Duke5A

You're going to have a barrel of fun with this one. I eventually settled for making Squid work as a captive portal and redirecting people to a locally hosted page with directions for setting their browser to use it as a proxy instead of relying on transparent.

Does your Smoothwall require authentication to get out? iTunes is pretty dumb in this regard and won't forward credentials to the proxy after receiving a challenge. I use Squid, but I've never touched a Smoothwall box. What you need to do is add these domains to an ACL that doesn't require authentication to get through: .apple.com .mzstatic.com

Inspect your proxy logs for all outgoing connections from a client with Prezi loaded in the browser the moment the page refreshes. I've had sites pull content from servers by using an IP address instead of a domain name and our upstream proxy is setup to block browsing by IP. Placing that single IP on a white list usually fixes that. Another issue I've seen is pretty much the same scenario, but the IP address keeps changing as the external content was hosted on a cloud service. I hope this helps...

Check settings in the Java control panel applet. I've seen issues where Java doesn't pick up system proxy settings correctly, and even had another issue where the temporary cache settings were set too low and causing an applet to crash all the time.

Wound up calling their support line, and the answer is a big fat no.

I used to support Firefox as part of our base image a while back, but eventually removed it due to it being a PITA as to manage. With every update it was getting harder and harder to turn off nag messages and the import utility. Students don't have persistent profiles so this stuff would pop up every time they logged in. I gave Chrome a try last year and got disgusted with the tweaks I had to make just trying to get the MSI to deploy through AD. It was a while ago, but I do remember that the installer was trying to call home back to Google, but couldn't get out since all traffic needs to go through authenticating proxy filters before being let out. As a result, the machines were stuck on the deploying managed software message. It wouldn't even time out and eventually continue, they were just stuck. I found a tweak on some webpage I had to make to the package to get it to work and eventually it did push out alright. It's just crap like this that turns me off from supporting alternative web browsers. We're a Windows 7 Enterprise district now and IE9 is all that we support. Teachers have local admin on their machines and can install whatever they like, but the base image and student computers only get IE9. It works, I rarely see websites break on it, and GPO just works.

We're running it too. While we're on a slightly older version (7.9), it runs great.

As principal BYOD devices, or any device you don't administrate shouldn't even be allowed to touch your internal network. That being said, I just went through this while back setting up a guest wireless network for our district. Redirecting HTTP isn't a big deal, but you'll break HTTPS in the process. In a nutshell I setup a box with two NICs, Squid in transparent mode, and IPTABLES to redirect all HTTP traffic on the local interface to Squid; really just a standard transparent proxy setup. HTTPS is still broke at this point though since you can't redirect it without performing what basically constitutes a MITM attack. So I had to somehow get the user to set proxy settings on their end. To get them to do this I setup Squid as a captive portal. When the user would connect to the guest network they would immediately get redirected to a terms of service page hosted on the proxy. At the bottom of the page is an acceptance button that serves two purposes: first, Squid will continue to redirect to the TOS page until it is clicked, second, once clicked it'll take you to a page with directions for setting up most popular browsers and devices for auto proxy configuration. If the user follows the directions, HTTPS works no problem. To finish off the auto proxy setup, I had to write a wpad.dat file and setup both DHCP and DNS to point to it (Internet Explorer can usd DHCP to find it, and Firefox/Safari/Chrome will use DNS). The exceptions to forwarding are defined in the wpad.dat file. It was a huge PITA to get working, but once I got it tweaked it works remarkably well for all major browsers, and iOS devices. I'm still playing around with Android though....

Give this a try: Repair Internet Explorer with Fix IE Utility I had similar symptoms with a friends computer and this fixed it. I would also dump Norton 360 (if the uninstaller doesn't work, then you can download one of their removal utilities) and install Microsoft Security Essentials.

That's great that you got it working; now comes the fun part of tweaking it! As far as version 3.0 is concerned, it is Squid's default behavior to pass on the internal client's address onto the cache peer (upstream proxy) unless it is explicitly disabled. Does your LEA give you one proxy only and traffic filtered differently based on originating address? Wait a sec, you're running Dans Guardian right? If so, Dan's gets the request first, passes it to Squid, and Squid in turn passes it to the LEA proxy. Unless Dan's is also setup for x-forwarding then the LEA is only seeing the IP address of your proxy as the origination for the request. Try dropping these lines in your Dans config file. forwardedfor = on usexforwardedfor = on You may have to read up on it a bit more since I don't use DG, but if you are this is most likely the cause of your x-forwarding issue.

It's the stand alone version. I'm fairly certain the content that it was trying to pull was from the help section. It was connections outgoing to Amazon's cloud service AmazonAWS. Anyways, the logs returned to a normal size once I added the amazonaws.com and autodesk.com domains to an ACL that allows connections through Squid to bypass authentication.

Does anyone know if the stand model FS570 is compatible with any of the newer boards? My staff mounted the boards in classrooms and now I'm stuck with having to store these in my office. I was hoping to be able to send these back out to a building if I could convince them to buy a board to mount to it. I tried looking around good, but didn't find anything. These stand are pretty old, circa 2005. They're listed as being compatible with 500 and 700 series boards, and those aren't even sold anymore. Thanks guys...

We installed about 20 short through interactive projectors by Optoma. The pens, even after firmware updates and a new version of the pen, while immensely better than the first go around, are no match for an interactive board. Aside from the weight and batteries associated with the pens, accuracy is a big issue and you need a very steady hand to use it. You can forget about trying to write legibly too. If this wasn't an issue enough, the reflective surface of the whiteboard messes with the pen and will send the cursor flying off the screen at random. The technology is a good idea in theory, but not very practical in practice. Get a board of some flavor.

I think you might be out of luck as far as using the built-in backup solution. Maybe try robocopy? I was messing around with Power Shell and wrote a script that would create a folder with the current date and copy data to it using robocopy. You can run it as a scheduled task and it'll even keep an eye on drive space. The $dstDelThreshold variable at the top tells it how many copies to keep. It's not the cleanest, but it was my first stab at PS scripting. $srcPath = "\\server01\share" $dstPath = "\\server02\share" $dstDelThreshold = "2" $Date = Get-Date -Format yyyy-MM-dd-HH-mm $srcStats = Get-ChildItem -R -Force $srcPath | Measure-Object -property length -sum $srcSize = "{0:N2}" -f ($srcStats.sum / 1MB) + " MB" $srcCount = $srcStats.Count "Backup job started on: $Date" | Out-File $dstPath\$Date.log $dstPathSplit = $dstPath.Split("\") $Server = $dstPathSplit.Get(2) $ShareName = $dstPathSplit.Get(3) $Share = [WMI]"\\$Server\root\cimv2:Win32_Share.Name='$ShareName'" $DriveLetter = $Share.Path -Replace '\\.*$' $Volume = [WMI]"\\$Server\root\cimv2:Win32_LogicalDisk.DeviceID='$DriveLetter'" $dstFreeSpace = "{0:N2}" -f ($Volume.Freespace / 1MB) + " MB" "Job size: $srcSize" | Out-File $dstPath\$Date.log -append "Destination free space: $dstFreeSpace" | Out-File $dstPath\$Date.log -append $dstBackups = Get-ChildItem $dstPath | where {$_.Attributes -eq 'Directory'} | Sort-Object Name If ($dstBackups.Count -gt $dstDelThreshold){Remove-Item $dstBackups[0].FullName -Force -R} If($Volume.Freespace -gt $srcStats.sum){write-host "I'll Fit" $Start = Get-Date -Format yyyy-MM-dd-HH:mm "Copy started: $Start" | Out-File $dstPath\$Date.log -append New-Item -Path $dstPath -Name "$Date" -type directory RoboCopy $srcPath $dstPath\$Date /MIR /LOG:"$dstPath\$Date - Robocopy.log" $End = Get-Date -Format yyyy-MM-dd-HH:mm "Copy ended: $End" | Out-File $dstPath\$Date.log -append } ElseIf($Volume.Freespace -lt $srcStats.sum){write-host "nope" "Copy aborted. Not enough free space." | Out-File $dstPath\$Date.log -append }

We're running into this problem too. All of our laptops have 16:9 displays, but a lot of the older projectors don't support this aspect ratio; TVs are even worse in this regard (yes, I still have people using S-video and tubes ). My user base wants to use clone mode as well all the time. I'm trying to get them used to extended desktop mode so both screens can have resolutions independent of each other. It's not going over so well though; people don't seem to mind a display outside of its native resolution and looking like poo.

Looks like that did the trick. Log files are back to a normal size after a full day of using the Autodesk software. It still blows me away that they push off all this content from the local install to web based, and the dev team doesn't have enough foresight to think that organizations that use their software would be doing it from behind a proxy. Unbelievable....

How To: Enable AirPrint on Windows (32/64Bit) with iOS 5+ Support - MacRumors Forums Check out the bit at the bottom of the first post in this thread. I actually had this working at some point in time or another. The problem with putting it on the print server meant it had to have a NIC in each of the wireless subnets. That was as far as I got with it in the beginning of the year. There does seem to be a workaround involving DNS though to the whole Bonjour across subnets deal.

That's pretty much it. If you're just looking to do something simple like add a couple printers to everyone that runs the script it's only a couple lines of code. Once you play around with it enough you can start getting into conditions and map printers based off of WMI queries, user group membership, computer and user object location in AD, etc...

This is an informational post for others to pickup once Google indexes it and will serve as place for me to vent... Autodesk releases crap... I've said it... Their AutoCad suite is bloated beyond recognition and it is more of a PITA to install every year. But how does this apply to Internet Related/Filtering/Firewall do you ask? Well, our students go through an internal Squid proxy for traffic logging before hitting the outside content filters. This proxy uses NTLM and by now enterprise level software should know what the hell this is. I come into work this morning to find the student proxy not passing traffic anymore and upon further inspection the volume I have setup to hold logs (30GB mind you) is freaking full. After purging some older logs and getting it working again I began to investigate. netstat -nat This lists all current IP connections to every interface and there was 40,000 of them for a district with 1/10th the amount of students. And only a third of the student body is computers at any given time. So I dumped the entire output to a file in the home directory. netstat -nat > ~/connections.txt Once I fetched and opened it in Excel I was able to sort it out. I was finding machines with thousands of idle connections, all coming from the CAD lab. tcp6 0 0 10.1.xxx.xxx:3128 10.1.xxx.xxx:63325 TIME_WAIT Now I could parse the Squid access log; which was already bloated out to 2GB by mid morning (this typically doesn't exceed 300MB for an entire day). less /var/log/squid3/access.log | grep 10.1.xxx.xxx > ~/moreconnections.txt Upon opening this 230MB txt file up in Excel and sorting by outgoing connection I find 2,000 GETS to here: 10.1.xxx.xxx TCP_DENIED/407 5100 GET http://autodesk-exchange-apps-v-1-5-staging.s3.amazonaws.com/data/content/fil Whatever AutoDesk app is running it's trying to get out to the web, getting hit with a challenge response for credentials, ignoring the challenge, and requesting the resource over, and over, and over again; thus filling the logs to oblivion with junk. I'm going to try white listing the domain so connections to it don't have to provide credentials and see if that will calm it down. I'm so sick of this....

You just saved a good number of people from one big headache. I've got a couple Squid proxies that we use with NTLM for logging. I haven't had time to experiment with it, but I wonder if dropping NTLM for Kerberos would work well.

I tried this move once and wound up crawling back to VB script on my hands and knees asking for forgiveness. I posted an example of the printer deployment sub we use to my blog. VB Script for network printer deployment - Blogs - EduGeek.net I don't know how it would behave in a mixed environment though, deploying printers using both VB and GPP. Good luck!

Only thing you have to watch out for when splitting a DHCP scope between two servers is to make sure the subnet has twice as many addresses available as the total number of clients in it. If one of your domain controllers does stop functioning you could run out of addresses in the scope on the backup. Make sure the new DC is a global catalog server too so it can process login requests.

Squid can do just what you need for free. I'm in a six site school district with 4,000 students and all their traffic goes through a single proxy sitting in a VM setup with two virtual processors and 1GB of RAM. You would be surprised at how little the hardware requirements are for proxy servers.

No such thing as free Ghost and I'm pretty sure asking for such would get you walking papers. If you do end up using Ghost though, you'll need version 11 at the least and you could use ghost32 with the -fro switch to ignore bad blocks.

I figured it out, or well, at least I applied a band-aid by adding wpad to the hosts file on the proxy server. This entire setup is for a guest wireless network and Squid is running in transparent mode so it'll grab outgoing HTTP requests and redirect to a TOS page that you have to agree to before Squid will let you out. Well, HTTPS doesn't work so well through a transparent proxy so this is where the WPAD setup comes into play. On the TOS page are directions for setting up browsers for auto proxy configuration. Once done, they'll pick up the Squid proxy and connect directly to it instead of having to rely on the transparent setup, thus making HTTPS happy. This whole setup feels like a Rube Goldberg machine, but it actually works really well.