Jump to content
EduGeek EdSec 2026 is Go! 27th Oct in Derby! Join us for a day of EdTech security focused talks, networking, and an evening social ×

browolf

Members
 View Profile  See their activity

  • Posts

    2,290

  • Joined

  • Last visited

 Content Type 

Blog Entries posted by browolf

  1. browolf
    How to make windows update talk to a remote wsus server, through a proxy.
     
    1 . deploy wsus server address in group policy
     
    2. create isa rule to allow thru http, https and kerberos-sec (udp) to wsus server, all users
     
    3. change winhttp on workstations to use a non-authenticating proxy. e.g. squid.
    c:\>netsh winhttp set proxy x.x.x.x:xx
     
     
    So in order for it to work you have to have to hand a non-authenticating proxy that you can route the winhttp downloads of BITS (background intelligent transfer service) through. I could not get ISA to accept a request with no credentials.
  2. browolf

    Capitalism

    By browolf,

    I happened to watch a bbc documentary on youtube about Karl Marx and discovered why credit cards were invented.
     
    Communism aside, according to Marx, an important aspect of capitalism is the class struggle. Between bosses looking for the most profits and workers who want more pay.
     
    When the labour market has an abundance of workers this pushes down the salary of workers as people are desperate and will work for anything. This is great for bosses as they make bigger profits. the trouble is at the bottom, the workers have little money to pay for products and services produced by poorly paid workers.
     
    This is a problem as profit get squeezed by diminishing sales.
     
    Since no one wanted to pay more and there barely any unions left (or they don't have the power to challenge the status quo ), capitalists invented credit cards so that workers could keep buying stuff whilst they were paid peanuts. Well that can't go on for ever...
     
    This is obviously an overly simplistic view but it does make you wonder...
  3. browolf
    Although it's been on my mind for years, there was no outside pressure to match sims users to active directory, so I never got round to it. Even though most users were created from sims, there's tonnes of inconsistencies due to altering the creation process in past years, kids that turn up without accounts, kids that have left the school etc.
     
    The most recent moodle coordinator is much more IT literate than past ones and there's pressure from above to be able to do something that requires connections. They want to be able to match user accounts to moodle reports to free school meals type data. I think they need the user data to be able to identify moodle users. I don't entirely understand it. I don't need to know that bit. All I have to do is make users matchable to sims.
     
    The easiest way to do this foolproof is to insert the admission numbers into the office field of active directory. Then I can just export a csv file from ad and the moodle guy will use it as a lookup table in his access database.
     
    to insert data get a csv from sims containing name, admission number
     

    for /f "delims=, tokens=1,2" %%a in ('type admission_numbers.csv') do dsmod user "cn=%%a,ou=pupils,dc=school,dc=county,dc=sch,dc=uk" -office "%%b"
     
    this will match the user by name, overwrite the office field and wont error quit if you run it multiple times.
     
    However there's another problem.
    The container (CN) is the field "disguished name" or the name column in active directory users and computers. Many older users have their username in this field not their name.
     
    So now I need to rewrite dn field with their full names.
    Enter a program called "ldifde" that does that kind of thing.
    But its not command line orientated. It uses a data file called something.ldf
    So I have to write a script to write the data file
     
    Export a csv from active directory users and computers that contains name,username
     

    const ForReading = 1 const ForAppending = 8 const ForWriting = 2 inputfile="addn.csv" outputfile="import.ldf" 'open data .csv file set fso = CreateObject("Scripting.FIleSystemObject") set ts = fso.OpenTextFile(inputfile, ForReading) set rs = fso.opentextfile(outputfile, ForWriting,true) 'while not end of file read a line Do While ts.AtEndOfStream <> True sstring=ts.readline pupilrec=split(sstring,",") fullname = pupilrec(0) currentdn = pupilrec(1) rs.writeline "dn: CN=" & currentdn & ",ou=pupils,dc=school,dc=county,dc=sch,dc=uk" rs.writeline "changeType: modrdn" rs.writeline "newrdn: cn=" & fullname & ",ou=pupils,dc=school,dc=county,dc=sch,dc=uk" rs.writeline "deleteOldRdn: 1" rs.writeline loop
     
    That gives me a massive file of change orders. Running it a bit at a time. Scared of the law of unexpected consequences breaking all the users.
     

    c:\>ldifde -i -f part1.ldf -j log -k
     
    -k to ignore errors (or it will error quit)
     
    then rerunning the dsmod batch file. Will be done tomorrow. Then I can start thinking up ways where being able to identify sets of students might be useful.
     
    Turns out I needed to have the moodle logins in the csv file too. Typically the moodle logins are not consistent with network logins. Year 7 and Year 8 are but not the rest. They're how we aspire to have all our logins. Fortunately it's not too hard to construct moodle logins from existing data. So I made another csv with the moodle usernames and used dsmod as above to insert them into the "business phone" field.
     
    Then set up all the necessary columns in active directory users and computers and export the perfect CSV file.
  5. browolf

    Not enough chips

    By browolf,

    Here's something strange.
     
    The extra memory we got for a bunch of new laptops. Only 15 / 45 worked.
    Turns out the sticks with 4 chips on one side don't work, the sticks with 8 chips on do work.
     
    The memory is PNY 2gb ddr3 1066mhz
     
    Dunno whether it's a bad batch or what. Getting them replaced. Still it's odd about the chips.
  6. browolf
    Twitter follower lottery
     
    say you have 5000 followers and you want to reward one of them in some way. Usually people do the xth follower wins something but that's a bit harsh on existing followers and you need them to RT it.
     
    So a website that reads a persons follower list and randomizes 1 person out of it.
     
    I had a quick google and couldn't find something like this. At least with this name.
     
    Whoever is clever enough to do this/make it happen is free to steal my idea. I maybe could technically but I have zero graphics skills and I find the json format of twitter mindbending.
  7. browolf
    Trialling office 2010 with some staff before we roll it out to everyone.
    I can see there's going to be some problems with outlook.
     
    Everyone has problems with shared calendars at first, showing busy instead of the actual information. Maybe this is because the server is still exchange 2003. Deleting the shared calendars and re-adding seems to fix this.
     
    A person with his own contacts as well as the global address book. can't forward messages to his own contacts, neither check names or the "to:" button on mails where you can change the contacts list knows about these other contacts even when they show up straight away when you go in the contacts in the main navigation folder list. We seem to have fixed this by changing the order of which contacts are checked first.
     
    A person's outlook has some problem with excel documents.
     
    A couple of people have reported some problem with emails not being sent.
     
     
    The nm has a problem where 2 emails are stuck in outbox and gets the error don't have appropriate permissions to send (0x80070005). Apparently the fix for this is to delete the mail connection and recreate it.
     
     
    I fear there's going to be a lot of "hmm that's strange, I'll look into it" when we roll it out to 200 users.
  8. browolf
    If you run dhcp on your own linux proxy for say, guest wireless, this is well worth installing:
     
    http://dhcpstatus.sourceforge.net/
     
    Tells you how many ips are used/free. I've used it on redhat and debian. There may be better gui apps for this purpose but all our proxies are minimal debian installs with no gui.
  9. browolf

    Well that's odd

    By browolf,

    "net view" has stopped working. There's a script the helpdesk admin runs every day that involves net view cmd. It worked yesterday.
     
    It doesn't work for her, me or on the servers. nslookup works. No firewalls have mysteriously turned themselves on.
     
    it's all very strange!
  10. browolf
    I've stopped repackaging software into MSIs and deploying them through group policy. It's a huge pain in the ass to get it right using wininstall LE. I just haven't got the time to be messing around like that. Java had also become a complex problem that I couldn't make head or tail of.
     
    Obviously we can't just stop installing software. Things became a lot easier when I discovered the fantastic Ninite - Install or Update Multiple Apps at Once. We purchased ninite one for the silent install options. I negotiated with the company for a one off yearly CC payment. Finance refused to pay monthly for it.
    Ninite painlessly takes care of all the runtimes ~ java, flash, shockwave, dot net, air, flash(ie), silverlight. And some other free software we can use.
     
    My alternative install solution is this ~ an account with local admin rights and a gigantic login script with logoff at the end and custom c++ window that says "Performing Maintenance". Security is maintained with some group policy and setting the shell to ping.exe. Ping!? Yep. That simply prevents the explorer shell from loading. Not needed for installing software.
    Pretty much all software has silent install options or I'll get the msi from the temp folder and use msiexec.
     
    For us this is a perfect solution as we've long had room prefixes to our computer names. e.g. k1-hp-12
     
    that means you can do
     
     

    if %computername:~0,3% == k1- ( do stuff )
     
    This does lead to some replication but it's simply copy and pasting.
    Also can do other things, like deleting local start menu items, changing file associations etc. I <3 dos programs & batch. Commands usually do one job and they do it just how you want.
     
    Funny thing is we used to have a guy who was amazing at repackaging software. That's where most of the existing repackages came from. But he left and no one could replicate his success.
    I know the ultimate aim in a network is to have everything automated through windows server functionality but we've never managed it nor have the skills to make it happen. I'm sure that's partly on me. If something gets too mind-bending or overly complex I'll do something else that's easier.
  11. browolf

    File Associations

    By browolf,

    Libre office 3.4 appears to be changing the file association for word. Previous versions just left them as is.
     
    fortunately and frankly, who knew it?!
     
    There's a dos prog called assoc which you can easily alter associations with.
     
    So adding a line in after libre office in our maintenance script to restore word.
  12. browolf
    Went to a classroom to look at some problems in a lesson. Child reports they can't log in. it comes up with the wrong login error. Check the obvious things ~ network cable. Yes it's in and the lights are on. Try to log in with our test pupil account.
     
    no that doesn't work either.
     
    wait a minute there's something wrong with typing the password in.
     
    The 3 key doesn't work.
     
    By sheer luck the child's and our test pupil account password both have a '3' in.
     
    Lucky because if I'd have gotten logged in I would have insisted the pupil was typing their password in wrong!
  13. browolf

    Verbose status

    By browolf,

    Just discovered this. If you have noticeable slowness on pc startup or logging in. You can enable "verbose status" that gives me more detail about whats happening.
     
    the location of this option in group policy is:
     
    Expand Computer Configuration, expand Administrative Templates, and then click System.
    In the right pane, double-click Verbose vs normal status messages.
     
    You can also apply it in the registry:
     
    Locate and then click the following registry key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
    On the Edit menu, point to New, and then click DWORD Value.
    Type verbosestatus, and then press ENTER.
    Double-click the new key that you created, type 1 in the Value data box, and then click OK.
     
    on ours applying computer settings & initializing network connections are the biggest delays.
  14. browolf

    Roles

    By browolf,

    Seems to me there's roughly 4 roles that ought to be covered in educational IT support. Whether you have the manpower or the need(re size of network) to fill these roles is another matter but I see them as:
     
    1. Helpdesk ~ stay in the office, answer the phone, deal with incoming people, change kids passwords, make new accounts, tweak the helpdesk, maintain records, keep track of what needs doing,
     
    2. Firefighting ~ roam with a radio, first responder, bring broken stuff back to the office, change mice, deal with wireless connection issues, printer jams, etc
     
    3. Fxing stuff ~ reimaging computers/laptops, repairing broken stuff, referrals from helpdesk, general maintenance of rooms,
     
    4. Sysadmin ~ Servers, forward thinking, R & D, Solving reoccurring problems, designing/implementing new network features etc
     
    On smaller networks roles can be merged but the minimum ought to be 2. The greatest revolution in my work was employing a specific help desk person. Before this, even with a helpdesk application we always in a bit of mess keeping track of things, maintaining consistency and had limited records of stuff we had . Such a person need not be great technically. Primarily they need to be good with people & kids and good at organising. We're lucky ours is good at fixing stuff too.
  16. browolf
    http://www.phoboslab.org/ztype/
     
    you have to type in the words attached to the ships in order to destroy them, so good for encouraging fast typing and spelling accurately. I sent it to our learning support department as they run a typing class after school for weaker kids.
  17. browolf

    Discovered on Spotify

    By browolf,

    It's funny how you like some things and not others. For instance I don't like Sigur Ros, {gasp} but I find the "Go" album by Jónsi pretty damn awesome. I'm very particular about melodies...
     

  18. browolf

    A few links

    By browolf,

    We'll Edugeek is not going to save the planet with our 20,000th odd ranking! In fact the majority of working done is investigating the evolution of the milky way.
    http://boincstats.com/stats/boinc_team_graph.php?pr=bo&id=12712374
     
    How to Look Younger Without Plastic Surgery
    http://www.sciencedaily.com/releases/2011/01/110105102719.htm
    It's a matter of having ones perceptions habituated , probably surrounded by kids has the opposite effect tho....
     
    Understanding the 10 Most Destructive Human Behaviors
    http://www.livescience.com/culture/top10-destructive-human-behaviors-100122-1.html
    Monkeys do some of them too!
  19. browolf

    Pre-vat increase PC

    By browolf,

    If I was going to make myself a new pc (which I do every 2 or 3 years)
     
    here is what I would make myself before Overclockers UK adds the extra vat to its product range (after this week I think)
     
    £65 - mobo - Asus P7H55-M Intel H55 (Socket 1156)
    £91 - case - Antec 900 Nine Hundred Ultimate Gaming Case
    £81 - memory - OCZ Gold 4GB (2x2GB) DDR3 PC3-16000C10 2000MHz Dual Channel
    £140 - processor - Intel Core i5 650 3.20GHz (Clarkdale) (Socket LGA1156)
    £60 - hard drive1 - Kingston SSDNow V-Series 30GB (windows drive)
    £32 - hard drive2 - Seagate Barracuda 7200.12 500GB SATA-II 16MB Cache
    (data drive)
    £112 - graphics - HIS IceQ 5 Turbo ATI Radeon HD 5770 1024MB GDDR5
    £26 - CPU cooler - Arctic Cooling Freezer 13 High Performance CPU Cooler
    £74 - psu - Zalman ZM500-HP Heatpipe Cooled 500W Modular Power Supply*
    £16 - optical - LG GH22NS50 22x DVD±RW SATA ReWriter
     
    = £697
     
    *antec power supply calculator rated 90% at 468w but 100% was 514W so
    maybe its +£15 for 600w version of psu
  20. browolf
    Well into controlled assessments now and gotta say my bespoke system detailed in this thread:
     
    http://www.edugeek.net/forums/how-do-you-do/58143-controlled-assessment-how-we-did.html
     
    is working like a dream. Although re-reading the thread I realise I made it sound more complicated that it is.
    For the record it requires only ONE active directory account to function.
     
    In practice, the whole thing is foolproof! and the only bother we get is teachers asking what the password is. When they've all finished I'll backup the folders onto DVD and delete them from the one user area. I had to write some stuff on our documentation about it, first time I had to generate some user codes I couldn't remember where I'd put the files.
  21. browolf

    holy smokes

    By browolf,

    just downloaded the ubuntu 10.04 install cd for the work experience student we have in 1.5mins! that was 8mb/sec!
     
    Our new fibre internet connection is freakin awesome!
     
    If only it wasn't so heavily filtered, for one thing I could download those ffxiv beta patches..every few days it's a 3.5gb download. Like a temporary whole new install of the game. :-S
  23. browolf
    it's just one thing after another!
     
    installed wordpress on xampp on server 2003.
    Found a good plugin for active directory authentication. (2nd one i tried)
    WordPress › Active Directory Integration « WordPress Plugins
     
    figured out I needed to use .htaccess to limit site to teachers only.
    found out about ad authentication & htaccess.
    been fiddling with for hours; fixed some problems.
     

    # Authentication realm and method: AuthType Basic AuthName "LDAP Auth" AuthBasicProvider ldap AuthUserFile /dev/null AuthBasicAuthoritative Off # DN of Active Directory server AuthLDAPUrl ldap://x.xxxxxxx.lancs.sch.uk:389/DC=xxxxx,DC=lancs,DC=sch,DC=uk??base?(objectClass=*) # An account in the AD that has enough permissions to perform an LDAP search #AuthLDAPBindDN "CN=xxx,OU=pupils,OU=other accounts,DC=xxxx,DC=lancs,DC=sch,DC=uk" AuthLDAPBindDN [email protected] AuthLDAPBindPassword xxxxx # The following would also be valid, although not truly LDAP compliant #AuthLDAPBindDN ADS\\yrodrigu #AuthLDAPBindDN [email protected] # When checking for group membership, use the DN of the user, not the HTTP entry AuthLDAPGroupAttributeIsDN on # Require groups, specifying the DN of the security group require ldap-group CN=teachers,OU=Staff,DC=xxxx,DC=lancs,DC=sch,DC=uk require ldap-group CN=Domain Admins,OU=Admins,DC=xxxxx,DC=lancs,DC=sch,DC=uk
     
    stuck with the errors

     
    using wireshark to try and find some more information about what's not working
    realised I need to filter out remote desktop traffic (TPKT)
     
    currently: trying to work out what capture filter syntax to use.....
  24. browolf
    I think eclipse.net is a terrific piece of library software but seriously ever time I do an update there's strange errors and things not working.
     
    Most errors can apparently can be fixed by either restarting the sql service or rebooting the server.
     
    Just done the 10.5.13 update.
    Had some issues.
    They seem to be fixed now
    Except for no apparent reason the silverlight interface has the web communications error on the server but works fine everywhere else. I'm just going to leave that and I hope I remember next time.
  25. browolf

    Lucid Lynx

    By browolf,

    Updated my home bedside pc to 10.04 lucid lynx at the weekend. It was a smooth process for the most part, although took 2 hours on that aging P4/3Ghz. There was a slight worry over the grub update as I have 2 hard drives but I managed to pick the correct drive.
     
    The general interface is darker than Jaunty and the slightly slower start up screens are now purple. Between this purple design and the previous orange I prefer the orange.
     
    For what I use it for, internet and media playing. It's not hugely different. Nicer looking, bit slower. That's about it. Tried Ubuntu one, but didn't see much point to it since I already use xmarks and dropbox.
     
    There was one thing that I found very alarming and invoked cries of "why o why??"! They moved the minimise, maximise,close buttons to the right hand side of applications. Talk about disconcerting.
     
    You don't realize how little thought goes into pressing those buttons until you go to click them and they're not there. GRRRR.
     
    Luckily I found the solution on the ubuntu forums. If you need to know yourself, I can save you some time.
    Here's the link: [ubuntu] How to "reset" the Close, Minimize, Maximize buttons? - Ubuntu Forums
×
×
  • Create New...