Duke5A

So I have a teacher that wrote a grant proposal without our knowledge and was awarded 29 Chromebooks. I learned of this when they showed up at my office door last week. We have a fully functioning Google Apps domain that we use with existing Chrome devices so I'm not worried in that regard, but the terms of this grant states that the kids need to take these home and use them outside of the school. This has me worried as I don't know if I can provide web filtering for these if they leave the network. Anyone have any experience with this?

The HP software for managing their RAID controllers from within Windows is absolute garbage with Dell's Open Manage coming in a close second. I've been spoiled with Dell servers though because their PERC controllers are just rebranded LSI cards and the LSI Megaraid Storage Manager works with them. MSM to me is exactly what it should be and nothing more (remote management capabilities, built-in reporting, etc). Does anyone know of any tricks to managing HP RAID controllers? I'm just trying to get some simple email reporting going, but their software and required licensing for basic functionality is a minefield. Thanks...

Youtube is most likely being redirected and you can't simply redirect an HTTPS page. That is why you're seeing what that error message. Try browsing to YouTube with an HTTP:// in front of it first. Whatever is redirecting you should intercept the request before it reaches YouTube and you should be served the redirect page.

There are log files inside: C:\Windows\System32\sysprep\Panther The few times I've had sysprep fail on me I was able to fix with the help of these.

I don't know if you guys ever got this to work, but I ran into the same problem with MMC crashing every time the console would try and display a list of installed packages. I customized my image and removed a lot of the crap bundled packages. I thought this might have something to do with it so I installed vanilla Win10 into a VM with the management tools and it worked.

So how does one get security and software updates out to remote users? My school has three criteria that set this problem into motion: our teachers all have laptops, they're allowed to take said laptops home, and we're on a 9 month calendar year. So, for the staff that elect take their laptops home that means they're offsite for almost three months. That is a long time to go with no security updates... Beginning to look at ways of solving this problem I saw that some admins had come up with scripts that detect whether or not the system is on the domain network, and if not it would revert Windows Update to look to Microsoft rather than the internal WSUS server. This would work for most, but I just don't use WSUS for delivering Windows security updates - I also use it to update Chrome, Flash, Adobe Reader and a few others using WSUS Package Publisher/ (auto update for said software is disabled in base image). The ability for remote users then to reach the internal WSUS server is pretty much a necessity then at this point unless I wanted to change my process (which I didn't). Before setting this there needs to be some prerequisites: Your internal domain name doesn't have a made up TLD like .local or .corp You own your domain name on the outside You have a certificate authority A functioning WSUS install The above isn't absolute and there are ways around them, but this is how I set it up on my network. And since this is going to be exposed on the outside, you need to do move forward with security in mind. We will be enabling SSL and locking down some sections of WSUS.

Aside from the pain you're inviting on yourself with onsite Exchange and a CA, you're domain is already named properly. Why you shouldn't use .local in your Active Directory domain name.

No it won't, but adding that functionality could be done in a dozen lines or so - it's not hard. The script would run at the privilege level of the user who is logged into the computer, so you would probably need to run it as a domain admin and the strings at the top would need to be edited to match your domain. I'm going to be blunt though, you need to be able to pick something like this apart and at least be able to identify what does what before turning it lose on a production environment. Scripts can be great time savers, but can also break a lot in very short order. I never run anything against my AD without thoroughly testing it first.

So..cool...must..resist...urge..to...spend...money!

Zip files in email get dumped via our spam filter. My above post was only referring to the macro attack vector. Disabling macros, or at least requiring them to be digitally signed before allowing them to run goes a long ways in mitigating ransomware.

Here is some VB that can do the user account changes: strDomainName = "Your Domain Name Goes Here.com" strLDAPPath = "LDAP://OU=Students,OU=Users,DC=yourdomainname,DC=com" strHomePath = "\\yourfileserver\sharename\" Set oContainer = GetObject(strLDAPPath) oContainer.Filter = Array("user") For Each User in oContainer on error resume next strFirstName = User.FirstName strLastName = User.LastName strUserName = Left(strFirstName, 1) & "." & strLastName User.DisplayName = strFirstname & " " & strLastName User.SAMAccountName = strUserName User.userPrincipalName = strUserName & "@" & strDomainName User.Put "homedirectory", strHomePath & strUserName User.SetInfo wscript.sleep (30) If err.number <> 0 Then msgbox err.description & " " & user.samaccountname end if Next Msgbox "Work is Done!" You could add a couple lines to change the directory names as it flies though. I just pulled this out of my backside with no testing, so test it against dummy user accounts in a dummy organizational unit.

I try and keep things as segregated as possible and use as the least amount of shares that I can. My setup goes something like this: Staff Home Folders ("\\fileserver\staff$") -UserA -UserB -UserC One top level share with users in their own folders underneath and maps pointing to their corresponding folders. Use file level permissions to keep users in their own folders and never grant full control to the user as you don't want them to be able to monkey with permissions. Student Home Folders ("\\fileserver\students$") -2016 -StudentA -2017 -StudentB -StudentC -2018 -StudentD One top level share with students in their own folders underneath organized by graduation years and maps pointing to their corresponding folders. Use file level permissions to keep users in their own folders and never grant full control to the student as you don't want them to be able to monkey with permissions. Building Shared ("\\fileserver\buildingshared$") -BuildingA -Staff -Student -BuildingB -Staff -Student -BuildingC -Staff -Student Maintain security groups that divide staff up by the buildings they work in and don't allow one building's staff into another's share. Place the student folder underneath the staff. This is done so that staff can modify the student shared area under one drive mapping. Use file level permissions to keep the kids from being able to go up a directory into the staff folder. If you have staff that work in multiple buildings then simply make them members of multiple staff groups. Map staff to the root of the share so that they can choose the appropriate building. This allows staff the works in more than one building to use the same shared drive rather than having to use a different map for each building. Applications -BuildingA -BuildingB -BuildingC CentralOffice -Business -Student Services -Human Resources Have your SLT separated into different security groups based on roles and limit cross access. District Shared Grant all district staff read to this share and limit who has write. The object is to give people as much access as they need to do their job and no more. It's not so much about keeping a staff member of one building out of another building's share for confidentiality reasons as it is damage control. People accidentally delete/move things and keeping control of how many hands are in the pot mitigate this. Additionally if something like Crypto Lock ever gets lose in your environment measures like this could go a long way in minimizing potential damage.

If budget allows don't put all your eggs in one basket. Primary Domain Controller - Can hold all FSMO roles - DNS - DHCP (split scope setup with secondary DC) - Radius (if needed) Secondary Domain Controller - Mirror of the primary - DHCP (split scope setup with primary DC) Utility Server - WDS/MDT/SCCM - WSUS File Storage Certificate Authority (if needed, most don't) - Never place your CA on a domain controller Print Server I've had problems with one service or another during operating hours and it helps to keep distinct roles on separate installs. Taking one thing down for service in the middle of the day that way doesn't stop your users from being able to work.

I second this and have seen it with Windows 7. Our CAD lab wouldn't WOL after upgrading to Windows 7 and replacing the driver that shipped with the OS cured it.

I've seen Step 1 take the form of macros in Word and Excel files here in my own environment. Actually had users open the .doc and follow the instructions in it to run the download macro. Fortunately, Symantec caught the downloaded payload and stopped it. Here are some shots of it in action on a secured computer: What I've done is downloaded the ADMX templates for Office and added them to the central store. This allowed me to disable macros for all users in my environment.

We drop guests onto a segregated network and use the filter in a captive portal setup where the student needs to accept terms before they're allowed out. We're currently looking into requiring students to use a username and password though. This way it will not only filter, but log traffic according to username. You can take it one step further and enable SSL inspection so that the filter can filter HTTPS connections by content and just not domains - this requires students install a certificate on their device though. Our filter will actually prompt the user to do so.

We opted to go with their 410Vx virtual machine since we already have a virtual cluster and the pricing for the VM was a LOT cheaper than the appliance. It's advertised as handling up to 800 concurrent users or 80Mbps of traffic. I set it up using WCCP to handle the redirecting of traffic at our core switch. We priced out a couple of other vendors and all of them were very pricey when looking at physical appliances - I had no idea it would cost that much. The virtual machine was significantly cheaper, but I don't have the cost on hand. What steered us their way was the fact we already have one of their messaging archival appliances and it has been rock solid in five years of service. At the end of the fourth year our service contract entitled us to a new box and their tech support team pretty much handled the entire migration remotely.

Quick and dirty method is to use 'msconfig' and take a peak under the Services and Startup tabs. Be sure to hit the check box on the Services tab that hides all MS services. Edit: If it's coming back while the machine is on then it might be a scheduled task. Take a look in there.

I just setup a Barracuda filter for our guest wireless access and I've been very impressed with it so far. I haven't even scratched the surface yet with everything it is capable off.

How are you mapping your drives? If the home folder is specified in the user's AD account this could explain why you see just that drive and nothing else since whatever method you're using to map the other drives is failing. I use Group Policy Preferences to map all my users' drives and it never skips a beat.

Something else that might be of use: Controlling Windows Update Using PowerShell | PowerShell content from Windows IT Pro It's a collection of Power Shell scripts for managing Windows Update in 10. I built these into my base image should the need ever arise to have basic functionality back in controlling WU.

Pickup a used college textbook for an Active Directory class and go through it. It'll bring you from the ground up and teach you the inner workings of domain controllers and roles. Great thing is you don't need to spend a lot of money on current texts. The core parts of Active Directory haven't changed much through the years. I'd say a book on server 2008R2 or even 2008 is fine.

I just wound up building a Windows 10 image the same way I have with previous versions of Windows: in a VM using snapshots and Sysprep. Removed all the preinstalled garbage and imaged using WDS. Works great on Surface Pro 3 tablets.

@woreilly nailed it. That is exactly how I would push it out. Only problem is you're going to need an existing network connection to be able to do that. Don't worry about the profile importing more than once as it won't break anything.

If remote control software won't connect to them then it's not an issue with the keyboard - the machine itself must be frozen. I would say have a look at the system log in event viewer and see if anything stands out. Maybe a driver being misapplied in the imaging process is causing something to hang when the machine sleeps. I've had old versions of a driver work fine on one model machine, match the vendor and device ID on a newer machine so that WDS would install it at imaging time, but cause stability issues further down the line. It can be a pain to narrow down.