Duke5A

I'm good in that regard. Just noting some goofy behavior from msiexec. One last question though, when you push this out do you just set the batch file as a start up script in GPO?

I wasn't even aware there was a problem with Photo Story 3 in Win7. Since the first revision of my base image I've had it installed and working. Windows 7 Professional x64 and PS3 3.0.1115.0.

Use gpresult at the command line to get a list of all policies the machine sees. Use rsop.msc to view errors in policy application and to determine what settings are being applied.

Awesome! I made the appropriate changes to the batch file and it uninstalled the previous Java version and dropped in the new one. Only thing to watch for is if you're running it for the first time msiexec won't create the Software-Deployment-Logs directory. If the folder that you want the log to show up in is not there, msiexec will simply quit without so much as even an explanation why in the event log. @FN-GM You rock. I can only imagine how much time it took to write and debug that script. Thanks again...

One more idea.... The lab that in question, do the machines use a block of addresses that are easily segregated from the rest of the site? You could create an ACL at your firewall that will only allow all outbound traffic from the addresses that the lab is using to go to the LEA's OWA server. I really can't think of a way a student would be able to bypass that without changing their address our bouncing off of another machine inside your LAN. Good luck!

Ditto on task scheduler. I've been looking for a replacement for Firefox for various reasons and decided to give Chrome a try in a lab that does web development courses. It installed the update manager (no way to turn this off in install) that is comprised of two services being listed in Services under Computer Management, and two scheduled tasks to activate the services. One task fires at every logon, and the other fires every hour. In the scheduled task description it states that those tasks will be removed when the Google product is uninstalled... it lies. I uninstalled the only Google product (Chrome) on my test system and the services and scheduled tasks persisted even after a reboot. The updater is even still present in Program Files. You can try using Google's GPO templates to control the behavior of the updater, or better yet, remove the scheduled tasks altogether. Needless to say after this, Google anything won't be making its way into my base image anytime soon.

This was probably the biggest advantage from setting up our own internal proxy in that it allows us to control outgoing traffic with ease (logging by AD name is also nice). A couple of lines worth of config in Squid and we've got filtering based on AD group membership. The same could also be done with ISA if Windows is your choice. Kids are crafty though. In our district they're limited users and we've got them locked down as far as we can before the computers would be rendered useless in terms of usability. They come in with portable versions of Firefox on USB sticks, use anonymous proxy websites that our content filter seems to miss, and I've even seen software that the students can run on the local machine that doesn't require admin privileges that will bypass system proxy settings in IE. When it came time for online ACT testing we had to ensure the kids could use the PC, but have no access to the Net. If even one student slipped through, the entire room's test scores would be invalidated and the testing board would come down on us. So we logged the machines in the night before to cache the account credentials and that morning I pulled power from the IDF. Good luck!

You sir, have a PM. Thanks again.

Can you point me in the direction of said script? Your absolutely right, I jumped the gun on Java 7. I waited until 7u2 was out but I should have waited longer. Oracle doesn't even have it up on Java.com yet, but I never went there for updated versions as they all come with whatever flavor of month toolbar they have. The downloads on Java SE Downloads don't have that junk. I guess I never saw the notice because of this.

Ohh Java, how I loathe thee.... With every Java update comes sleepless nights and therapy sessions. Alright, Java 7u3 is out now and I need to push it down to staff machines to plug the giant gaping security holes it leaves. I've followed Oracle's little how-to that can be found here and have had success. The problem is, Java will uninstall any previous version that is in the same major revision number. So if I deploy Java 6u31 and a machine already has 6u17 it'll remove it, but if I push 7u3 and there is a previous install of 6u30 it'll leave it. This is what I've observed, and it makes sense to remove older versions, but most of the time when it's pushed through Active Directory the uninstall goes up in smoke and leaves a broken install on the machine. This has happened countless times to me deploying both versions 6 and 7. Oddly enough, the push of 7u2 went without a hitch because almost everyone was running 6u30 on their machines, so Java didn't make an attempt to uninstall the previous version this time around. Now I'm back to deploying 7u3 and I'm worried it's going to break again. Has anyone else successfully pushed an MSI of Java through AD and lived to tell about it? I'm looking to get your observations on how successes and failures have played out. Thanks guys!

Squid works great, and it's free. I setup an internal Squid proxy last school year that authenticates against AD and records traffic usage by account name. Another free piece of software called SARG parses the logs every night into an easy to read webpage.

Just about every time I see this happen it is because of a junk add-on that has its hooks in IE. Tool bars, coupon printers, shopping thingies, you name it. Uninstalling the crap typically fixes it.

Yes I do see it. It works exactly as you described it should when I refresh the page by hand. When it happened to me though it was the 60 minute timeout. I'll leave a tab open on an advanced reply page and see what it does after an hour. Thanks for your help!

Yeah I did. All it showed was the original quoted text from the post I was replying to. I wasn't using the quick reply box though, I was on the advanced reply page. I'm using Firefox 10.0.2.

Sure, no problem! Getting Squid setup as a transparent proxy and tweaking iptables to foward all HTTP traffic to Squid on port 3128 was relatively easy with the help of a couple guides. What took me three days to figure out how to do was setup the session helper in Squid to keep track of both user sessions, and who accepted the terms and conditions. Here's a snippet of my Squid configuration file detailing how to do this. external_acl_type session concurrency=100 ttl=3 %SRC /usr/lib/squid3/ext_session_acl -a -T 10800 -b /etc/squid3/session/ acl session_login external session LOGIN external_acl_type session_active_def concurrency=100 ttl=3 %SRC /usr/lib/squid3/ext_session_acl -a -T 10800 -b /etc/squid3/session/ acl session_is_active external session_active_def acl clicked_login_url urlpath_regex -i SplashAccepted.html acl Bypass_Cache_Peer dstdomain .guestwifi.local acl splash dstdomain .guestwifi.local deny_info http://service.guestwifi.local/SplashRules.html session_is_active http_access allow clicked_login_url session_login http_access allow splash http_access deny !session_is_active cache_peer upstreamproxyaddressgoeshere parent 8080 0 no-query proxy-only always_direct allow Bypass_Cache_Peer never_direct allow all The gist of this configuration is Squid uses an external helper ext_session_acl to keep track of currently connected sessions. When a client initially connects to Squid a session is created and entered into a DB using the IP address to identify it. Squid checks to see if the session has been marked active and will only allow HTTP traffic to pass once it has been. If not, you’re simply redirected to the acceptance page SplashRules.html over and over again. The way to get your session marked active is to click the acceptance link at the bottom of the page linking to SplashAccepted.html. Once Squid sees you’ve browsed to a URL containing that string it instructs the helper to mark the session active. The last three lines of configuration forward all HTTP traffic up to the content filter at our ISP. For HTTPS, there are directions on the SplashAccepted.html page detailing how to add the proxy settings to popular browsers. I also setup WPAD for auto proxy configuration. Even if users don’t go through the added steps, they’ll still get filtered HTTP. HTTPS seems to be working for iOS and Android if the users follow the directions. What tripped me up for three days was the helper wasn’t behaving like it should as detailed in the documentation. It turns out that there is a bug that prevents it from accurately keeping track of sessions when used in active mode. From what little I found on the issue, you need version 1.2 of the helper to get around this. The fixed version is included in Squid 3.2, but the latest version available in the Ubuntu repositories is 3.0. It was recommended that I start with a clean install and compile the latest Squid from scratch. I wasn’t totally enthused to set Bind, DHCPD, Squid, Apache, and a host of other services back up, so I compiled Squid 3.2 on a new clean install and simply copied the new version of the helper over. It worked without any hitches. I hope this helps. If you need anything else, or snippets from my iptables rules or such, don’t hesitate to ask.

I just finished typing a rather lengthy reply with configuration snippets to a Squid proxy configuration file and the page auto refreshed on me. I lost the entire post.... Is it at all possible to turn this very annoying feature off?

I just went through this with our guest wireless. We also have content filtering that is done by our ISP and is required by law to be used on the network. As you already know, you can't transparently proxy HTTPS without actually doing MITM, and even if you could get it working, I don't know if it would be legal. So I settled for a couple of compromises and set it up the best I can. I setup a Squid 3.2 proxy server running on Ubuntu 10.04 LTS acting as a transparent proxy for HTTP, and let HTTPS route through it without being redirected to Squid. When first connecting using HTTP, Squid will redirect to a captive portal splash screen with the terms of usage for the network with an accept button at the bottom of the page. When accept is clicked it will take you to a page with directions on setting the browser up for a proxy so that HTTPS will work properly. If accept is not clicked, it'll simply keep redirecting you back to the TOS page. Finally, to keep people from being able to get out with HTTPS and bypass the acceptance page, I blocked all outgoing traffic from the guest VLAN on the firewall except for that destined to go to the offsite proxy at our ISP. I did set the ISP's content filter as a cache peer in Squid, so even if the guest doesn't set proxy settings HTTP will still go out and up to the content filter. This at least gets some degree of web surfing to mobile devices. Bind was also setup on the Squid box so browsers that support WPAD would work with a single check box. I hope this helps and I can provide examples from my configuration files if you want.

Thanks for the information guys. This is going to make things easier when presenting a solution to my boss. I appreciate it!

I maintain both a x32 and x64 image of Windows 7, but only x64 is deployed. I've got about 200 or so workstations out of 1500 running Win7x64 and the rest are either XP or 2k. We haven't had any issues with software incompatibility on x64 yet so we're pressing on with it.

We had nothing but issues with ISA when trying to use it as an internal proxy. Like you, our actual content filtering is handled outside the internal network. The only reason for having an internal proxy for us is to log traffic by AD name. The issue we had was ISA was dropping connections when forwarding to the offsite content filter. I spun up a Squid 3.x proxy running on Ubuntu 10.04 in our VCenter cluster and got it working with both basic and NTLM authentication. It handles student traffic with no problems (about 30GB a day) and parses the logs every night with SARG churning them into an easy to read web page principals can access. Firefox and IE both function with NTLM just fine on domain computers, and non domain machines, including iOS and Android will prompt for AD credentials when trying browse the web.

That is pretty slick. How is it as far as bandwidth usage? We have six sites in my district, each with their own video distribution racks. There is probably a dozen or so channels that they all have in common, along with four or five private internal broadcast channels. I'm wondering how hard this would be over a 1GB/s uplink between buildings.

We're running CS5 and even Autocad with the on board Intel graphics on Optiplex 780 and 790 machines. It works great, but we did have a problem that I didn't realize. Windows 7 ships with Microsoft drivers that work, but will cause the machine to go unstable and randomly reset when using hardware acceleration. The biggest issue we had with it was the machine crashing when using Powerpoint 2010. The new version of Powerpoint uses acceleration to animate the transitions between slides. Installing the real Intel driver cured the problems.

I've had a few problems with Dell systems and WOL. A couple of things to check: 1) In this BIOS, look for an option called low power mode (called different things in various models). This is enabled by default on some models and will power the NIC down when the system shuts down and will ignore WOL, even if enabled, as a result. 2) I imaged a lab full of Optiplex 780s that were functioning fine with WOL and Windows XP. I imaged Windows 7 onto them and WOL broke. It turns out that the included driver in Windows 7 (which was a Microsoft driver) is what was tripping it up. Installing the real Intel driver cleared up the issue with no other configuration changes. I hope this helps.

HA requires common storage that every host in the cluster can see, whether it be a SAN or any other device that does iSCSI. If you're going to have both your domain controllers in the cluster, then run one on each host. All that HA does is startup a VM on another host if the host on which it was running on originally goes down. So you would be without a DC for the time it takes to cold boot the VM if you run them both on the same host and a failure occurs. Ideally though, you want to keep one DC physical and in another location.

Firefox Community Edition is a quasi fork that makes use of GPO templates. You can get it here: FrontMotion Firefox Community Edition I've been using it in my district for three years now and with the GPO templates you can control every single option in Firefox's about:config page. It's on orders of magnitude more configurable than IE. FirefoxCE is typically only a couple days behind the official release schedule in updating. The MSI packages make pushing out extremely easy too.