Duke5A

We use Deep Freeze here on about 1300 student machines and almost half those are netbooks. Profiles are kept on the local machine so they have to be rebuilt every time, but it doesn't seem to be that detrimental to performance. A typical desktop (Core2, 4GB, 7200RPM disk) can be up and running from a cold boot in a couple of minutes. We do not enforce a reboot on log off though. The netbooks on the other hand really dogged down with Symantec End Point 12.x and Deep Freeze, so about two years ago we started stripping the AV out of the netbook carts and only running Deep Freeze; this increased performance on orders of magnitude. We still use AV on the desktops though since they have the ability to be woken up at night for updates. The AV on netbooks since it wasn't getting updated was next to useless anyways. Depending on how you have the schedule set for Windows Updates and AV updates could really be hurting performance as well if it is constantly downloading the same updates throughout the day.

I don't have the Promethean software installed on anything, but the Smart software loads a driver for the tablet functionality and lists it under Human Interface Devices in Device Manager. The device name has tablet in it so it's easy to find. I'm assuming that this is what that script using Devcon disables. If that is the case it should just be a matter of finding the right Promethean device to disable and using its hardware ID with Devcon. If you don't have it already, I included the x64 version of Devcon in a blog post last year here: Card Readers and Mapped Network Drives - Blogs - EduGeek.net For some reason the standalone download includes the x32 and ia64 versions, but not the x64.

Count another for LAN School; we use it here in 10 computer labs and it works flawlessly. Completely configurable through GPO and deploys through AD without a hitch. Pricing was very cheap too compared to all the alternatives.

I just checked two separate systems (Optiplex 760 and Latitude 2100) with Crucial V4 SSD drives and they came back aligned. Both these systems were imaged through WDS with no special prep for SSD drives.

Just a heads up, those 560 boards are serial, but Smart does make a USB to serial cable that works with the new software.

It would work in XP as long as the controller the boot drive sits on uses the same driver as the one on the old board (same south bridge chip). I remember being able to uninstall the controller in device manager prior to pulling the drive and it would play and play the new controller properly.

Is your script written in VB? I had something similar to this happen a couple years ago and wound up adding a couple lines to the script to disconnect drives if it detected they were already in use. Another thing I could possibly think of is the drive letter is in use by a card reader or sort and it's hidden in Explorer since there is no media in it.

A coworker in the office here brought up Cryptolocker this morning. I've heard of it, but never seen it in the wild. It's ransomware that encrypts documents and hits you up for money or deletes them in a couple of day's time. Nasty stuff... Anyways, he stumbled upon a prevention kits of sorts using GPO. I'm only reading through it now, but it looks pretty cool. Cryptolocker Prevention Kit (updated) - Spiceworks

Tell me about it. I made the mistake of building IE10 into the base image over the summer and it has been nothing but a headache since. It broke a number of sites that are working in IE9 that included: our SIS system, E2020, parts of Black Board, and smaller sites individual teachers use. We use Google Apps as well, and Google just announced they're dropping support for IE9, so damned if you do, damned if you don't. Chrome is now on every machine in the district as a result. Thank God it works well with GPO.

It's in the Computer policy. Computer Configuration > Policies> Administrative Templates > Printers > Point and Print Restrictions You only need to worry about this if you're running Windows Vista/7/8. We still deploy our printers via script as well since GPP proved to be unreliable. Besides, using a VB script allows for much better granular control without making a mess of AD. I made a sample script in a blog post here: VB Script for network printer deployment - Blogs - EduGeek.net

Are they all the same model laptop? Or more specifically the same model wireless chipset? You may have a driver issue.

Long story short, Java started including an expiration timer on JRE releases. So many days after a release, regardless of update settings, a dialog will start popping up asking the user to update. This really isn't an issue, but with it JRE will stop running unsigned code. Many sites that my teaching staff have come to rely on have unsigned Java apps, and keeping over 500 frozen wireless laptops up to date every time a new version of JRE is released isn't really feasible. So enters VB script to get around the issue. The code below is a sub from my logon script that deals with this issue. The setting the keeps Java from running said unsigned code is the security level and is stored in the deployment.propterties text file in each user's local profile. The default level is high and the line is not present in the config. Adding the line will force JRE into medium the next time it is launched. Since this is plucked out of my logon script you'll need a source for the username, but other than this it'll work as is for Vista/7. For 2k/XP you'll need to modify the path. Sub TempFixes5 Set objFSO = CreateObject("Scripting.FileSystemObject") Const ForReading = 1 Const ForWriting = 2 FoundIt = False strUserFilePath = "c:\Users\" & strUserName & "\AppData\LocalLow\Sun\Java\Deployment\deployment.properties" strSecurityMedium = "deployment.security.level=MEDIUM" 'Check to see if Java is installed, if not, then exit sub If objFSO.FileExists(strUserFilePath) Then 'Do Nothing Else Exit Sub End If 'Check to see if Java security is set to medium, if so, then exit sub FoundIt = (InStr(1,objFSO.OpenTextFile(strUserFilePath,1,true,-2).ReadAll,strSecurityMedium,1) <> 0) If FoundIt = True Then Exit Sub Else 'Do Nothing End If 'Open Java configuration files for reading Set objUserFile = objFSO.OpenTextFile(strUserFilePath, ForReading) 'Copy file contents into string strUserFile = objUserFile.ReadAll 'Add medium security line to config strNewUserFile = strUserFile & Chr(13) & strSecurityMedium 'Open Java configuration files for writing Set objUserFile = objFSO.OpenTextFile(strUserFilePath, ForWriting) 'Write the files objUserFile.WriteLine strNewUserFile 'Removes Java configuration file from memory objUserFile.Close 'House cleaning Set objFSO = Nothing End Sub

@mac_shinobi WMI Corruption.docx

Anyone ever have WMI go legs up on them? In my 15 years of working IT I never have and of course the very first time I have to deal with it it hits my Windows 7 x64 base image. I first noticed it when trying to activate Office 2010 using the OSPP.vbs script; it was giving me an error code of -2147217406.. It was failing hard and so was another script I use for post-image related tasks. I then found this in the Event Log: Windows Management Instrumentation ADAP failed to connect to namespace \\.\root\cimv2 with the following error 0x80041002 Running the WMI Diagnostic utility was also filled with similar errors. 0x80041002 (WBEM_E_NOT_FOUND) After messing around with a couple potential fixes the only thing that cured it was stopping the WMI service and resetting the WMI repository using this command: c:\windows\system32\wbem\winmgmt.exe /resetrepository You can test it by either running a script that calls to WMI, or using a built-in utility in Windows to connect. c:\windows\system32\wbem\wbemtest.exe What bugs me is that I don't know what caused it. The only changes I made to image since the last update was these: Image Revision: 2013/10/23 -Windows Updates -Installed Java 7u40 -Added registry keys to disable sponsor in Java Update -Removed Start Menu group -Installed Windows Live Movie Maker 2012 -Installed Flash 11.9.900.117 -Installed Reader 11.0.04 -Installed Google Chrome 30.0.1599.101 -Updated OEM information I suspect it was one of the updates; the last time it was ran was 8/22. Fun times... I got to waste an entire morning ironing this out. Now to sysprep and resend this pig of an image back up to WDS.

Doesn't seem bad from an educational standpoint. According to the site it uses existing chat networks to initiate connections; which are already blocked by most. The fact that it is a browser plugin isn't bad either as this is blocked through policy for installed browsers, and portable browsers are blocked through the App Locker policy (students can only execute programs inside of the Windows directory and Program Files - two areas they don't have write access to).

At work we use Exacqvision. It's a pay for solution that scales really well and barely touches the CPU. A free one that I use at home is iSpy; it can be rough on CPU, but does motion recording, remote access, etc, etc.

Wow, a typical max here is between 32 or 34 with an average of 29 (in a public school at least). I'll bet a class environment over there is a lot better controlled and conducive to learning.

It tries to come off as a cheery sort of holiday like a birthday or such, but to me it reads, "It's Tax Day!"

We're running Deep Freeze on about 800 clients and I've seen this issue crop on more than a few. It's exactly as you described where the machines still require an additional reboot for those multi-reboot updates, but they freeze before the last one causing an indefinite loop. The quick and dirty individual fix is to put up with WinPE (available via our WDS server), drop to a command line, and deleted "C:\windows\winsxs\pending.xml". I haven't seen the issue recently, but we're still fixing problems with client-side targeting working on our WSUS server so a large portion of student machines aren't getting updates right now. If you use client-side targeting specified in GPO, then remove all Windows Update configuration from the Deep Freeze client configuration file.

You should be using psexec for this; it's part of the Sysinternals Utilities suite and is a free download through Microsoft. Sysinternals Utilities Drop each computer name in a text file on its own line and run it some like this: psexec @PCList.txt -d "shutdown -r t 0" It'll start the shutdown process client side all at the same time. You may need to play around with command switches to tweak it, but I use this utility all the time to refresh group policy en mass amongst other things. BTW - are the clients XP?

It was more out of necessity than anything else for us;IE10 breaks so many pages in completely random ways it is not even funny. Looking at alternative browsers Chrome was the only one that has itself together in an enterprise environment. Firefox is a hot mess and the only enterprise solutions it has are supported by third party. But yeah, Chrome has certainly made my life easier. Thank God someone out there knows what they're doing.

Are you just looking for an SNMP poller or something more in-depth that will do event log monitoring? If the former, then give Dude a try if you haven't already. I set it up here monitoring a fairly large infrastructure complete with detailed maps and alerts. I've even got it graphing charge, load, and input voltage from my APC units. The mentioned is in fact free, but just because something requires payment doesn't mean it's good.

The Google Updater has it's own policy template separate from Chrome; no need to resort to the dark arts to control it. Google Chrome and Update were actually the easiest things to push and admin that I've done it a while.

You could always spin up another VLAN and gradually migrate over to it if you can get to everything at once.

This is exactly what we're doing too. Using App Locker it has been extremely successful.