Jaan

Sorted it...... if i restart and not shutdown, we could enter uefi with f7. Disabling uefi and going old school f7 works everytime.

Hi all, had a look on stone's knowledge base but i can't find which key i need to get into BIOs? Anybody know? Need to password protect and change boot orders. Ta.

UPDATE: all upto date and synced. port123 was blocked on the firewall. My PDC was set to local cmos MY BDC was set to sync to PDC 1. Amend Firewall to allow port123 2.On PDC as elevated admin set source: w32tm /config /manualpeerlist:"0.uk.pool.ntp.org,0x1 1.uk.pool.ntp.org,0x1 2.uk.pool.ntp.org,0x1 3.uk.pool.ntp.org,0x1" set as reliable source: w32tm /config /reliable:yes 3. start stop service: net stop w32time && net start w32time 4.on BDC net stop w32time w32tm /unregister w32tm /register net start w32time 5. force bdc to sync to pdc: w32tm /config /syncfromflags:DOMHIER /update 6. start stop the service: net stop w32time net start w32time 7. force resync: w32tm /resync /force All upto date, synced and working

The pdc is physical and bdc is virtual on another box. Both were insync before, just the source was out 2mins. Now i have the correct source time on the PDC and the BDC is looking at the PDC, time sync is enabled in the VM settings for the BDC and i'm getting this: Is this because of the time sync in hyper-v? or is it just "catching up?". I had it enabled before and the PDC and BDC were in sync. From what i understand (and i could be wrong). It should be enabled for hyper-v but disabled for other hypervisors: https://serverfault.com/questions/486593/hyper-v-time-sync-for-vm-domain-controller https://blogs.msdn.microsoft.com/virtual_pc_guy/2010/11/19/time-synchronization-in-hyper-v/

Ok if it's of any use to people.... i've followed the steps below...... and getting an error 47. So i'm just checking my firewall and will report back. 1 Logon to Domain Controller (with PDC role) with Administrator account and open elevated command prompt. If you have multiple domain controller and don't know which DC holds PDC role then use following command: netdom /query fsmo 2 Type following commands on elevated command prompt 3 w32tm /config /manualpeerlist:"0.uk.pool.ntp.org,0x1 1.uk.pool.ntp.org,0x1 2.uk.pool.ntp.org,0x1 3.uk.pool.ntp.org,0x1" Configure external time sources 4 w32tm /config /reliable:yes Make this DC a reliable time source for the clients. 5 net stop w32time && net start w32time restart w32 time server, now DC should synchronize time with uk.pool.ntp.org time servers. If the DC is not synchronizing time with the external NTP server then check the event logs (Event Viewer >> System). Normally event id 47 which means it is unable to reach the external NTP server, check the firewall to make sure port 123 is open. 6 Some helpful w32tm commands: Force synchronizing the time asap w32tm /resync /nowait Check NTP configuration w32tm /query /configuration w32tm /query /source Display time source w32tm /query /peers Display list of all configured NTP servers and their status w32tm /query /status Display time service status i.e whether it is getting time from local cmso clock/external NTP server 7 Force domain computers to synchronize the time with the DC; use elevated command prompt w32tm /config /syncfromflags:domhier /update net stop w32time && net start w32time 8 Following commands will reset the time service to default. net stop w32time w32tm /unregister w32tm /register net start w32time

Hi guys just had a support call asking for the time to be adjusted on the client pcs. All clients,servers, hyper-v hosts and dcs all have the same time. But that time is out by about 2 mins. I was going to create a GPO for the DCs but the one in question i'm unable to find. (computers\admin templates\system\windows time). I've been able to determine that the clients are getting their time from either of the two DCs ..... we'll call them dc1 and dc2. DC2 gets its time from dc1...but dc1 gets its time from the "Local CMOS Clock" which i assume is out by two mins. How can i force the dc1 to get its NTP from an external source...... either ntp.pool.org or our UTM which is getting its time from ntp.pool.org as the time is 2mins head! Any pointers would be great. FYI Server 2016 dcs. cheers guys.

Got this sorted now in a test environment. So now have DFS and DFSR set up and running across two nameservers and two file servers. Thanks for your help. Just need to read more into the "optimized polling modes" now. Consistency vs Scalability. I'm leaning towards consistency as it doesn't depends on my PDC to be online and will query the next available DC...... Just wanted to say ta

Ah ok cool.... as always i'm ahead of myself... thanks for the advise

Thanks for your reply. So should i have two namespace servers for each dfs root eg DC01 & DC02 or fileserver1 & fileserver2? in the event of one of the namespace servers being unavailable?

I've setup DFRS on a physical file server to replicate to a virtual file server. We plan to go just virtual. the replica works fine. I have not yet set any dfs namespaces. the wizard says: "Enter the name of the server that will HOST the name space. The server you specify will be known as the namespace server". Should this be the machine that hosts the physical files (in my case the file server), or the DC that "points" to physical files? The dfs and dfsr roles are on both our physical and virtual file servers, not the DCs. Think i'm just over thinking it. thanks in advance.

I'm hope edge and core stacking become available so i can aggregate across two physical switches. Then we'd switch to these on our next core/edge refresh (no pun intended)

I've just doubled checked this. we no longer get the pop up and are having the same behavior as yourself. Interesting.

The rejection message isn't in the form of a bounce email. When you click "send" you get a popup style notification (Gmail)

could you put one of the further up the OU?

I just imported a "naughty word list" and had a giggle at the same time.

what about student*@domain.com ?

not sure i'm afriad. We have both all students and each year group added separately.

Easily done when you share at a screen for any amount of time! i'd be a crap programmer! i can't spot ";"

Sure, Lets assume we have a group called [email protected] that contains all our student users. We dont want the students to be able to email the whole dist group. In the Google admin panel, we have selected the Students OU (so not to affect the staff users). Content compliance "edit" or add edit setting content compliance 1.email messages to effect; Internal-sending 2.Add expressions that describe the content you want to search for in each message "if ANY of the following match the message" expressions ADD "advanced content match" location "any envelope recipient" match type "contains text" Content yourdistributionname (eg [email protected]") save 3. If the above expressions match, do the following reject message customize rejection notice "As a student, you are unable to mail official email distribution lists. If you think this is in error, Please contact your teacher or a member of the ICT support team." hope that helps

We use the "Compliance" section in Google admin panel. (apps--g-suite--settings for gmail-- advance settings) We use this to stop any pupils e-mailing distribution lists or sending abusive emails directly to the head!

I contacted Google with regards to this. It's a paid option at the moment, but was told to keep an eye on the release calendars and newsletters.

Just testing Win10 1703 and this doesn't seem to work anymore......can anybody else confirm please? worked in an old pre 1703 test environment.

We use Sophos here. Looking at that rule, on our system it would block internet access for the "dummystaff" user as you have exceptions="auth". our rules would block all access to the internet if the utm is unable to authorise that user. try the below and see if that works. EDIT: sorry just re-read that... you already have url skipping enabled, sorry

Do you allow the use of flash in your browsers?

I/O on the host?