate article). This would mean that in case I lost one of the HyperV Cluster Servers, the individual virtual machines could move between the Cluster Servers. The virtual machines were setup to use the HV3 as their preferred server, that way they would move back there if it went offline and came back – and to prevent them moving to the other HVs to often. On its own, this doesn’t give me the Remote Desktop environment. What I wanted is a Pool, so that I can use one name – and the system will work out which of the Session Host servers can handle the load. To do this, I need a Connection Broker. Again, there is a great guide to setting this up here – so I wont repeat it. Essentially – as per the Session Hosts – you choose the service role Connection Broker. Then you add the Session Host servers to the “farm”. You also need a Web Access server – which is incredibly handy, when you think about the VLE needs of a School. Nothing speaks true “anywhere, anytime” like being able to login to Remote Desktop and get exactly the same experience and programs at home as you do at School. More great links for this here.... http://technet.microsoft.com/en-us/library/ff710462(WS.10).aspx http://technet.microsoft.com/en-us/library/ff686148(WS.10).aspx http://aaronwalrath.wordpress.com/2010/05/28/configuring-windows-2008-r2-remote-desktop-farm-with-connection-broker/ http://www.techotopia.com/index.php/Deploying_a_Windows_Server_2008_R2_Remote_Desktop_Server_Farm_using_RD_Connection_Broker Connecting the two So…that was the core of the Remote Desktop system setup. Next – how to get the clients to connect to it. Well, the Session Hosts were called Site-RDSH, and the farm Site-RDS. Using a locally installed certificate authority, I created a signed Remote Desktop connection for Site-RDS. This had all the options for the sessions themselves in – such as the desktop background, animation, printer and client drive redirection etc. You may remember from the first article (here) that the Windows Thin PC clients connected to the RDS system via a pre-determined single username. This username auto logged on to the Windows terminal, then triggered the RDS session prompting for the actual username to use the machine. This was OK to a point, except I found some problems mainly around printers. We use PaperCut – and all print jobs would show as my “communal” user rather than the actual user. Hmmm. Next problem - logon stats were distorted, and it meant that there was always a connection to the system from these machines. Final problem, from the netbooks I had also setup for this system – they would always be triggering the remote desktop before the network was truly ready. Rethink time. What I did was change one of the settings available in Group Policy and on the Session Host servers to take the actual machine logon, and auto logon this username to the Remote Desktop. So – the Windows Thin PC machines would now present a standard Windows logon (and it looks exactly the same as the Windows 7 one) – which the user would enter their details. The same shell replacement as described in the first article is still used – so the RDP file is still triggered. The difference now – it is automatically logged in as the user. Technically, the user logs in twice (once to the physical machine, and once automatically to the RDS) – which you must account for if using any logon restrictors. The next stages were the printers, which back to front I covered in this article (here) Any questions or comments, please let me know. Site visits are also possible – I am based in the South West. You can follow me @TheScarfedOne on Twitter too.

Sorry @Cache - I wasnt getting notifications on blog comments. Now sorted (I think - with ZH). Right...your questions... Yep... the security filtering is something that is so often done wrong. DO NOT mess with the Security Filtering section on the Scope tab. Instead, use the delegation tab to and edit the settings here. Remove the Checkbox for Apply GPO settings for Authenticated users, and then add the usergroup you want and ensure that check box is set. I will do a blog post with screenies as its one Ive seen a few times... Ive not seen the Run in users context used before...I generally dont use it. Will look it up (and poke the GPO and RDS team at MSFT to get an answer for you). Finally...many thanks for using my posts. I hope they have been useful. If you have any suggestions for more topics...please let me know. Im trying to post as much as possible about the setup to help others.

You can also do this with daemon tools and daemon scripting. I used to do this, before binning the virtual cds when upgrading to Windows 7 and finding most of the apps would run as a server complete install.

Right...it really depends how you want this to work. Using RDS with a pool of Windows 7 VMs is VDI. This is a one to one using the personal virtual desktops...and its how it has to be. What I suspect you are after is a pool which any user can use and be multi user. This needs to be a collection of Server OS installs running in Session Host mode with a Connection Broker. You don't need the web bit, but hey...if you have it...useful extra. I'm going to update my blog in the next few days with more about my setup in detail. Some of the v1 bits are there now. PM and I'm happy to help

Yep - just got it too...

This sounds like its got a good story attached to it :-p

Charming.... Neg rep :-p teeheee

I had initial issues with this on a vanilla Windows 7 system - but the principles for getting it working ok should be the same... 1. You can deploy using the supplied MSI... without modifications. Add that to the RMMMC via the normal methods 2. You will also need the SQL Compact Edition MSI (Microsoft Download...). Add that as well to RMMMC via the normal methods This will install by default to a subfolder of Public! Really random I know...! You will need some Path Rule exceptions to allow it to run from there, and to modify the Access Control Permissions to the folder (as it needs Modify for your users). If your system requires proxy authentication (mine did - we have local ISA/TMG)... then you will get a prompt for your proxy. Standard RM/IFL proxies don't need this so you will be fine. Enjoy

OK, so any ISA or TMG guys about who can help achieve this (and no @john - do not abuse me for my ISA/TMG :-p)

Coolies. Will get playing with it next week. Will also let you know if 7.8 will play nicely with AD using the IISAPPPOOL Account too.

Does this mean that Tracker only supports SQL Database backend now? Will it be ok with clustered SQL - or will I be testing that one for you ;-)

Ok... lets just calm shall we. This is a professional forum. As stated on the front page article - as soon as more information is available, it will be posted. The tasks of 1. getting the site secured and new systems implemented, 2. restoring data, 3. dealing with password resets for all users, 4. tracing the origins of the attack and reporting it, 5. establishing what data may have been accessed all take a significant amount of time. Please be understanding with the management team. We are trying our best to ensure the site is safe, and that all the users who want to get back involved with the community can. Like I have said, and as was also put in the other thread - as soon as the information is available, I know that the admin team will post it. In the mean time, I don't think that threads such as this serve any purpose. Please message the admins via the option available if you need any further advice. Best wishes TheScarfedOne Edugeek.net

Shameless plug! The info you need is over on my blog. Thats exactly how it is set up with us.

Which session are you doing?

And while you are registering...check out the seminar schedule. Having done a few last year, they are well worth the peanuts cost Seminar

Details and scripts available over on my Edugeek Blog...

Ermm..yes! It took 10 mins for me...but then it was about the 5th time ive done it now. Whats going on? Lets see if we can sort it. Post up any logs, and also the versions/state of your SCCM layout.

There is an update to this article in progress - as I now use NTLM as the users logon to the Thin PC as their own user, it still triggers the RDP, but then autologs in to the RDP.

It was just a standard limited account. Group policy locked out to prevent anything other than a "Cancel" box showing from a CTRL - ALT - DEL. Using Shelly to replace the shell to use the script calling an RDP file (yes with the domain prefix included - as highlighted by other comments), prevents any access to the account itself. It has no desktop, user home folder, or even profile. All it is is a network access account, to allow calling of the RDP with the GPO for "ignore certificates" set.

Likewise...done it here with Windows Thin PC. Will also go hunting for the setting - and that reminds me to go and update/add blog posts on the changes made to this from my original setup. See my blog for some background..