Duke5A

Can someone tell me what I'm doing wrong here? Proxy: Squid3 DNS: Bind9 OS: Ubuntu 10.04 I've got a Squid proxy setup internally and I'm trying to get WPAD working for clients. So far I've got Internet Explorer working no problems since I did it with DHCP. Now I know just about every other browser doesn't support this implementation so it has to be done through DNS. I created an A entry in bind and wpad.mydomain.local resolves correctly at the command line using ping and nslookup. Firefox doesn't work though. I ran a packet sniffer on the client and Firefox is attempting to pull the auto configuration file from http://wpad/wpad.dat instead of using the FQDN http://wpad.mydomain.local/wpad.dat. When trying to browse directly to the WPAD file without the FQDN Firefox tells me it was unable to determine the IP address of wpad, yet I can ping and do an nslookup just fine at the command line. When using the FQDN I can get Firefox to browse to the configuration file without issue. Does anyone have any ideas? This is the last stumbling block of this project I have left... Thanks...

Then I would get it loaded with drivers and everything and take the backup right before joining it to the domain. This way if it does go completely down you only have to restore, join, and promote and a new DC. The prospect of having to do a bare metal restore of a DC always scared me a little. Of course you would have to contend with removing the old DC from AD if this were to happen.

Try adding this right before the lines that map the drives: WScript.Sleep 200 [/Code] It's goofy, but I've seen it where if enough is going on in the background and the drives are mapped too quickly some of them will be ignored. Maybe a timeout or something...

I would setup another DC (if you have the licensing) offsite or on the other side of the building somewhere. Just promote it and make it a GC with no other services on it. Real time backup without having to worry about timestamps on backup sets.

What kind of script, VB or batch?

Two more things to check on the GPO itself under the scope tab: Security Filtering WMI Filtering Make sure both of these are as listed. One more thing to do is run RSOP to see if the policies are actually applying. You're going to have to find a system that is logged in and having the issues and run RSOP against it. From your own workstation open RSOP.MSC, at the top of the tree in the left side right-click and select change query. From there you can type in the machine name and it'll give you the option to run the query as the user who is logged in. Once it completes you'll be able to drill through all the applied user settings.

Policy restrictions work just fine for us. Is a matter of fact, a lot of the workarounds the kids managed to figure out under Windows XP stopped working in 7. Can you post a screen shot of the of the settings tab of your GPO with all the options expanded? RSOP is also a good utility for seeing if the policies are being applied properly on student machines. GPresult as the command line will let you know if they're being filtered as well.

I used to have this exact mindset when XP was the primary OS being deployed. I would turn everything back to classic and make it look as close to Win2k as I could. With Windows 7 I left the entire interface stock with the exception of cleaning up useless icons in the Start Menu and setting the system tray to not hide anything. There wasn't a single complaint regarding the interface in Windows, just Office. The new Start Menu grew on me in short order and now I don't know why I stuck with the classic one for so long; I mean, it's just abysmal to work with. Even the ribbon interface grew on me! Now, as far as Windows 8 goes, well, I don't think I'm that adept to change.

I don't, and it makes me want to cry. I use WDS, but it's all unicast. I can image a lab of thirty machines (100MB to the desktop, 1GB backbone) and it doesn't bog down that bad. The problem is we have dumb switches scattered all over the network so it makes multicasting impossible. When imaging parts of a lab or building I can isolate I'll bring a laptop with 2008R2 loaded onto it with WDS configured and jack it into that local network segment. Not pretty, but it works...

I guess I'll make it two then. When I came into the district I'm in now they had just installed a fully managed Cisco wireless network. It consists of six buildings, 120 access points, three wireless controllers, and an install of WCS to manage it all. The place I came from had no wireless capabilities (except for access points mounted on carts) and I was extremely leery of the entire setup. The more I worked with it the more I was impressed by it. There was only 180 wireless devices in the entire district after it was setup and we're just shy of a thousand now scattered between all the buildings. Teachers have laptops and the majority of student computers are mobile netbook carts with each cart housing 30 devices. Teachers can check a cart out from the library and bring a lab's worth of machines to their classrooms. Is a matter of fact, the only buildings with dedicated, hard-wired labs are the middle and high school. Each elementary has three to four carts of thirty netbooks. It really is awesome...

If you don't want to mess around with switch configs you can give the Connection Server a try. I loaded it on one of our apps servers and it works great. Didn't want to enable multicast forwarding on our wireless teacher VLAN.

I just ran into this today with a Dell Latitude E5530. I install the drivers by hand on a test rig before adding them to the WDS console and I think I know why this fails. The USB3 driver actually has two separate drivers that need to install, but prior to installing the first driver Windows only sees one device missing a driver. After this gets installed is when the second device will show up in Device Manager. So yeah, adding these to the offline image is pretty much the only way to get around this. Absolutely weird....

Try adding some sleep statements to the script so it doesn't get too far ahead of itself. The value is in milliseconds. WScript.Sleep 100 I've seen it where if the machine is processing too many other tasks in the background on logon for some reason it'll simply skip over certain scripted events like drive mappings and printer installations. For printer deletion I've always used this: Set objWMIService = GetObject("winmgmts:\\.\root\cimv2") Set colInstalledPrinters = objWMIService.ExecQuery("Select * from Win32_Printer",,48) On Error Resume Next For Each objPrinter in colInstalledPrinters If InStr(LCase(objPrinter.Name), "SomeStringInThePrinterPath") Then objNetwork.RemovePrinterConnection objPrinter.Name Next If Error <> 0 Then 'Just catch the error, moving on Else 'Nothing to see here folks, move along. End If

My user base had a hard enough time with going from Office 2003 to 2010. I could only imagine the fun Windows 8 would cause. As general rule of thumb I've always lived by is I let the first Service Pack come out before I deploy a new version of Windows in mass to the wild. Go ahead and build your image, let a few of your more experienced staff be guinea pigs, and test, test, test. It's a lot to take in.

I was having issues with this too using WDS. The UUID is stored in the netbootguid property in the machine's computer object. If you were ever curious enough to want to find out what it is you can use this script: strLDAPComp = "LDAP://CN=machinename,OU=example computers,DC=example,DC=com" Set objComp = GetObject(strLDAPComp) Msgbox "AD UUID:" & ConvertObjectGuidToString(objComp.netbootguid) Function ConvertObjectGuidToString(ByVal arrRawObjectGUID) Dim i, strByte Dim arrObjectGUID(15) For i = 1 To LenB(arrRawObjectGUID) strByte = Hex(AscB(MidB(arrRawObjectGUID, i, 1))) If Len(strByte) = 1 Then strByte = "0" & strByte arrObjectGUID(i - 1) = strByte Next ConvertObjectGuidToString = Join(arrObjectGUID, "") End Function To get the UUID from a Windows box (replace the . in the computer name string with a netbios name to get it from a networked Windows box) that is running, you can use this script: 'http://www.tech-archive.net/Archive/Scripting/microsoft.public.scripting.vbscript/2006-07/msg00078.html 'http://araihan.wordpress.com/2010/02/19/how-to-set-computer-naming-policy-in-windows-deployment-services-wds/ 'http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_21909382.html 'On Error Resume Next Const wbemFlagReturnImmediately = &h10 Const wbemFlagForwardOnly = &h20 strComputer = "." Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2") Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_ComputerSystemProduct", "WQL", wbemFlagReturnImmediately + wbemFlagForwardOnly) For Each objItem In colItems Msgbox "UUID: " & objItem.UUID Next I can't take a whole lot of credit for these as they were pieced together from sources around the net. Only the second script had comments in it with sources (it's been a while since I've had to use these). The UUID stored in AD actually has a part of it reversed and that is what the function in the first script fixes to make it human readable.

I haven't had any issues yet, but I'm sure I'll run into it. We've got a fleet of old boards that were basically collecting dust for years until last school year. Does it look like it's just normal usage that causes the white surface to droop? BTW - This is a great thread that will undoubtedly get indexed by Google (if it already hasn't). The information you posted here is going to help a lot of fellow technicians.

It depends on what you're trying to accomplish. If you want a transparent proxy, then yes, two NICs is a requirement. If you're just setting up a proxy for internal student/staff web traffic that will be pushed out through GPO, then one NIC is all you need. Two NICs are really only needed when you're routing traffic between networks.

Thanks for the reply, you got me thinking about replication as we have three domain controllers in our network. I verified the policy is successfully replicated across all three DCs by not only checking the settings in GPMC on each DC, I also checked the modified dates in the policy folder in each DCs sysvol share. Without a doubt it's the same. Next I looked at the student machines and noticed with gpresult that the ones with issues were applying their policies from DC02, while the ones that are working were pulling from DC01. RSOP on each student machine verifies that the correct proxy configuration is present in each machine, regardless of what DC it was pulled from. But I still have yet to find one instance where it is working when it was pulled from DC02, and one instance where it is not working where it was pulled from DC01. It's there, it's just not processing it. So following Google led me to a policy in the computer configuration that may help: Computer Configuration>Administrative Templates>System>Group Policy>Internet Explorer Maintenance policy processing Here you can set IE maintenance policies (which are the only policies that fail to apply) to run over slow links, and force them to process again even if the policy hasn't changed. I just set these options so now I need to see if they helped. Fun times... I'll keep you posted.

Some background: Domain controllers are a mix of 2008 R2 and 2008, clients are Windows 7 Enterprise x32 /w SP1 and IE9. I'm having an incredible issue right now with proxy settings applying intermittently on student workstations. The proxy GPO was set using User Configuration>Windows Settings>Internet Explorer Maintenance>Connection/Proxy Settings. What will happen is out of a cart of 30 or so netbooks, 2/3rds of the students will fail to pull proxy settings. Looking at one of the afflicted machines shows the check box in IE not checked, and the proxy address field blank. If you run RSOP it shows that all the policies have successfully applied without error (no filtering, etc), and if you drill down back through User Configuration>Windows Settings>Internet Explorer Maintenance>Connection/Proxy Settings it's clearly there. IE is simply ignoring it, and with the randomness I don't know what to make of it. Has anyone else come across this issue?

If you're using Cisco equipment give this a look: Multicast in a Campus Network: CGMP and IGMP Snooping - Cisco Systems Every switch in the environment though is going to have to be a managed switch that is IGMP snooping capable. I wanted to setup mutlicasting from our WDS box, but we have far too many dumb mini switches floating around the network.

Short of having a scheduled task run dsmod to unlock an account every so often, I don't see how. 2000/2003 AD doesn't support multiple account/password policies; you can only do that with 2008.

I'm looking at setting up App Locker to reign in the kids, but you're going to need Windows 7 Enterprise on the clients to do it. Windows XP and Vista have SRP (software restriction policies), but these can get messy in a hurry and can be hard to manage.

I'm pretty sure this type of printer connection is a per user connection, so it'll have to run under a logon script. @rpanchal The script looks right. If you take the On Error Resume Next line out does it through up an error code?

Well, I've been playing around with this and it seems to be partially users' fault. Users will open the lid while it's on the docking station so when the internal display comes Windows now sees three monitors in total (DVI external, TV, and the internal to the laptop). Depending what is set as primary at the time will cause different things to happen. Most of the time the internal on laptop gets disabled, and will even stay disabled once it is pulled off the dock. Even the power issues with not being able to wake the machine up while it's on the deck seem to be because of this. The users that follow these instructions don't have any further issues: never open the lid while the laptop is on the dock, never dock it with the lid open, and wait for it to go to sleep (power LED will pulsate) before placing it on the dock.