m25man

I saw this on Tuesday. You must kill the running process (it usually disguised) One killed Sophos can clean it. I was lucky there was only one machine infected and that was the only one connected at the time. It hogged 10% of the CPU but swallowed all of the 2 MB SDSL band width. I tried downloading a Sophos Update whilst the drone was active and could only get 2k per sec, killed the BOT and immediately got 286k. I dread to think what half a dozen will do to your network!

You can use MAC addresses in a Radius Authentication Policy too.. This useful for locking switch connections down. Especially in halls of Residence and the likes. Stops people connecting unauthorised devices to you LAN outlets or AP's

Don't forget to consider the noise levels. Check the server specs carefully. Rackmounts may give higher density, more servers in a smaller space however on the downside they tend to create as much heat as a tower in a smaller chassis. This means they tend to have more fans to assist cooling. This leads to a higher noise levels unless you can keep the ambient temperature low enough which requires air-con. So, unless you have somewhere you can lock them away with some decent air-con to keep them cool and you don't have to have your own desk in the same room racks are the way to go. If however you plan to have them all in a neat little row in the room you have to work in for 7 Hrs a day you might want to consider pedestal servers as they tend to have a lower dbm factor. I have worked in too many server rooms all day long and come out with my ears ringing. How do these guys do it every day!

I had to do the same thing last week after a succesful Exch2k3 upgrade, then we upgraded the OS from 2k to 2k3. It died and nothing would fix it. As only the OS was screwed I just reset the Exchange server AD account, reinstalled the OS joined it to the domain as the same name server it used the existing machine account. Reset the drive letters so they matched the old installation then re-installed Exchabge 2k3 with the /DisasterRecovery switch. Updated to Exch2k3 SP2 and remounted the stores instant recovery. All working sweet as. So if you have an offline backup it's as simple as 1,2,3 Henrik Walther published a walkthrough here... http://www.msexchange.org/tutorials/Recovering-Failed-Exchange-2003-Member-Server-Using-Disaster-Recovery-Switch.html I have used it several times without problems. My golden rules for exchange, NEVER install it on a DC Always have it on a partion with twice as much space as you thing you will allow the stores to grow to. Always do an offline backup before performing any major changes to the server or the OS

Localzuk, I have an early version (pre adaptec - Maxtor I think) at one site, it has the Guardian OS but no iSCSI target support, it only has a 4 drive Raid 5 yeilding only 250Gb. I expect this was state of the art when it was installed 3 yrs ago. Your post has made me re-evaluate the Adaptec version and I have to say they are impressive. The SANbloc product looks extremly good value at £3000 with expansion upto 72 drives it has the sort of capabilities any school could use. Anybody got one?

Now I would never have considered the Snapserver Products because they were a crappy NAS based solution with it own bespoke NFS that could not be properly integrated with Windows Security models therefore was a waste of time unless you were using them for archive or backup storage. Are you saying that this new generation of Snapservers are an "Out of the box SAN solution" that is as easily integrated as plugging it into an iSCSI adaptor/switch/HBA and away we go? Maybe then I should revisit the Snap product range, because at that price they might fill a significant technology hole without breaking the schools IT budgets. On a different note:- Having seen several posts on this site recently from our US cousins... Whilst it's fantastic to have thier input into this forum I think it might be a little frustrating for some of the UK Techs that simply do not have the same level of access to the resources that US Schools seem to have. With the vast majority of UK Schools under tight control of the DFES and very little commercial money made available to them the US Schools will probably wipe the floor with the scalable solutions that they seem to be able to get thier hands on! It would make an excellent thread though! What about an Overseas Section that lets Edugeekers from outside of the UK tell us all how they do it and what challenges they face compared to ours! I know ICT Technician.com has a fair mix of members but lets face it this site has so far been definately UK biased, do we need to take Edugeek Global? Maybe they Sysops would like to consider this or would globalisation make Edugeek less effective? C'Mon Grumbledook, POLL IT - Should Edugeek stay with a UK Bias or go Global.

What spec blades are you using to host 20+ VMs ? And how are they weighted? Eg Blade 1 = DC1 100% Blade 2 = DC2, AV, Media @33,33,33 Blade 3 = DNS, RIS, Radius @33,33,33 Blade 4 = SQL1, SQL2, Linux Sandbox, Internet Filtering @35,25,15,25 I have found it hard to run any more than 2 or 3 VS2005's on a single Xeon but running on Quads, VS is as good as a real server and I have had 8 VM's running on a single quad core. How do you do it? Any suggestions for this years Datacenter Deployments in our secondary schools or are we just going to roll over and have RM put a couple of CC4 boxes in uner a BSF contract for the next 10 years. 8O

But what versatility, need to add extra storage to an existing server put a HBA in it and your away, you can even boot from it! Loads of 1u Blades all plugged into a massive SAN Bliss! Just to P**s you of a school down the road from you "Found" 20k left over in the IT budget at the end of the year and gave the IT manager about 3 hrs to spend it. needless to say without proper time to plan the spend wisely they spent more than half of it on crap! At the other end of the scale most state schools would have spent 10K in the first few weeks on supply teachers so the IT budget get squeezed to counter for somebody elses bad management. I see it all, and in most cases to the victor goes the spoils. School Network Managers tend to be yes men happy to take whatever scraps they are given. There are a few who have excellent negotiation skills and secure a fair slice of the cake when it comes to budget time. Be adventurous write a business plan sell it to the SMT and push for as much as you can get away with, that way a 10K SAN could end up being just the cherry on the cake!

localzuk has the right idea. School networks have outgrown the old concept of Server + Raid Array = Good Network. With more and more users wanting to access more and more "different" services and a tenfold increase in user data storage requirements entry level SAN's are the way to go. iSCSI has already forced a massive reduction in pricing, the newer HP Switches support iSCSI out of the box, Host adapters are cheap and Server 2003 R2 has iSCSI support out of the box. Now re-assigning a disk volume located on a SAN can be re-assigned to another server on demand. Volumes can be duplicated expanded, assigned, re-allocated clustering is easier than ever. There are entry level systems coming on-line at less than 10k There will be winners and loosers, early adopters will pay a higher price but will master the technology earlier. Those that hold out will benefit from the cost cutting that will occur as result of higher demand.

Hello to Florida, This site and forum is for technical and not so technical type persons who have an involvement in the Educational Sectors in a IT Role. This should probably be handled elsewhere but we'll let the sysops decide that. Your issue is probably related to the KB925902 MS knee jerk security patch that has taken out literally hundreds of applications. There are already many posts regarding this so-called security patch that has ruined many a good system (and server) so before you do anything drastic try and remove this patch or update it with one of the other Knee jerk fixes MS has posted since it's premature release. If your issues have been "apparent" since 04/4/2007 then I would highly suspect that this patch has affected other 3rd party installed applications or plug-ins. The result is applications are being re-located into memory locations that are reserved for OS DLL's. Do not however be duped into thinking this patch is not required. The ANI cursor threat is serious, serious enough for M$ to release an untested and botched patch out ahead of schedule to millions of users. I have already seen the effects of this patch, servers have become unstable, reboot themselves, leak memory until the don't work any more, work stations that re-boot as soon as certain webpages are accessed. The fix is probably as big athreat to your systems as the exploit it was supposed to fix! Best of luck, Enjoy Florida, I do.

Take SBS 2003, Remove everything business related from it. Provide some client connection software. Put in a PNP Media Service and a fancy user console there you have it. Microsoft Homeserver. Im sure it can do a lot more but Im still trying to find something!

I'm about to do one, Reception, wall mounted Plasma with Mac Mini attached. Does anything, Plays anything built in everything just run a Cat 5 up to it (if I find it can't use the wireless for all I need) managed across the LAN with VNC. Sorted...

Vista doesn't really need an anti virus product as it's the most secure operating system ever invented! And anyway, if you do feel the need to have one why not use Microsofts own Onecare Product, it's wonderful and all you will ever need.... Arrggghhh... Bill plse take the twigs out from beneath my fingernails, please...... Of course I use AVG on my own machines, it's quick and lite but I still haven't been able to get the AVG Antispyware product to work properly with Vista yet which ran fine under xp.

Hey, Just got me a new gizmo for making Video Files & DVD's from the schools Camcorders and VCRs. A Pinnacle Dazzle VC Platinum. So easy, Comes with it's own drivers and software which must be installed prior to plugging in the device :-( Immediately Vista says "There are known Issues with this software"- Sends you off to the Pinnacle Site.. eventually I try the realtime tech support... Hello, I have a problem blah blah blah... Oh, You have version 10.5 you can't use V10.5 anymore we no longer support it, you must upgrade it to V10.7.... OK then, I will download the 112mb file and upgrade it... No you cant, that's only for XP..... So what about my Vista..... Don't support it yet... You are welcome to try the 10.8 beta... But there is no support for it and it expires on April 1st... Thats really useful for a brand new piece of hardware... So what do I do after that then?... We hope to have a fix by then.... A fix... Sorry, I mean an upgrade.... Will it be free? I very much doubt it, as it will be V 11 by then... So thats it for now then, I will just have to wait for stuff to become compatible with Vista.... No - Have you thought about buying a Mac instead? Gobsmacked..... Everyday I hate Vista a little bit more.

The built in IMF that shipped with Exchange 2k3 SP2 is really quite effective when tuned correctly and it costs nothing. Try this first before you part with a load of taxpayers money, you might find it is good enough with the other layers provided at your LEA/ISP etc. Daniel Petri has some really good how to's: http://www.petri.co.il/installing_imf_with_exchange_2003_sp2.htm

I have been using various SSL VPN Solutions for the last 12 Months including Open-SSL, Sonicwall, Netgear, Aventail and others. Over the last few weeks I have had reports of a number of clients reporting to be having trouble connecting and using some appliances. So, today I began testing and then very quickly discovered that Vista, IE7 and RDP6 do not work with the current release of Sonicwalls SSL appliance. Sonicwall like so many other hardware vendors have posted the usual advisory that Vista compatabiliy should be forthcoming in early 2007. I suppose this should come as no surprise especially as M$ have aquired Whale Communications a major player in the SSL-VPN arena and have begun to integrate SSL-VPN into ISA, IAG and Longhorn products. Clearly M$ have got their eyes on the lucrative SSL VPN Solutions market and Vista has made it easy for them to disable the competition with a few critical updates and the odd service pack. If you operate any one of these SSL devices and plan to deploy Vista I would begin some serious evaluation. The good news is the i-Mac still works with them.

What a complete load of pants this tool is.... There are dozens of free tools that do a better job without the hassle or the overhead. Whatever you do, do not download an install this onto a critical server/pc. It wants to install SQL Express 2005 as part of the setup and if you are already pushing the envelope (which most schools seem to do) this is just the app to push your system over the edge and leave you with a big pile of pooh to clean up. Microsoft get 0 out of 10 for this one... I say, don't waste your time or your bandwidth with it.

If it's a flush not contoured facia most laptop CD/DVD/RW drive are a generic build only the retaining bracket it bespoke. I picked up a replacement DVD/RW slimline internal "Sony" for my Acer Laptop from PC Worlds white box shelf and it only cost me £45 inc VAT. Ebuyer list them such as this... http://www.ebuyer.com/UK/product/124422

Such an act of deliberate vandalism as you describe is hard to defend against. The countermeasures required to defeat such an attack bring management challenges that simply do not suit the traditionally "flat" school network designs. Realtime monitoring solutions such as Cisco's, HP and 3Com's switch software can normally display when such an attack occurs as you would normally loose your segments one by one so by detecting the source switch it can be isolated quickly by unplugging it at the core or distribution layer. Core switch management usually has other features that can be leveraged. By baselining the entire network and specifying specific threshold values for a specific port or uplink sudden unusual traffic patterns can be detected and controlled, throttled or even shutdown. Time to get the switch manuals out and look closely at many of those features the manufacturers went to great lengths to build in but we all chose to ignore... The birch or a Taser would be more effective, but I would draw the line at lethal force for a minor network violation...

Here is as good a place to start as any, http://www.cisco.com/univercd/cc/td/doc/product/software/ios113ed/113ed_cr/switch_c/xcvlan.htm There are 3 types of VLAN:- Port based, MAC based and Protocol based. ICTNUT's suggestion uses purely a simple port based VLAN using 802.1q tagging to propogate VLAN membership throughout the segment. This restricts broadcast and multicast to VLan members. In ICTNUTS design all VLAN1 servers see each other and I guess VLANs 2&3 whilst VLANs 2 & 3 do not see each other. This type of VLAN satisfies certain security requirements but a broadcast packet will still propogate to all ports that happen to belong to the same VLAN so a Broadcast Storm started in a classroom will still flood all of the Curriculum VLAN and Server VLAN ports. Which brings us back to L3 Routed Subnets. Much more complicated and probably way to overkill for most school lans but as you should by now understand probably the only way to safely quarantine unauthorised loops. I have not tried this but, I will when I have the chance, that's using port based authentication. By assigning a specific device either through MAC or Radius to a specific switch port the connecting equipment would need to be authenticated before the switch will pass any significant traffic for it. So if a kid tried to loop out two ports the connection would not be authenticated, therefore no traffic could pass. An interesting theory, maybe someone else here has tried it. Port based Auth or Radius mechanisms are used widely in secure environments to prevent casual plugin abuse. Uni Campuses, Police and Government Agencies use them extensively. I can't see why it wouldn't work - I will let you know.

Whilst Nero 7 did work I had to un-install the emulator (Drive Image) as it kept causing a BSOD. I replaced this with Virtual DAEMON which does work. In my original Nero XP installation Nero Recode would convert the ASF files created with my Digital Camcorder into AVI. Vista seems currently unable to support the Intel Codec used by the ASF file format so I can't use my Camcorder anymore with Vista. Microsofts own (A)nother (S)illy (F)ormat will only playback on my Vista if I use VLC mediaplayer how mad is that! Microsoft Moviemaker whilst it was a bit pants in XP it worked, alas the version shipped in Vista declines to load at all because my laptops video card doesn't meet the minimum specification for Moviemaker (So why bother to include it during the install if the system knew I didn't have enough resources). Fortunately I have a spare 2.5 HDD with XP on it that I have to plug in and use so that I can access my old XP applications and load my mp3's and burn DVD's from my video camera! I will stop there.. otherwise this will just turn into another anti Vista rant... Me thinks what we need here on Edugeek is a new thread, where the insane, stupid, divorced, truly dedicated or just plain bored techies can post of what current educational software titles do actually work with Vista, and how they did it, or not as the case maybe! Eg. Clicker 5 - Works if you have 2gig or Ram in the Vista box! (only joking) Jasc PSP V8 only works if forced into compatability mode and run as an administrator.... (as if) AB Tutor Control etc etc etc.... This kind of real world testing would be invaluable and a massive timesaver. Anybody think of a good format for the thread and the posting etiquette? Care to get it started?

There are lots of posts both here on edugeek and elswhere regarding Vista USB issues. As Vista extends policy management to USB devices as well as protecting everything with UserAccessControl it appears that any "In Place" upgrades may not inherit some of the default Vista USB Host settings or Drivers. Someone reported some success by starting in safe mode and deleting all USB related drivers and redetecting. I only managed to resolve mine with a clean build. Now all my USB Storage works but most of my other stuff doesn't. My Zen Micro doesn't work anymore. My HP2600n Colour Laserjet will not be supported until July if at all. Nero doesn't work for me. Most of my tools and utilities only run if configured in XP compatability mode and run as administrator. I could create a list probably dozens of lines long listing applications that are broken in one way or another. What does work? Everything Microsoft gave me. So, either dual boot or VM an XP machine seems to be the best answer at the moment. There is one thing for sure, my next laptop will be a Mac..

A standard packet is addressed explicitly from source to destination MAC address. By adding the STP information to each packet as it arrives fron client into switch the system can identify if a packet has already been seen passing thru said switch. If a packet arrives into a switch with an STP header indicating that it has indeed already passed thru the device the packet can be ignored. STP is by design intended to be used for OSPF routing and redundant loop operations. Many installations create loops between backbone switches on purpose to provide fail-over. The STP protects the loop, when a switch or a link fails the loop ensures that packets flow the long way round.... Cheap switches simply do not have enough resources to handle this type of abuse and turning on STP on a cheap switch will only result in the switch cpu running at 100% tying to cope with the STP load. I guess what I am trying to say is that STP was not designed to handle locally induced loops on a single switch created by 14yr old cyber terrorists. In most cases STP has to be worked into a network design for a specific purpose. Turning STP on, on each and every switch on the network can help, but could add enough packet overhead to cause a noticable drop off in everyday performance on some badly configured or overtaxed networks. I would look into Broadcast Storm Control if your switch supports it, many have this feature built in and in addition use a program like NMAP or Ethereal to monitor your network in realtime. Remember that a broadcast packet will propogate to every switched port in a common subnet regardless of your STP settings and whilst any single node broadcasts, all your other traffic will be waiting it's turn to send! If you really want to isolate this behaviour only true sub-netting and vlan routing your switch segments will resolve the issue, using L3 design techniques. This way when a kid next loops out your wall sockets only the room connected to that switch dies (closely followed by the kid that did it!)

All my USB issues in Vista have now been resolved. I simply gave up trying to fix it and just re-installed Vista as a clean install. It was a completely in vain effort to try and keep all my old XP programs and settings intact. Give it up and just do a clean install. It took far less time to round up all my old tools and utilities and re-install them on my Vista Image, where I had spent an entire week and countless hours just battling against one incompatability issue after another. All my usb storage now works as does my camera, scanner and mp3 player. For me the in place upgrade was a total waste of time and effort.

To do it properly you do need some decent tools. Starting with a decent chipset in your wifi sniffer. Most of the cheap ones don't display the noise levels anymore. My weapon of choice, an Orinoco Gold A/B/G and AirMagnet.