Duke5A

I agree with mrwoberts. Scripting this to recreate permissions from scratch is probably going to be your best bet. Are these home folders that are messed up? I'm looking for a way for the script to be able to match folders with users. If these are in fact home folders with their names the same as the AD account name this would be easy.

Where does your current filtering sit in the network, on the outside or the inside?

The proxy and clients are in two different VLANs and this is being done on a 6506E series chassis. Without any blocking it works great. When I implement an ACL to block outgoing web traffic on the client VLAN it stops working. I've tried multiple configurations with different ACL setups and it never seems to work. What I did was instead I went up to the firewall and blocked outgoing web traffic on the client VLAN from there. Seems to be working as intended now.

Is anyone familiar with WCCP for redirecting web traffic to proxies? I was wondering how one goes about stopping the switch from routing web traffic to the outside in the event the proxy goes down and is no longer registered with the switch. I had this happen on the guest wireless today and discovered students were getting unfiltered Internet access. Thanks.

How are your drives being mapped? I used to have a VB script handle it all and it was really sensitive to timing. Had to add sleep statements to a few of the subs to make it work reliably. When I migrated everything over to GPP my issues with drive maps just disappeared. Had another annoying issue where I forgot to comment out the sub in the script as I progressively moved everything and had the script and GPP fighting over mappings. That lead to a day's worth of head scratching.

Thanks guys!

This kind of falls between forums and thought it would get more traffic here: We're adding a ton of copiers and other equipment that relies on NTP and DNS. Typically I would just point these devices back to the PDC, but I'm getting tired of having to change these settings on the umpteen billion devices every time I stage a new domain controller. I do this every couple of years and keep our AD current and it was always drilled into my head to never reuse IP addresses for new DCs.. Not all devices support getting their NTP configuration via DHCP, not all of them support getting DNS while retaining static addressing, etc. I was thinking about setting up a Linux box with BIND to forward DNS and have NTPD running on it as well. Point everything in the infrastructure to it and in turn point it to the domain controllers. I just don't know... What do you guys typically do? My network here is rather large with seven building and over 4,000 clients.

WSUS Package Publisher - deploys MSI and other packages through WSUS. This has made my life on orders of magnitude easier, and is free! Notepad++ - For writing any and all kinds of scripts The Dude 4.0 - For network monitoring. I have not found any other solution that even begins to compare. It's small, lightweight and also free. ...and the custom launcher I wrote for TightVNC. It never sat well with me deploying VNC to staff computers, so I made a launcher for it in VB .Net 2010. Goes something like this: Copies TightVNC server exe to client via the admin share Creates a random password for the connection Writes registry keys on target computer for TightVNC Register the exe as a service and starts it, set to manual start Opens the viewer on your computer and connects When the viewer is closed it will wipe all remnants of VNC off of the target machine In the event the connection is severed before cleanup commences a script is placed in startup that will clean it up I wrote it a number of years and order of things probably escapes me now. I wrote it to work with Windows 7, but it and the version of TightVNC I have rolled into it work on 10. It has been a lifesaver over the years and I even used it this morning.

WSUS Package Publisher - deploys MSI and other packages through WSUS. This has made my life on orders of magnitude easier, and is free! Notepad++ - For writing any and all kinds of scripts The Dude 4.0 - For network monitoring. I have not found any other solution that even begins to compare. It's small, lightweight and also free. ...and the custom launcher I wrote for TightVNC. It never sat well with me deploying VNC to staff computers, so I made a launcher for it in VB .Net 2010. Goes something like this: Copies TightVNC server exe to client via the admin share Creates a random password for the connection Writes registry keys on target computer for TightVNC Register the exe as a service and starts it, set to manual start Opens the viewer on your computer and connects When the viewer is closed it will wipe all remnants of VNC off of the target machine In the event the connection is severed before cleanup commences a script is placed in startup that will clean it up I wrote it a number of years and order of things probably escapes me now. I wrote it to work with Windows 7, but it and the version of TightVNC I have rolled into it work on 10. It has been a lifesaver over the years and I even used it this morning.

WScript.Sleep(5000) Drop this in at the top. Delay the script from firing for five seconds and see what happens.

I used to run this remotely on people's computers using PSTools way back in the day. ESheep : Wikis (The Full Wiki) http://images-mediawiki-sites.thefullwiki.org/02/1/0/8/92732064078784351.png Really funny to launch 15 or so of them and watch them crawl around unsuspecting user's desktops.

You can try adding the SSD in its own RAID0 volume, boot the system with WinPE (or even Windows server setup of some flavor) that has drivers for the controller, open a command prompt (Shift-F10) at the first question prompt and run whatever cloning software you have to copy the volume over. I use Ghost32 and this process works all the time for me.

It isn't going to let you without first taking ownership and giving yourself write access. To script it you'll need to use 'takeown' and 'cacls' to make those changes. Or instead of messing with replacing the exe in system32 you could just use GPP to copy the Windows XP calculator executable into Program Files somewhere and create a link to in the Start Menu. No scripting needed.

I have the Store app disabled using App Locker policies and removed all of the preinstalled modern apps in my base image. We don't use them at all.

I just deleted the 'calc.exe' place holder executable in system32 and replaced it with the one from Windows XP in my base image. Worked like a charm.

Trying doing a "wuauclt /detectnow" at the command line on one of the offending machines. Maybe if it see the update has been declined it won't attempt to install it on reboot. Just grasping at straws here....

When setting up your Appx Rules don't blanket deny everything. The Start Menu is considered a modern app and will not work. This is my basic rule set. I preroll my images and removed all of the built-in apps beforehand. Appx Action User Name Rule Type Exceptions Deny Domain\All Students Microsoft.WindowsStore, from Microsoft Corporation Publisher No Deny Domain\All Students windows.immersivecontrolpanel, from Microsoft Corporation Publisher No Allow Everyone (Default Rule) All signed packaged apps Publisher No

Another vote for PS! I took a couple of days putting this script together because I wanted an automated solution I could use with a scheduled task. This script will place users in organizational units based off of graduation year, create home folders and set permissions. Now, I'm completely new to PS, so to the pros on this forum I know I'm a butcher. lol. This is obviously customized to our needs, but it should help. $WorkingDir = "c:\scripts" $GoogleDomain = "GoogleAppsDomain.org" $ADDomain = "OurDomain.com" $Password = "password" $BaseOU = "ou=Grad Year,ou=Students,ou=OurUsers,dc=OuRDomain,dc=com" #$BaseHome = "\\FileServer\Students$\" $HomeDrive = "H:" $UserCount = 0 $LogPath = $WorkingDir + "Log $($LogDate).txt" $LogDate = Get-Date -UFormat "%Y-%m-%d.%H.%M.%S" $PSExportPath = $WorkingDir + "PSExport2.txt" $UserExportPath = $WorkingDir + "User $($LogDate).txt" $TimeStart = Get-Date "Processing started on $($TimeStart)" | Out-File $LogPath -append "--------------------------------------------" | Out-File $LogPath -append "" | Out-File $LogPath -append Try{Import-Module ActiveDirectory -ErrorAction Stop} Catch{ "[CRITICAL] Active Directory module not loaded! Aborting." | Out-File $LogPath -append "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append "`t $($_.Exception.Message)" | Out-File $LogPath -Append Exit } $FileExists = Test-Path $PSExportPath If ($FileExists -eq $False){ "[CRITICAL] User export not found! Aborting." | Out-File $LogPath -append Exit } $PSExportFile = Get-Item $PSExportPath $Limit = (Get-Date).AddHours(-12) If ($PSExportFile.LastWriteTime -lt $Limit){ "[CRITICAL] User export is more than 12 hours old! Aborting." | Out-File $LogPath -append Exit } Copy-Item $PSExportPath $UserExportPath | Out-Null Try{$Users = Import-Csv -Delimiter "`t" -Path $UserExportPath -ErrorAction Stop} Catch{ "[CRITICAL] Export not formatted properly! Aborting." | Out-File $LogPath -append "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append "`t $($_.Exception.Message)" | Out-File $LogPath -Append Exit } If ($TimeStart.Month -gt 7) {$FiscalYear = $TimeStart.Year + 1} Else {$FiscalYear = $TimeStart.Year} AddUsers Function AddUsers{ foreach ($User in $Users) { $i++ $UserFirstname = $User.Firstname $UserLastname = $User.Lastname $PSNumber = $User.PSNumber $Grade = $User.Grade If (($UserFirstname -eq "") -Or ($UserLastname -eq "") -Or ($PSNumber -eq "") -Or ($Grade -eq "")){ "[ERROR] Information missing. Check source line $($i)." | Out-File $LogPath -Append Continue } $UserLastname = $UserLastname.Replace(".","") $UserLastname = $UserLastname.Replace(" ","") $UserLastname = $UserLastname.Replace("'","") $UserLastname = $UserLastname.Replace("-","") $Displayname = $User.Firstname + " " + $User.Lastname $SAM = $UserLastname.Substring(0,4) + $PSNumber.Substring(6,4) $UPN = $SAM + "@" + $ADDomain $GApps = $SAM + "@" + $GoogleDomain Switch ($Grade) { 12 {$GradYear = $FiscalYear + 0} 11 {$GradYear = $FiscalYear + 1} 10 {$GradYear = $FiscalYear + 2} 9 {$GradYear = $FiscalYear + 3} 8 {$GradYear = $FiscalYear + 4} 7 {$GradYear = $FiscalYear + 5} 6 {$GradYear = $FiscalYear + 6} 5 {$GradYear = $FiscalYear + 7} 4 {$GradYear = $FiscalYear + 8} 3 {$GradYear = $FiscalYear + 9} 2 {$GradYear = $FiscalYear + 10} 1 {$GradYear = $FiscalYear + 11} 0 {$GradYear = $FiscalYear + 12} Default {"[ERROR] Grade not valid. Check source line $($i)." | Out-File $LogPath -Append Continue} } $HomeFolder = $BaseHome + $GradYear + "\" + $SAM $OU = "ou=" + $GradYear + "," + $BaseOU $GroupName = "Students_" + $GradYear Try {$UserExists = Get-ADUser -LDAPFilter "(sAMAccountName=$SAM)"} Catch { "[ERROR] Unable to check for duplicate user $(SAM) Source line $($i)." | Out-File $LogPath -Append "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append "`t $($_.Exception.Message)" | Out-File $LogPath -Append Continue } If(!$UserExists){ Try{ New-ADUser -Name $DisplayName -DisplayName $Displayname -SamAccountName $SAM -UserPrincipalName $UPN -GivenName $UserFirstname -Surname $UserLastname -HomePhone $PSNumber -Description $GradYear -City $GApps -AccountPassword (ConvertTo-SecureString $Password -AsPlainText -Force) -Enabled $true -ChangePasswordAtLogon $true -PasswordNeverExpires $false -Path $OU -HomeDirectory $HomeFolder -HomeDrive $HomeDrive -ErrorAction Stop } Catch{ "[ERROR] User $($SAM) not created. Source line $($i)." | Out-File $LogPath -Append "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append "`t $($_.Exception.Message)" | Out-File $LogPath -Append Continue } $UserCount = $UserCount + 1 "[sUCCESS] User $($SAM) created. Source line $($i)." | Out-File $LogPath -Append Try{Add-ADGroupMember -Identity $GroupName -Members $SAM -ErrorAction Stop} Catch{ "[ERROR] User $($SAM) not added to group $($GroupName). Source line $($i)." | Out-File $LogPath -Append "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append "`t $($_.Exception.Message)" | Out-File $LogPath -Append Continue } "[sUCCESS] User $($SAM) added to group $($GroupName). Source line $($i)." | Out-File $LogPath -Append Try{ New-Item -ItemType "Directory" -Path $HomeFolder -ErrorAction Stop $Acl = (Get-Item $HomeFolder).GetAccessControl('Access') $Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($SAM, "Modify",'ContainerInherit,ObjectInherit', 'None', 'Allow') $Acl.SetAccessRule($Ar) Set-Acl -path $HomeFolder -AclObject $Acl } Catch{ "[ERROR] User $($SAM) home folder messed up. Source line $($i)." | Out-File $LogPath -Append "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append "`t $($_.Exception.Message)" | Out-File $LogPath -Append Continue } "[sUCCESS] User $($SAM) home folder created. Source line $($i)." | Out-File $LogPath -Append } Else{ "[iNFO] User $($SAM) already exists. Source line $($i)." | Out-File $LogPath -Append Continue } } } $TimeEnd = Get-Date $ElapsedTime = $TimeEnd - $TimeStart "" | Out-File $LogPath -Append "Processing Finished on: $($TimeEnd)" | Out-File $LogPath -Append "Total processing time: $($ElapsedTime)" | Out-File $LogPath -Append "Users created: $($UserCount)" | Out-File $LogPath -Append

See here: https://productforums.google.com/forum/#!topic/chrome-admins/mxw2VzoaPRg;context-place=topicsearchin/chrome-admins/category$3Aapplication-compatibility|sort:relevance|spell:false This put me in a tight spot after deploying the latest Chrome a little while ago. A number of sites refused to since Chrome was failing to auto download Flash on its own from Google. I went round and round with checking plugin version in Chrome and details are a bit fuzzy now, but the end solution was to deploy the Adobe PPAPI version of Flash. I dished it out via WSUS using Local Update Publisher, but I got to imagine using GPO would work just as well. From this point forward I've just resigned to the fact I have yet another software package I had to update and deploy on a regular basis now.

I setup two Squid instances (one for staff and the other for student) here in my district seven years ago and I'm still using them. Squid authenticates against our domain controllers via Kerberos and I use SARG to parse the logs. Got a few other utilities for log monitoring too, but forget the names.

Thought I should share this: I was able to setup Youtube restricted mode for our students a couple weeks using the DNS redirection method. We use Squid for logging against Active Directory, so setting up Bind on the same VM didn't take much work. I used this howto: https://www.cwssoft.com/?p=1577 So far it is working awesomely. Since we're on Google Apps as well I was able to setup teachers to have the ability to whitelist videos for the kids too.

The name linking is done by having the computer account's 'netbootguid' property populated with the GUID of the machine. As long as that property is filled and the answer file has %MACHINENAME% specified for its account name it should assume its former name. Use this Power Shell script to provision the accounts before imaging (you'll need to delete the old accounts first if the name conflicts). The script uses a CSV that needs to contain the computer name and MAC for each machine. I dug around in the DHCP logs to get this information when I did it. Took a little cleaning up in Excel. As long as each individual computer account persists in AD you'll only have to do this once. Hope this helps... (Not my script. Found it somewhere on the Internet once upon a time.) # V3.0 # Changes: # No longer relies on Quest AD Snap in # No longer uses the kludgey Test-XADObject to validate the existence of computers in AD import-module activedirectory import-csv "c:\machines.csv" | foreach-object{ #imports CSV containing Name and MAC headings $name = $_.Name $MAC = $_.Mac $CheckExists = get-adobject -Filter {(ObjectClass -eq "computer") -and (Name -eq $name)} #Will be $NULL if this is a new computer if ($CheckExists -eq $NULL){ [guid]$nbGUID = "00000000-0000-0000-0000-$MAC" #casts 0s + MAC into a GUID, which is required for the netbootGUID property new-adcomputer -Name $name -SamAccountName $name -OtherAttributes @{'netbootGUID'=$nbGUID} write-host $name " - " $nbGUID } else { write-host "$name already exists." } }

I know you already got this fixed, but you may want to block connection the doubleclick domain. I do this. Helps cut down on a lot of the garbage.

As much as I despise Flash too, I haven't had any issues when applying for the distribution license. Typically gets back to me within a couple minutes. I had to hunt down my account details a few weeks ago after I learned Chrome wasn't including Flash anymore in the installable binary. Chrome will attempt to download it itself on a first use basis and it was creating issues with my setup here. Deploying the PPAPI version of Flash I downloaded from their distribution page fixed the issue. I'm more giddy about the fact that the need for JRE is finally going away.

As mentioned here Chrome no longer includes Flash in its installer. It's now supposed to download Flash by itself on a need basis, oddly enough from Google's content servers (don't exactly know what they're trying to accomplish here). Nevertheless, the download ends up failing half the time and it needs to be done for every user. Flash is almost 30MB and I don't need this happening on machines that don't keep user profiles. Long story short is download the PPAPI version of Flash from Adobe by requesting distribution rights (they get back to you within minutes). You can push the MSI via AD or I use Windows Package Publisher in conjunction with my WSUS setup. Unfortunately, this is just another separate package that needs to be maintained now.