dan400007

Seen this discussion elsewhere and I still can't bring myself to give the students admin rights to the local machine. All our users run as standard users but they do have modify access to places like Program Files. Sits nicely in the middle.

We've got a script running at logon and logoff that makes an entry in an Access DB with the Username, PC Name, Date and Time. Makes it an easy one stop shop to find out who was last on a computer before the computer took a nose dive. Am also going to update the script over the coming months to send an alert to the administrator when certain students logon. Then if we suspect a kid is playing on the network we will hopefully know as soon as they logon and start to watch or record them.

A couple of people are talking about using beefy processors. Before you do look at what virtual hosts you want to be running. For example I'm looking at virtualizing a fair few servers and I know that several of them are running applications that are in effect file servers and use very little processing power. The random access time of the RAM, HDD and network bandwidth are more important. As with all school ICT, it comes down to budgets and if you're going to use a SAN to host the virtual harddrives. MS also provide a whitepaper detailing the trade offs about running your DCs in a virtual environment.

I find the 3Com wireless controllers work well and provide a long list of functions (reasonably priced for education too). If you do go for a 'thin ap' solution I'd recommend having a supplier that has proper support for the product so they can assist in the setup. That is unless you've got a decent amount of free time. As far as controlling internet access I'd be tempted to put an ISA box on the VLAN that has 3 nics. One for the Internet access, one for the VLAN and one for access to your domain. Then you can get all the users to authenticate on the ISA box using their domain username/password. Surely that way you'd be able to meet the T+C of your RBC.

Every PC likes a brand new Windows Install. Each time I'm amazed as to how much quicker it is.

I'd go with this using a seperate GPO and OU for the computer suite you want to apply the num lock to.

This could end up going the same way a long post I remember from a couple of months ago about what to allow students to do on the workstations. The jist of it was that everyone had a different opinion on the matter and a different way of approaching it. Initially I was very much for locking the system down as much as possible but then it only needs a fairly smart KS4/5 student to find a way around. If you've got Serif MoviePlus 5 you may have the same problem there too.

Well the upgrade of the firmware went without a hitch but I've not had the time to test the packet-filter for the VLANs. I did quickly assign an acl to a VLAN using packet-filter but then had a problem with VLAN routing. Another thing that I found that concerned me is that after applying the filter and saving the config I couldn't find any reference to it when I displayed the current configuration. If you've got a 5500-SI I'd highly recommend updating as they've decided to get ride of the SI and EI images. So now if you upgrade the firmware on an SI switch you get the EI firmware,

I havent even seen 2006 running so I can't say much, but I believe that you should still have a System Policy which will be processed before the firewall rules you set. So even if you set a firewall policy to allow RDP to the ISA server but the System Policy is set to deny RDP then the System Policy is applied and the RDP Session is denied.

For connection via RDP to a ISA-2004 server you'll need to do the following: Logon as a user with admin rights. Open the ISA Management Console. In the actions panel on the right select the tasks tab and Edit System Policy. In the system policy head to Remote Management and Terminal Server. Ensure the there is a tick to enable it and head over to the From tab. Add or Edit a Computer Set and add the IP addresses that you want to use. Restart the ISA servers to apply the new System Policy.

Our access points run on channels 1, 4, 7 and 11. I did consider this as a possible problem and so have tried to connect next to all 4 different channels. This IPaq does support WPA-TKIP as it can connect to my home wireless, running on channel 11. The PDA is quite resonable apart from this wlan problem. If anyone has a wifi enable Windows Mobile then I'd suggest installing some of the vx software. It's great for network troubleshooting on the move.

If its an ISA server remember that the RDP connections can be restricted by IP address in System Policy (ISA 2004). Also what do you get back from a port scan?

@DMcCoy I was thinking along those lines too but the trace from the wlan controller shows that the wlan is recieving the MAC of the PDA and successfully processing it. @bizzel Originally the wlan was set to accept only G, I've since changed it to B+G but didn't make any difference. Yes, its Windows Mobile 6 Classic. My home network is WPA based and it works successfully on that. I'm guessing its going to center around the MAC authentication but I don't know where since as far as the wlan is concerned its doing all that it should do.

WPA-TKIP with MAC based RADIUS authentication.

Ok, this one has me stumpted and all suggestion will be taken. We've just recieved a new IPaq 214 for trialling the Sims Mobile Registration, the only problem is that its refusing to connect to our wireless network. The IPaq see's the wlan, I enter the key and it just sits their saying connecting. Ok, maybe a problem with the wlan config so I setup a trace on our wireless controller and its passing all the authentication. To double check I booted up Ubuntu, changed the wireless MAC to the same as the IPaq and got connected, no problem. Maybe a problem with the IPaq, took it home, connected straight away to my home wireless so HW seems ok. I've tried setting a static IP on the ipaq but didn't help. I've also installed vxSniffer on the IPaq to check whats happening and this I where I'm at: The IPaq finds the wlan and starts to connect, sends its initial key and recieves one back from the wlan and then loses all idea about what to do next and starts sending packets asking to start the authentication but doesn't recieve a response. So somewhere between the handshaking with temporal keys and requesting an IP it falls over. HELP!

Right, after some further looking around I think that the 'Packet-Filter VLAN' command is the right way to go. However you will need to upgrade the software on the switch to the latest version. I'm going to try and upgrade my 5500 switch tonight and see what happens.

As an option, thats not installed by default.

I'm currently waiting for a PDA to test the Sims Mobile Software and I have been told by Capita that it is possible to download the registers for the day. The leave school, complete the registers and then upload the registers when back in wireless range. However this was on a second phone call, on the first phone call I was told it couldn't be done and needed to be range of wireless. From: SIMS Annual Entitlement & Maintenance Guide 2008/2009. Never know with Capita, it may or may not work and may work sometimes, fail at other times.

Sorry can't help with the GUI problem but thought that this may help until a fix is found: http://www.microsoft.com/technet/scriptcenter/resources/qanda/aug05/hey0825.mspx

The core mode does seem to be a bit of a half arsed attempt of removing the GUI. In fact some of the GUI remains, for example setting the timezone and clock can still be done via the GUI even in core setup.

Did anyone find a way of assigning an ACL to a 3Com VLAN? I'm preparing the overhaul of our 3Com network and it would greatly reduce my headaches if it was possible.

Some of the Aero style effects can be installed on Server 2008 by installing one of the 'Features' (Beware of that on Server 2008 you have Roles, Features for Roles and plain Features). They've made the option available for those who will be using TS. I'm currently planning to move several of our servers over to Server 2008 but thats mainly because we've shifting a lot of servers to VMWare. However the Domain Controller will be staying as is for the moment and won't think of migrating those until we start to consider Vista.

Be careful with webDAV. It will work but can be a bit of a pain on Vista with Office 2007. In XP you could access webDAV using IE and use it as a normal folder, with Vista you can't do so anymore. You have to add it to My Computer as a network location. Also there is an update that would need installing on the client. If you are going to use webDAV i'd recommend having browse through MSDN for how to create the script to manage R+W settings on individual sub folders. Then you can make it an opt-in option for staff, after all we all know how easy teacher passwords are to guess.

Sorry, been busy planning our migration to VMWare. I got the information from an MSPress book called "Introducing Windows Server 2008". Its a free download from MS, http://www.microsoft.com/learning/windowsserver2008/default.mspx#EBOOK The comment is on page 35. The book in general is worth a read.

Well, I've just been reading an MSPress book that has shown up a nice bit of licensing that I didn't know: "Microsoft changed licensing to allow customers to run up to 1 physical and 4 virtual instances with a single license of Windows Server 2003 Enterprise Edition on the licensed device; and 1 physical and unlimited virtual instances with Windows Server 2003 Datacenter Edition on the licensed device." Don't know if this applies to Windows Server 2008 but may help when deciding what licenses to buy if you're going virtual.