Duke5A

Here is another vote for NetOp. We use both NetOp and SynchronEyes, and NetOp wins by a small margin. Where SynchronEyes fails is it doesn't run as a service, only as a user level process. So you can't administrate the machines unless they're logged in.

Squid proxy setup for NTLM authentication to log traffic by user name, and SARG for parsing the traffic logs/formatting it into a nice to navigate web page. Both are in the Ubuntu repositories. I'm running this setup currently for student and staff traffic logging. If you don't have a basic knowledge of a Linux command line though, this might not be for you.

@Glenda: Any new developments? We haven't had any recurrences since my last post, but I'm still wondering what the underlying problem is.

I don't know how far you would want to take this, but I have a single Windows XP Pro image I made for about a dozen or so different hardware specs, it makes life a fair amount easier. In a nutshell, I created the image on a dual processor reference machine, added driver support to it for the other models into the sysprep.inf file, added sata drivers to the mass storage section, sysprep'd it, and captured it. There is a couple of pitfalls to watch out for when initially setting up the sysprep inf, but once it is set, it's set.

Early last week I had a complaint from the high school stating that the problem had cropped back up (what was odd is that the frequency of occurrences went way down). So, I tried out my last idea and it seems to have held through four full school days. I left the NTLM bypass tweak in place (knew I would be adding sites to the list for other various problems), and added another to bypass the upstream proxy for those two domains. Config looks something like this.... The "bypassauth-sites.squid" and "bypasscache_peer-sites.squid" files contain... I've been constantly calling the media paras at each build asking they had seen this issue repeat itself since I implemented this last change and all have said they haven't. I'm not declaring victory or anything, but this band-aid seems to be holding. Good luck and keep us posted.

We're running the same deal with six buildings, and an AP in every other classroom. Totals out to something like 120 access points across three Cisco wireless control switches, which in turn are managed by a single Cisco Wireless Control Server. We had issues at first, but now it is working great with netbook carts rolling through the schools with 30 units per cart, and every teacher has a laptop. It's not uncommon for a single AP to get loaded up with 30 associated clients. Streaming video on an entire cart works great. The WAPS themselves are Cisco 1130s B/G, with 100Mb up-links. The key tweak to get it all working was to disable the 1Mb, and 2Mb data rates on the B/G radio. You'll be surprised how much of a difference that makes.

What are you using for the SCSI controller in the VM? The Windows 7 boot WIM plays nice with the LSI Logic Parallel controller. Change it to that to capture, then change it back before booting the VM up again.

Jostens - School Yearbooks, Class Rings, Photo Books & Graduation Gifts Our MS uses this site for their yearbook creation. Teacher and students seem to like it.

Yeah, sure did, just had to ask Google, go figure. Create an ACL line in your Squid configuration file that looks like this... Then place an access rule right before the one that requires NTLM authentication that reads like this... Now add whatever sites to "/etc/squid/bypassauth-sites.squid" you want that can bypass domain authentication. Test it by logging onto a domain computer locally (or a computer not on the domain), set your proxy up in Internet Explorer, and try browsing the web. You should get asked for credentials with the exception of the ones specified in bypassauth-sites.squid.

Using a VM to create and maintain Windows base images has got to be the absolute best way to do it. Quite simply because it gives you a reference machine to do it on where the hardware spec never changes, and you can use save states. This is how I maintain my images. In a nutshell, after I'm done updating my image, I'll create a snapshot, then sysprep it, capture it with WDS, and finally revert to the snapshot taken just prior to sysprep. Images should be kept vanilla as possible. Don't install VMWare tools itself, just install the device drivers.

Yeah, exact same setup as Glennda (un-authenticated upstream, and authenticated proxy in-house). Our upstream proxy is provided by the County, and I believe they use Smart Filter by Mcafee. It's still smooth sailing since I created that ACL to bypass domain authentication, and added the office site.

I use WDS for capture and deployment, and I build/maintain the images in virtual machines on an ESXi host. I've got two images in total for about seven different models. One image is WinXP, and the other is Win7. WinXP can be made to deploy quite nicely with WDS operating in native mode.

I'm pretty sure my ACL to allow office.microsoft.com to bypass AD authorization fix worked. After a full day of the redirect problem not showing up, I changed the proxy GPO and funneled the rest of the student body through the Squid box for today, and still no issues even with a two-fold increase in web traffic through Squid. This is just a band-aid though, there is still an underlying problem. Glennda, if you decide to go ahead and give it a try, let me know what the outcome is. Thanks everyone.

Whoops... http://www.edugeek.net/forums/internet-related-filtering-firewall/62642-squid-dansguardian-redirecting-office-download-page.html#post573964 That's what happens when you've got 25 or so tabs open in a single window.

And the plot thickens.... There is another post I'm involved in on here dealing with this issue. http://www.edugeek.net/private.php?do=showpm&pmid=108013 I work IT for a public school district, and we have a similar setup. Squid /w DG setup to authenticate to the Active Directory, that utilizes an upstream proxy (also state mandated). We run Office 2003 on every district computer here, and there shouldn't be any Office 2007 systems that pass through this proxy. It was only setup for students. I've performed testing on a couple of different flavor operating systems, including Ubuntu using wget at the command line, and the problem is still present. Whatever is causing this, it is definitely the proxy.

Tom, if you're referring to "cache_peer-proxygoeshere," then this isn't a problem. I removed the actual cache_peer address in the log intentionally. I just finished making some quick edits to the squid.conf. This is basically how it looks... The bypassauth-sites.squid text file contains .microsoft and .msecnd.net. I then logged on locally to a domain computer and tried to browse the net through the proxy. I got hit up for credentials on every site I tried to visit save for the exceptions I defined in that ACL. So it's working as intended. Now I'll let users have at it for the next couple of days and see if the problem persists.

That is interesting... When I setup Squid here I did everything all at once, so I couldn't say if it was authentication, the upstream proxy, or a combination of the two. I'll try creating an ACL in Squid to let office.microsoft.com requests bypass proxy authentication.

I'm having the exact same issue here. I setup Squid with Dan's Guardian on Ubuntu 9.04 running in a VM on ESXi so we could log student traffic. Both Dan's Guardian and Squid were installed through apt-get and not compiled from source. For the most part it works beautifully, and I have SARG setup to parse the Squid logs to make it easy for principals to check where there students have been going. It's just that every once and a while, when going through this proxy, you'll get bounced to office.microsoft.com. It doesn't matter what site you're pulling up either, but it ALWAYS redirects to the MS Office site. It seems to be very sporadic. Squid is setup to authenticate to the AD, and log traffic using the student's AD account name. The cache_dir in the squid.conf is pointing to /dev/null, effectively disabling the caching function of Squid. Now I do have a cache_peer setup in the squid.conf, since we get filtering through our ISP. I've isolated where the redirect actually takes place in the access.log file, here it is... The initial request shows up with a TCP_MISS, which is to be expected since caching has been disabled, but a 301 code is tossed, signaling a permanent move. The very next log entry for any user after this code is always office.microsoft.com. This is driving me nuts. Did you have any luck figuring this out?

I've never encountered this in the wild, but check this out... A program on your computer has corrupted your default search If this works for you, it's easy to make a custom GPO template to implement this fix for everyone via Active Directory.

Here is the deal... I setup a Squid/Dansguardian box running Ubuntu 9.10 a couple weeks ago for Internet access logging. It works great, authenticates against a 2003 Windows Server domain, and logs traffic with AD user names. The issue is third party apps on the client machines that don't support NTLM, or basic authentication against a proxy. Since they don't pass credentials to the proxy, they can't get out. One of these apps is Google Earth, well, not all of it. When a user clicks on a landmark to view pictures, nothing comes up. If I change IE to another proxy that doesn't require authentication, it works beautifully. I guess what I'm asking is, how do configure squid to bypass authentication for a particular domain? Thanks guys...

Sorry for the delay. From the sounds of it, you work educational IT, well, same here. It's been incredibly busy for the last week and a half. Windows is only going to pick up storage drivers if they're placed in the mass storage section at the bottom of the sysprep inf. My setup looks something like this.... The reason for the multiple directories, SATA01 and SATA02, is because the latest offerings of Intel SATA drivers don't typically include support for the older SATA controllers. Good luck.

Nope, VMWare tools is not installed on the base image VM. If I need drivers for a piece of VM hardware, I'll pull them out of the VMWare Tools installer and install them by hand. The idea is to keep the base image as neutral as possible since it was built to cover a broad range of machines. How I handle drivers is I create a directory in the root called "drivers" and create folders inside it by computer model. Once the drivers are placed inside of there, sysprep is pointed to their location. I use the snapshots feature of the VM to revert back to a pre-sysprep'd state. Once I get done updating the image, I'll take a snapshot, sysprep it, capture it, and then revert back to the snapshot. As far as my base image is concerned, it has been updated over 20 times and has never had sysprep ran on it. Have fun!

One more thing... Add the script into your unattended.xml under the oobeSystem pass. I ran it synchronously so other script I had would run without waiting for this one to end. Good luck!

I just jumped onto the WDS band wagon, but haven't messed with Win7 deployment using it yet; I've been far too busy shoving an XP image down its throat. I did however experiment deploying it with Ghost 11.0, and got a fair amount of success out of it. If you want it to ask for a name, then forget about auto domain joining. What is happening right now is it is joining the domain, then asking for a name. When the name changes, it only changes on the local machine, thus breaking the domain trust. There is no way to change its order of doing this. What I did is disabled the auto join, have it ask for a name, auto login, and then run a VB script to join the domain. Here is that script.... This script must be ran from an elevated command prompt. I forget what I had to do. I think it involved disabling UAC and something else. Let me know if you need anything else. Goodluck!

It certainly sounds like a HAL issue to me. Missing south bridge drivers will give you a BSOD, where incorrect HAL type will do exactly what you're describing. - What is the reference machine you're building the image on? - What is the HAL type you're using in the reference build? - What is the machine you're trying to dump to? - What does the UpdateUPHAL line read as in your sysprep.inf? The way I've been doing it is I build my images in VMWare virtual machines setup with two processors, using the "ACPI Multiprocessor PC" HAL. I then use this line in my sysprep.inf.. UpdateUPHAL="ACPIAPIC_UP,%windir%\inf\hal.inf" This allows for the image to be compatible with single core, and multi-core machines. If I dump my image onto a first generation P4, it will revert to the "ACPI Uniprocessor PC" HAL. If it gets dumped onto a Hyperthreading P4, or even a Quad Core Core2 Duo, it will use the "ACPI Multiprocessor PC" HAL. Just add SATA drivers for every Intel SATA controller under the sun, and you have an XP base image that will boot on almost every Intel branded machine on the planet. This methodology works on Dell Optiplex GX260s to Optiplex 780s. The only systems that I've found that don't like this setup is older mobile P4 laptops; pretty much anything D600 Latitude on down. The D610 systems work just fine. For this older stuff (only constitutes a small handful of machines out of hundreds) I had to fork my image and use the "Advanced Configuration and Power Interface (ACPI) PC" HAL, and change the HAL line in sysprep to read: UpdateUPHAL="ACPIPIC_UP,%windir%\inf\hal.inf" The forked version of my image for use on older hardware will work on newer hardware, but will not use more than one processor/core. Good luck!