Duke5A

Just tossing this out there... and are handy utilities too. The first will dump gory details regarding to applied and filtered policies on both the computer and user, while the second will force the client to pull policy changes from the domain.

Ditto... Typically a search for MSI, Flash, and FTP yields the link you need in the first page of results. Definitely fill out the application for distribution though to keep things on the up and up. And as far as pushing it out to clients goes, Flash is probably the easiest MSI deployment I've done, it just works.

Here is another vote for WDS. Being able to point the console at the driver INFs and have it dish them out freshly imaged machines makes my life a lot easier. You need Server 2008 R2 to do this though.

If you can verify that the driver is indeed being pulled down, but not installed, then maybe something with driver signing?

What's the name of that utility? Is it home brew?

If you have your unattended answer file for WDS, and the sysprep.inf file in your XP image to both handle partition and formatting this can happen. If WDS is setup to do this, then remove these lines from your sysprep.inf file in XP: [Data] AutoPartition=1 MsDosInitiated=0 UnattendedInstall=Yes [unattended] ExtendOemPartition=1 FileSystem=ConvertNTFS Repartition=Yes

What version of Success Maker are you running? It's been around for a while and has gone through some big changes. In the previous district I worked at we had a web based version that was hosted internally, and in the current district I'm at we're running an ancient version that requires a client to be installed on the workstations. The old one is what I'm most familiar with as I just had to migrate it from multiple servers back to a single. It uses a SyBase back end, and can be a pain in the neck.

I've been under the assumption that the browser will cache the PAC (at least I remember reading it somewhere). Does IE and FF not do this?

We run Cisco wireless controllers here. Our guest WIFI access was setup as a segregated VLAN using a private class C address scheme. The controllers themselves will do DHCP, but we needed something more configurable so that would could set options in the DHCP scope. I whipped up a CLI install of Ubuntu with DHCP and Apache, and plugged it into the core switch with the port set to the guest WIFI VLAN. The entire point was to have a setup in place that could do automatic proxy detection for guest users since our guest WIFI requires proxy settings.

We're a school district, so all Internet traffic is filtered through a proxy. The thing is all of our teachers have district issued laptops and they're encouraged to take them home at night if they need them for work. Currently, teachers just check off the usage of a proxy in IE when they take it home. I still get questions periodically though when they forget to turn it off, or turn it back on when they bring the laptop back into the district. So I decided to give an automatic proxy configuration script a try, but there are a few issues I need to iron out before making it live. I used a proxy.pac posted by FN-GM on this forum (Thanks!) as a starting point. Looks something like this.... function FindProxyForURL(url, host) { //Declare proxy strings as variables var staffproxy = "PROXY StaffProxy:3128"; // IP not to use proxy if (shExpMatch(url, "*172.*")) { return "DIRECT"; } if (shExpMatch(url, "*10.*")) { return "DIRECT"; } if (shExpMatch(url, "*192.*")) { return "DIRECT"; } if (isPlainHostName(host)) { return "DIRECT"; } // URLS not to use proxy server if (shExpMatch(url, "someurl1.com")) { return "DIRECT"; } if (shExpMatch(url, "someurl2.com")) { return "DIRECT"; } // Apply proxy if machine is on internal network if (isInNet(myIpAddress(), "10.0.0.0", "255.0.0.0")) { return staffproxy; } else return "DIRECT"; The PAC file works, but my hang up is in how it ascertains whether or not it is behind or school's network. The line below is too general to identify our network. if (isInNet(myIpAddress(), "10.0.0.0", "255.0.0.0")) { return staffproxy; } We use a class A private address scheme here in the district, and so does a lot of home networks, bars, and Internet cafes. I suppose I could make it more specific, but I would still run the risk of an outside network matching that line. I've seen examples where you can query DNS to see what network you're on (for instance trying to resolve the hostname of our primary DC), but every time you launch a browser window it tries to perform this DNS query, and will hangup while waiting for the request to timeout if you're on an outside network. The only other option I've been able to think of is comparing the primary DNS suffix the client gets from DHCP to the one that we use in the district. This would be able to be done instantly without a timeout issue, but I don't know how write this in the PAC file, or if it is even possible. Any ideas? Thanks guys....

We use Firefox Community Edition in our district quite extensively. With the ADM templates they provide, every option that you see in About:Config is configurable, and to the point where you can control it on a computer object and user object level. You can even just set these options as default, or lock them down and make them unchangeable. Pushing out new versions is as easy publishing the MSI in AD. The guys over at Front Motion really did a slick job with this. I'd have to argue that their version of FF is even more configurable than IE with the templates.

If the DHCP options are all set then I would think it might be the Windows Firewall on the new server. My old boss moved a WDS installation and couldn't get it to PXE. This turned out to be the cause.

I've seen goofy occurrences like this in AD at work. If the machine shows that it is in the correct OU with the correct policies when running gpresult, then take it off of the domain and rejoin.

Your script doesn't have to run over and over because of Deep Freeze. You can schedule actions in the DF console and have the machines wake up at night and go into maintenance mode for a couple hours. You can then create your scripts and set them up as a start up script in Group Policy, apply it to an OU, and the script will run at night when the machines are thawed. When the maintenance period is over they'll reboot frozen again. After a night or two, you can remove policy from the OU.

So you're not even getting a link light in the PE environment? If so, the NIC is shutdown and the driver that is loaded for it in the existing Windows installation knows how to enable it. The only other thing I can think of is to open the NIC up in device manager and browse through the advanced settings tab, then turn everything off related to power management. I've seen goofy problems with LAN booting and WOL caused by the driver loaded into the existing Windows installs. Most recently I've got a lab of Optiplex 780 machines that run Windows XP. WOL worked beautifully until I reimaged the lab with Windows 7. Even though it was still enabled in the BIOS, they would not wake up. It turns out that the NIC driver included in Windows 7 was lacking some features and somehow disabled it. After installing drivers from Dell's site WOL magically started working again.

To get Win7 to give some verbosity to login events try enabling Verbose vs normal status messages in GPO. It can be found under Computer>Policies>Administrative Templates>System. Also, I found it to be easier to maintain two separate computer policies for Win2k/XP and Vista/7. You don't need to separate machines into different organization units either. You can create WMI filters in AD and apply them to the policies so the 2k/XP policy doesn't get applied to Vista/7 clients and visa versa.

I just migrated scopes from a handful of edge domain controllers back to a single server, but they were both 2003 R2 boxes. I used these commands at the command line to do it... To export the scopes along with the leases: To import the scopes along with the leases: I didn't have to down the DHCP server service during the process either. Don't forget to change IP Helper addresses in core switches where needed too.

Give a look in the BIOS for something called low power mode or something equivalent. Newer Dells have it enabled by default and it shuts the NIC down when the machine is powered off, or asleep. I'm thinking it might be on and the link isn't coming up off post for some reason.

Every machine that leaves the district gets its drive destroyed, even if it a student machine. This way if something confidential ever did get on the outside you've got yourself covered from that angle when questions are asked. Two holes drilled through desktop drives, and a big blunt object for 2.5" drives.

Different methodology I guess... I update my images on monthly cycles, and if there is an updated Flash/Java/whatever I just let AD push it out to existing clients. In older versions of Flash and Shockwave it was a pain in the neck to get to the auto update features and customer participation turned off. That's primarily why I built them into the image so I could clean up after the installs. Flash now has a control panel plugin (finally), Java is deploy-able with transform files that I use to keep all the crap turned off, etc.. I'll have to look into stripping those out of the image.

If I had to guess, the client is trying to talk directly to the printer and it is failing. If it were a Laserjet using Microsoft drivers then it probably wouldn't need a direct path of communication to the printer, but with the advanced printing features built into the driver the client needs direct access. We had some similar problems with Toshiba copiers, and a couple Canon Image Runners that were on different subnets than the clients. Traffic was blocked from traversing the subnets, but the print server that sat in a server VLAN could freely communicate with both. We were getting error messages that basically said the same thing. Try directly adding the printer on the client and see what happens.

We use Symantec End Point 11 on our clients, and have it centrally managed. It's extremely easy to deploy, effortlessly installs over top of Symantec Corporate 10.x, and is pretty easy to administer through the console. The problem though is it doesn't do a very good job of doing what it was designed to do. I have about three staff members a week with some flavor of fake AV software pop up. Most of time the machine will be blatantly infected and Symantec is completely oblivious to it with nothing showing in the logs. AV defs will be up to date too.... ug....

Are you serious? You would have Group Policy Management, Active Directory Users and Computers, Sites and Services, and their ilk installed on a base image? Even having users appropriately locked down, that still sounds like a bad idea to me. If you're making a base image, it should contain software common to the entire user base you're looking to deploy the image to. If you start adding software to it that only a select few will use you're bloating your image up. Trust me, keep it lean and universal. For software that isn't universally used I package up into MSI files and push it out through AD. For a 1500 user base I maintain four images - a Windows 2k base image, an XP, Win7 x32, and Win7 x64. By this time next year I'll probably only be maintaining Win7 64 and XP for a handful of legacy machines. Software I'd recommend to include: Adobe Flash Adobe Shockwave Adobe Air Java VLC CutePDF (or any other open source PDF printer) MS Office MS Silver Light Front Motion Firefox (GPO controlled Firefox) 7-Zip file archiver Quicktime Infra Recorder (open source CD/DVD burning software) Anti-Virus Lots of the above software comes with bundled auto update utilities. Since I use the same image for students and staff I disable these features and anything that might nag the user. Java, Adobe players, and FM Firefox updates are extremely easy to push out over AD. It's also a good idea to keep a text file somewhere in image that you can use as a change log to keep track of changes you've made to the image. It'll give you an idea of how old an image is in the wild. Good luck!

FN-GM replied in post number 4 that it was the desktop icon he was looking to remove, or at least that is how I read it.