Duke5A

Not trying to be a Valve fanboi here, but games release through Steam that use Steamworks for their DRM check do just seem to work. I stay very far away from Ubisoft titles and to a lesser extent EA. Ubisoft is the damned Devil.

Don't let Squid scare you. Setting it up for Kerberos can be tricky, but as a basic cache peer it's really simple. I used a minimal install of Ubuntu (shell only) and installed everything I needed from the repositories. You can host your proxy PAC off of the same box by installing Apache.

Our content filters are provided by the local government and are thus external. I wound up setting up a couple of Squid proxy servers (one for staff and the other student) and configuring the outside content filter as an upstream cache peer. Squid is setup to use Kerberos authentication so it can log web traffic by AD username and it is configured on the clients by means of a proxy pac file. It's actually been in place for four years now and I've never had any issues with it.

https://social.technet.microsoft.com/Forums/windowsserver/en-US/36ebd50c-e374-4b36-95f6-0ab6e6d98ce4/manage-documents-manage-printers-permissions-do-not-seem-to-work?forum=winserverprint

How did you copy folders over to the new box? If you used robocopy with the /MIR switch then it should have also copied the permissions. Alternatively take a look at this blog post I wrote ages ago:VB script for creating student drop boxes - Blogs - EduGeek.net It's a script I setup to automate drop box creation. A little tweaking and you should be able to use it in your environment.

On the security tab under printer properties you can grant rights to manage documents and not the printer itself. I also run this script as a scheduled task nightly to empty printer queues: Set objWMIService = GetObject("winmgmts:\\.\root\cimv2") Set colInstalledPrinters = objWMIService.ExecQuery("Select * from Win32_Printer",,48) For Each objPrinter in colInstalledPrinters objPrinter.CancelAllJobs() Next

I second this; the K-5 kids love it.

This looks promising. I'll give it a go and report back.

This is a bit of a brain tickler: Google Chrome will not pickup proxy settings if it is launched first after logging into machines. As soon as you open IE and allow it to load the homepage then, and only then, will Chrome start using the proxy. Proxy settings are defined via GPO and we're using an auto configuration script. This problem has been around for ages as it is detailed in this thread on Google Code: https://code.google.com/p/chromium/issues/detail?id=386088 Now here is another tickler: I grew frustrated and decided to statically set proxy settings for Chrome through GPO rather than letting it get them from Windows, and it still does the same damn thing. I am sooooo tired of having to juggle three different browsers because of all the crap that works on one, but not another.

How do you build your images, pre-cook them in a VM, or straight off of an install WIM? Post the specialize section of your answer file. That error should be detailed in the setup log on that computer.

You're really over thinking this. reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f Run that as a first logon command in your answer file. It'll look something like this: cmd /q /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f This will remove all entries from start up if you want to be lazy about it. For a more targeted approach use the same method, but call out the actual value names that launch the offending tray apps.

You need to build the answer file in Windows System Image Manager and use the original install media to build the correct catalog. Use this as an example starting point: en-us en-us en-us en-us en-us en-us true Your Org Your Org true true true true true Generic KMS Key goes here %MACHINENAME% domain.com zzzzzzzzzzzz JoinUser domain.com OU=Win7,OU=ComputersWDS,DC=Domain,DC=com en-us en-us en-us en-us en-us zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz false true 1 LocalAdmin true true Work 1 zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz false LocalAdmin Administrators LocalAdmin Eastern Standard Time true 5 C:\Windows\System32\sysprep\ClientSideClonePrepTool.exe Blank HW ID from Symantec Client 1 false cmd /q /c del /Q /F c:\windows\system32\sysprep\Win7ENTx64.xml Delete XML answer file 2 cmd /q /c del /Q /F c:\windows\panther\unattend.xml false Delete XML answer file false 3 "C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE" Rearm Office false 4 Activate Office cscript "C:\Program Files (x86)\Microsoft Office\Office15\ospp.vbs" /act By default the local admin account is disabled by the mini setup; just create a another local account and use that for your auto logon. This answer file will create computer objects in predefined OU so that freshly imaged machine can get policies that allow lower level tech accounts to install software and whatnot, but this is only if the computer account hasn't been pre staged. If it has then specifying the name to be %MachineName% will cause it to pickup that name and location of the computer object. The commands that run on first logon activate office, delete the sysprep answer file, and strip the unique identity for the crappy antivirus we use.

Those system tray icons are just exe files placed in the run section of the registry. To automate it you can either write a script the runs on first logon to remove those registry values or you can edit the driver inf and remove the line that places the tray utility in the registry run section.

Go to straight to Microsoft and get a driver certified to work. Drivers from MS's catalog are typically stripped down and are extremely small; the 8500 driver I'm looking at right now is only 646k. Whenever setting up printers (especially on a printer server) I check the catalog first for compatible drivers. Microsoft Update Catalog I swear HP drivers were written by the hand of Lucifer.

As already mentioned, if you have a dumb switch in a classroom and a kid loops that then all the Spanning Tree protection in the world won't do anything. You need to be monitoring your switch links in some kind of SNMP poller like MRTG or The Dude. The Dude saved my backside last year as we had a kid loop a 5-port switch in a classroom. Looking at the links between the switches you can see which way the broadcast traffic is flowing and trace it back to the offending switch and finally the port.

We use Deep Freeze as well, but even without it I never leave any of the auto updates enabled. Everything gets pushed via WSUS by means of Local Update Publisher.

I'm a bit confused; the WPAD file is still accessible at home when offsite? Is the URL to it specified in the auto proxy config field in Internet Options? The way I use it is I specify the URL to the file in Internet Options under 'Use automatic configuration script' via GPO. The script is hosted on an internal server that isn't accessible from the outside. When a user takes their laptop offsite IE doesn't have access to the script anymore and reverts to going to direct.

It's rather common knowledge now that you can enable down scaling (if the hardware supports it) in Windows to increase resolution beyond the max supported by a display. It basically involves searching for every REG_DWORD Display1_DownScalingSupported and changing the value to one. The problem I ran into was I needed to do this to a multitude of different model netbooks and the key name changes between models since it is named by GUID. So a simple registry export/import wouldn't work on dissimilar models. Here is a simple batch file solution: @echo on set KEY=HKLM Set VALUE=Display1_DownScalingSupported for /f %%A in ('reg query %KEY% /v %VALUE% /s ^| findstr HKEY') do ( reg add %%A /v "Display1_DownScalingSupported" /t REG_DWORD /d 1 /f The above will enable you to select 1024x768 on a system that only supports 1024x600. The aspect ratio will be off, but if you have applications that check for resolution requirements then this will get you past that. After the keys are changed the system needs to be rebooted. This was successfully used on Dell Latitude 2100 and 2120 netbooks to get past the 1024x768 resolution requirement for the NWEA Locked Down Browser.

Sure it is! It's all about setting up your answer file correctly and creating the computer object ahead of time. To have the machines automatically grab the correct names you prestage the computer account in Active Directly and place it where you want it. Once imaged the machine will attach itself to that computer object and pull all the policies associated to it. Set the computer name field in your answer file (should be in the specialize pass somewhere) to: %MACHINENAME% Now read here to create the computer object: Provisioning Computer Accounts with netbootGUID for WDS Deployment Great thing is, once the account has been staged you never need to do it again. Image as many times as you like and it'll always pull the same name and location in AD. Set your auto logon and run once lines in the answer file for tweaking and it can be completely automated. The only thing you'll need to do is start the process by hand and selecting the appropriate image. ---- EDIT ---- For licensing you're going to need to use KMS keys along with a server. You can use MAK, but there is a finite number of activations with this type of key and you'll eventually run out.

Run RSOP.MSC, right-click on 'Computer Configuration', select properties, click on the 'Error Information' tab. See anything?

You mean an EES agreement? I had no idea the standalone AV was offered free with that licensing. We have Office and Windows covered under EES, so I'm definitely going to look into this.

Staff are on 20GB limits while students are on 4GB. I had to turn quotas on after the backups started running through the morning and discovering a student home folder with 110GB used; it contained the most comprehensive and meticulously organized collection of anime I have ever seen.

I have officially had it! We're using Symantec End Point 12.1 and it's a total, putrid bloated pig of an application. Installing it on anything is like putting a boat anchor around the systems neck and expecting it to tread water. The final straw was me discovering it eats 10GB of space on my base image. Various cleanup tips from Symantec have been useless. A word of caution to anyone thinking about a Symantec product: don't walk away, run! Whether it is anything in their AV line or even Backup Exec (we ran this pile for years) it's all complete crap. Does anyone have any recommendations for a replacement? I'm interested to see what your opinions are. We recently ditched Backup Exec for Veaam and I couldn't be happier with that decision.

Something else I just thought of: do you have your wireless subnet defined in ADSS (Active Directory Sites and Services). I've seen this slow down machines finding domain controllers.

I was always leery of installing VNC on client machines; especially seeing as how a lot of those machines were laptops there are frequently taken offsite. I wound up writing a custom launcher for TightVNC that would: Copy TightVNC to the target computer via the admin share Randomly generate a password for that session Create the registry keys on the target machine Register TightVNC as a service and start it Start the TightVNC client and connect to the target Wait for the client to be closed on your end and then clean up the registry and files on the targer computer If the connection was severed then there would be a cleanup script in place to remove all of that stuff on the next boot Requirements are: Open the VNC port on the targets firewall Have the remote registry service running on the target That you have local admin on the target That file sharing is enabled on the target so you have access to the admin share Remote management is enabled A GPO tweak to enable CTRL-ALT-DEL sequences to be sent to the client to logon if need be I can dig out the source if you're interested. I should probably make blog post for it.