djameson

I believe I have the issue worked out now. As usual, user error!! On to the next issue. Thanks again for all the suggestions.

As far as I can tell through my testing, everything works fine until the teachers attempted to download and install a program, app, or a printer. Also, during a training session they found they didn't have access to the PC Settings to change lock screens and home screens. Have not tested as a power user. Will test more Tuesday. Synack...I sincerely appreciate your help and understand your opinion. However, we have allowed teachers to be the local admins of their machines since XP. The boss expects Win 8.1 to operate the same way for teachers so I have been tasked to "fix it" as he likes to say! Thanks again for all the comments and help.

We have allowed teachers to download and personalize their laptops for years (from Xp to win7). Yea we have some issues but overall it's been fine. The issue is the new apps that curriculum wants them to explore and also the installation of printers and such. I don't want to install all apps and things for over 500 teachers!! Again, we would like to give them the rights. Any one know the gop settings we would need to adjust for win8.1? Thanks.

We have just received new HP 810 G2 Revolve laptops for our teachers. We are moving to Win 8.1 Update 1. We've had several issues but the one I am dealing with right now I can't seem to get a handle on. When a domain user logs in, everything works fine. But if they try to access PC Settings or make any "changes" or attempt to download and install an app or program, they are prompted with a log in box asking for the administrators credentials. How can I give domain users the rights to make changes and install apps and programs? Preferably, I'd like to accomplish this through Group Policy. Any help would be greatly appreciated!! Thanks in advance for you time.

We have been using Backup Exec for several years and although it works, have not been satisfied like most of you. We are currently on BE 2012. We are looking to move to something new that handles virtual servers better. What do you use and what suggestions might you have for this? We have looked at Inmage, Dell Appassure, and VRanger. Has anyone had any experience with these? Majority Windows 2008 R2 servers, 3 Linux servers Only about 5 physical servers now and roughly 30 virtual Thanks for your time and suggestions.

Thanks for the continued responses. I mentioned the max above but currently I have things set as below: Enforce password history: 2 remembered Max age: 45 days Min age: 1 day Minimum length: 5 characters Complexity and Encryption disabled The way I understand, and please correct me if I am wrong, that the 45 day setting meant that a password was good until 45 days expire...then it had to be changed. Not that it couldn't be changed before 45 days. With the minimum age being 1 day, it should be able to be changed the next day. I was thinking more on the lines of Group Policy not being applied correctly..... Thanks again.

Yes, we have tried other machines...with no luck. All looked "ok" when running gpresult but I will take another look. Thanks.

The Domain Policy Age Restriction is 45 days. I have looked at these two and see nothing of any difference between them and all other users. Two different locations, two different OUs...heck, one is a computer teacher and the other a shop teacher! The only common scenario is both gave their username and passwords to another teacher to use....then wanted to change the passwords to "new" passwords when the teachers were finished.

I have 2 users who all of a sudden can't change their passwords. They get the message that the password they are attempting to use does not meet complexity. Issue one, we have complexity turned off with our domain policy....and two, I have made up passwords that far surpass the complexity requirements and they still get the message. We've tried on different computers with no luck. I can change their password myself with no issues in AD. Has anyone seen anything like this before? Thanks in advance for any suggestions.

Thanks for the suggestions. I guess we will have to look at multiple OUs under our current laptop OU. Thanks again for the help.

I've read dozens of posts but haven't actually seen my situation. If anyone has any thoughts, they would be greatly appreciated!! OS: Win7 Server: Win 2008 R2 Goal...to deploy different network printers to different laptops through GP or Printer Management. Situation: We have up to 15 sets of laptops in mobile carts at our schools. Different carts are in different locations, therefore, they want to print to different printers in the school. ie.. ML1 wants to print to Lab 100, ML2 wants to print to the Media Center, etc. Our computer OUs are one for Desktops and one for Laptops per school. What is the best way to accomplish this? I'd rather not create 15 OUs under laptops but this is the only way I can think of. Thanks in advance for your time.

I appreciate all the suggestions. I have checked everything I can think of. Even tried doing this as domain admin rather than my username. Nothing makes a difference. I have no idea what changed but obviously something has. I'm at a stand still. I'd love to be able to use my script but.... Thanks again for all the help and suggestions.

Not intentionally. I used a variation of the script a couple months ago to move elementary students to the middle school and middle school students to the high school. No problems there. The script does several things: 1. imports users from a csv file 2. create user 3. adds user to the correct groups 4. creates home directory 5. sets home directory rights. 1-4 are working as always. The only thing I can come across that is "different" is we added a new District Instructional Tech person and gave her rights to see the existing student home directories. I guess it is possible that over wrote something. I'm sure it is something stupid and simple I ma just over looking. Thanks again for all your suggestions.

Thanks. I'll take a look but again, no changes on my account since last year (or ever actually) and it ran fine. I'll let you know if I am able to solve this. I really hate losing the use of the script as it really saves me a good bit of time in creating new student accounts. Thanks again.

Thanks for the quick response. It happen on 7 servers x 7 home directory folders. The code to set the home directory permissions: ## Modify Permissions on HomeDir $userSID= (Get-QADUser -samaccountname $USERNAME).sid # Write-Host $userSID $directory = $HOMEDIRECTORY $inherit = [system.security.accesscontrol.InheritanceFlags]"ContainerInherit, ObjectInherit" $propagation = [system.security.accesscontrol.PropagationFlags]"None" $acl = Get-Acl $directory $accessrule = New-Object system.security.AccessControl.FileSystemAccessRule($userSID, "FullControl", $inherit, $propagation, "Allow") $acl.AddAccessRule($accessrule) set-acl -aclobject $acl $directory Write-Host "============ Home Directory Rights Set ============" -foregroundcolor Cyan Thanks again.

Thanks in advance for any help. I have a script that I ran all of last year to create students, home directories, and set permissions. All ran fine with no problems. I attempted to run it yesterday and got the following error: Set-Acl : Attempted to perform an unauthorized operation. At C:\Users\djameson\Desktop\ADAccounts\HD Rights.ps1:29 char:9 + set-acl <<<< -aclobject $acl $directory + CategoryInfo : PermissionDenied: (\\rmsdc01\home$\students\sw19 38:String) [set-Acl], UnauthorizedAccessException + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.Pow erShell.Commands.SetAclCommand Everything in the script is created but the permissions. As far as I know, no changes have been made to the server, my workstation, the script....I am a domain admin so rights shouldn't be an issue. I have executed the script from PowerShell with "run as administrator". Nothing seems to make a difference. I can manually add the permissions without any problem. Any ideas as to what may be causing this issue? Thanks again for your time and suggestions.

Sukh... Had a little time yesterday to play around again. I talked with a neighboring tech guy and he gave me one of his imageunattend.xml that he uses. I compared and the only difference I saw was the location of the components. The components were the same but most of mine were in WindowsPE and OOBE....most of his were in Specialize and OOBE. I edited his xml and low and behold....it ran fine. The only thing that did not work was the prompt on network location. All others populated fine. So....I guess the location of components is important!! Again, thanks for all your help.

Sukh...I appreciate all the help but I am going to have to move to another project for a few days and come back to this a little later. Again, I appreciate all your time. I'll post back if I get it working or when I get to come back to this. Thanks again.

I continue to appreciate all the help and suggestions but I am not trying to "install" Win7....I am working with a reference image. I began with saving the unattend file with the name "Autounattend.xml". The name appeared to make no difference as some resources referred to it as the autounattend, others as imageunattend, and still others as just unattend. Regardless of the name I use, WDS moves the unattend file to a location of it's choosing and renames it when it is assigned to the image through the image properties. I will give the older WinXP $OEM$ format a go and see what that does. So far my testing shows parts of both unattends are being applied while parts of both are not. The WDSunattend is naming the drive but not adding the computer to the domain or prompting for our naming convention for the computer name. The imageunattend is handling the EULA correctly and the time zone correctly, but not the Network type (Home, Work), not adding the CD Key, or the administrator password. If I remove the imageunattend, the WDSunattend works as expected....and the computer reboots with all prompts (time, EULA, etc.) I feel as though there is some WDS setting or setting on the reference computer itself that is set up incorrectly or not at all. Since the unattend is being copied from the WDS server to the computer during imaging, I feel something is failing to "tell" the imaging process to apply the unattend file completely.......or there is confusion between the two unattends. Again, thanks for all the time, help, and suggestions. It is GREATLY appreciated.

WDSUnattend.xml OnError 1 Primary true true NTFS WinXP C 1 1 0 true acsd4.local wds ### OnError Image Name as displayed in WDS Image Group WIM Image Filename 0 1 Thanks.

With the ImageUnattend.xml, I did not include that section. I understood to leave that blank to prompt for the image. With the WDSUnattend.xml it is configured: Image Name as displayed in WDS Image Group WIM Image Filename

Yes....X86 image.

The following errors occurred with your submission The text that you have entered is too long (546473 characters). Please shorten it to 12000 characters long. Sorry......

The setupacct.log is 533 kbs. I'm limited to 488. Deploying Win7 x86. Again, the image works fine, I am just not getting the changes in the unattend file applied. Thanks again.

The name I use is "ImageUnattend.xml". Once you point to the unattend file in the properties of the image, it automatically moves the file where it wants it (image folder\image\unattend\) and renames it to "unattend.xml". Thanks.