Duke5A

Could be a couple of things... - Do you deploy software that was packaged by hand? I've created packages using the snapshot method and the reference machine I was using decided to check in with the KMS server in between the before and after snapshots. I didn't realize this until I deployed the package to a dozen computers or so. They were all coming back with licensing errors after reboot. It worked itself out eventually, but I did have to recreate the package. (Note to self, use MAK keys on reference computers for building packages). - Do you using software similar to Deep Freeze? The systems have to be scheduled to thaw periodically or every time they boot Windows will believe it hasn't checked in with a KMS server since it's initial call in. - The Deep Freeze software will also affect MS Office, even if you have a maintenance schedule to thaw the machines at night. Office doesn't attempt to activate until it's opened. You can force it to check in via command line if need be. Outside of that, I've never really seen any issues with KMS licensing.

Not much in the way of advice, but I just pulled the plug on it. I was using the URL rewrite method and it worked when it was initially setup; then out of the blue kids were able to access videos/comments outside of the educational channel. Google supposedly fixed it (and it worked for a while) and then I started getting complaints again. Youtube seemed to be ignoring edu filter option on the end of the URL. I don't want to keep thinking when are the kids going to eventually circumvent the filter again. It proved to be too much of a headache in the end.

I hope you're using the group policy templates to keep the kids from changing proxy settings/installing plugins.

Note to self, don't cross plexer. In all seriousness though, I've never seen shielded cabling installed in a school environment either; not even in relatively big districts (10,000 kids or so).

How many clients do you have on the network? A handful of IP cameras wouldn't necessarily need their own VLAN, but if you're entire building is on a flat network it might be a good idea to start. Typically it would look something like this: - A VLAN for servers that is accessible by all. - Management (switching infrastructure) - An instructional VLAN for wired staff and student machines. - One for security (IP cameras, IP enabled door lock controls, etc) - Wireless clients - Wireless management (for access points) - Telephone systems This is by no means a definitve list. It all depends on the size and diversity of your network. Setting up VLANs though is still a good idea, even if it's just a few. The district I came into used to have a lot of its equipment on the same VLAN wired computers were on, and this included the building phone systems. Out of the blue at almost every same time in the morning the phone system would go down. We had the phone vendor out to check over the equipment and he couldn't find anything wrong. Looking at Solarwinds though showed an uptick in broadcast traffic during every episode. Long story short, it turned out to be classroom monitoring software called LAN School causing the issue in a lab down the hall. Every morning the teacher would start it up at about the same time and it uses broadcast traffic to discover the clients. Phone systems apparently don't like to be interrupted. Moving the phone switches over to their VLAN fixed the issue.

What settings are those? I only ask because I'm still having some very random issues of proxy settings not applying correctly on wireless devices.

In regards to the SMB Service and TCP protocol components, does anyone know if this addresses the SMB performance issues of using a W2k3 file server with Win7 clients?

What you need a site to site VPN between you and the data center then. You're going to have to work out the details with them and you might need to purchase a new firewall. This isn't that odd of a setup, but be prepared for everything to stop working if that link goes down.

It's been a while, but I remember Apple Application Support needing to be installed as well. I think this is it's own MSI.

Agreed. We're running 2010 with 400 mail boxes on a VM with 8GB and four virtual processors. It barely touches the processors but eats all the RAM. Runs fine and mail is the only thing that VM does.

Something or someone has a lock on the file. You can go into the Computer Management console > Shared Folders > Open Files to see who has what open. If this persists, reboot the box after hours and try opening the script locally by browsing C:\Windows\SYSVOL\sysvol\\SCRIPTS.

If you use a client VPN solution you're going to have to set it up so the connection stays persistent even without a user logged in to the computer. If you don't you'll be able to join the computer to the domain, but upon reboot it won't have a connection back to the domain to process the initial logon request. Cisco's VPN client has an option specifically for this.

I can't make any recommendations, but we just replaced our core with a new 6506 and it cost $40,000 USD. This was with dual power supplies and a single supervisor module. The cards from the old core were reused. I think a total overhaul with dual supervisor modules and new 10GB blades was somewhere between 70k - 80k USD.

Create a new policy, open up Computer Configuration, right clock on Administrative Templates, and select add/remove templates.

@tom_newton Is Smoothwall capable of transparent SSL filtering? That one of the biggest hangups we have with BYOD right now as filtering is a state requirement.

How was it installed/deployed? It sounds like Photo Story is running under different credentials than the user. When you start it up, open task manager and look at the Photo Story process. What user does it list it running as?

Java has been an extreme pain in the neck as of late with the constant updates. Many sources are calling to uninstall it, but unfortunately many of us don't have the luxury of doing that. So the next best thing besides pushing out a stream of updates (that are already exploitable out of the box) you can do is to disable the Internet Explorer plugin. The ability to run Java within a browser is something that isn't needed in my district; all that is needed is for Java Web Start to handle the JNLP file association. Now, I just figured I could write an ADM template and do this through GPO, but the values you need to changed are stored under a key named according to the version of Java installed. So writing a template would only be good for the version you wrote it for. Scripting was next viable alternative and this one will handle any version of Java installed on the system. Const HKEY_CLASSES_ROOT = &H80000000 Const HKEY_CURRENT_USER = &H80000001 Const HKEY_LOCAL_MACHINE = &H80000002 Const HKEY_USERS = &H80000003 Const HKEY_CURRENT_CONFIG = &H80000005 strComputer = "." Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colOS = objWMIService.ExecQuery("Select * from Win32_OperatingSystem") For Each OS in colOS strOSArch = OS.OSArchitecture Next If InStr(strOSArch, "64") Then WriteKeys HKEY_LOCAL_MACHINE,"Software\Wow6432Node\JavaSoft\Java Plug-in\",strComputer WriteKeys HKEY_LOCAL_MACHINE,"Software\JavaSoft\Java Plug-in\",strComputer Else WriteKeys HKEY_LOCAL_MACHINE,"Software\JavaSoft\Java Plug-in\",strComputer End if Function WriteKeys(HKEY_LOCAL_MACHINE, strKeyPath, strComputer) Set objReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv") objReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys For Each SubKey in arrSubKeys objReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath & SubKey, "UseJava2IExplorer", 0 objReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath & SubKey, "UseNewJavaPlugin", 0 Next End Function Set it up as a startup script in GPO and you should be all set. I hope this helps...

If this is route you want to take, then I highly recommend getting into an educational institution at first. Educational IT is the wild frontier of the technology industry. You're placed in an environment where you have limited resources and you're challenged to come up with non-traditional ways to fix issues. You'll become an IT MacGyver. If you go corporate odds are you'll become silo-ed. You'll be responsible for a very specific task and you won't be allowed out of that. No out-of-the-box thinking in those jobs. At least these have been observations between working in this field for 12 years. I've got a few friends who went from education to corporate as well to draw on. Advancement opportunities may be limited in education, but we have the most fun.

Your workstation is probably getting a DHCP reply from the router first. There is no way to specify on the workstation what DHCP server to use; it's simply whoever replies the fastest. What you should do is add the workstation's MAC address to a deny list on the router. This way the router will not respond to DHCP requests from the workstation and it will be forced to get an address from the 2k8 server.

We're using it on a managed Cisco wireless network. A pair of W2k8 R2 Radius servers are used to handle authentication against AD to join the network and a pair of Squid proxies setup for Kerberos handle student and staff web traffic. When it was originally setup the Radius server would allow you to join based off of computer and/or user credentials. I discovered that students were using their AD accounts to join private phones to our network. To stop it I changed the wireless policy for student computers in AD to only use computer authentication and then denied the top level student user group access in the Radius policy. All in all, the setup works great.

Get a wireless router that has the ability to be setup as an access point only or a bridge. You could probably get an old Linksys WAP54G off of ebay cheap enough.

You can, but it comes with pitfalls. Squid supports this via a function called SSL Bumping. It has to be enabled when Squid is compiled from source, and none of the packages you find in repositories has it turned on, so you'll have to install Squid from source to do this. SSL Bumping involves decrypting transparently intercepted encrypted traffic to rewrite headers. This is basically a MITM attack. You'll have to install a cert on the proxy that comes from a trusted certificate authority to keep the user's browser from complaining. The last pitfall I encountered was I got halfway done with the install and discovered a known bug in Squid 3.1.x when using SSL Bump with an upstream proxy (cache peer). After decrypting the traffic it will then send it back up to the cache peer unencrypted. This was obviously a deal breaker for me and I gave up. Supposedly this is to be fixed in 3.3. Here is a guide if you're feeling adventurous: SQUID transparent SSL interception | Dvas0004's Blog And info on the SSL bumping with cache peer bug: Using parent proxy with SSL Bump enabled Squid 3.2 | MyDLP | Data Leak Prevention & Protection Solution In the end I settled for setting up Squid transparently with a captive portal page. Whenever someone connects to the guest wifi they get redirected to a terms and conditions page. Once they click the accept button Squid will allow them through. This page also comes with instructions on how to setup the proxy in most browsers so SSL will work. It's not elegant, but it's free and it works. I went with the WPAD route at first, but it is only good for Internet Explorer (using the DHCP option) and Firefox/Chrome (using the DNS option). iOS and Android devices don't work with WPAD.

You need to enable Remote Administration on the firewall (or just disable the firewall altogether) and add their domain user accounts to the BUILTIN\Administrators group on the print server.

Thanks, I just installed this on my Windows 7 workstation and discovered that our website breaks pretty badly when being viewed with it. One more reason that I can use to justify a website overhaul to the brass.

I always appreciated nVidia's product naming scheme; it makes a lot more sense than the market speak Intel has been throwing around and even if you've been out of the market for a while it's relatively easy to know how the products compare just by looking at the model number. The first number signifies GPU series and the last two signify the performance in the series. Anything under 50 is usually considered budget card territory. High end cards of older GPU series (anything in the x80 range) out of date are still usually faster than the newer midline cards. Where the differences really come into play though with the newer cards is the versions of Pixel Shader, OpenGL, and DirectX they support vs the old stuff.