ntoupin

That error throw is custom coded in the php, it's not an actual LDAP error. It's coded to throw that error... if ($info !=1){ } where $info = ldap_count_entries($ldap, $result); when binding the ldap connection. How the form is working is that you enter the details and when you submit it binds to the ldap server, does an ldap search for the username you entered. If it finds an entry, it results a false for $info!=1 because $info would be 1 (matching the username in your LDAP) and goes to the else {} statement which just echo's the error message into the page. It shouldn't create the account if it's throwing that error as the only code in the else {} statement that shows the error is the error, the code that actually creates an account in LDAP is dependent on the if ($info !=1){ } passing as true. The only thing I can think of that would do that would be users submitting the form, it creates the account in the backend while processing the end user's page, then while the page is still loading they hit submit again thus bringing them to the error message (basically double clicking the submit button) vs. submitting once and waiting for a page load. If that's not the case, attach or pm me your index.php code so I can take a look.

Looking for ways people currently get certificates deployed onto end-user personal devices such as BYOD for SSL inspection for web filtering. Do you just have a page where users can download the certificate with instructions on installing? Do you have an onboarding system that installs the certificate as part of the self-enrollment for wireless connection?

Correct, if I do ever update it my plan was to put the configs into a database so no configs would need to be done in the actual code. Those we're just placeholders for future settings / changes. Of course feel free to change/modify to your needs. Not sure that I'll ever update it on git though as I really only made this for my own use and just wanted to share it in working condition for others that could find use for it.

My pleasure, enjoy! It's been very convenient to not have to create guest/temporary accounts for wifi/computer authentication for speakers, events, etc. myself and allow the staff to do this themselves, so hopefully you find the same!

The certificate authentication for LDAPS has been the most common issue people have had when PMing me for help - I usually tell most to just set ldap.conf to "TLS_REQCERT never" right off the bat for testing - if everything works after that then the cert/ldaps is the issue.

Enable ldap debugging, what error is it throwing? ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);

I have it running on a apache webserver on linux. No reason it can't work on IIS/windows though, it's just PHP code. It requires PHP openLDAP to be enabled.

We use the same, haven't had to use any of the backups but it works simply and is free depending on your needs.

Now on GitHub: https://github.com/ntoupin/AD-Guest-Registration Again, it's at the very beginning stags, the code is all over and there's configuration in just about every file you would need to do to make it work with the current code.

Hi, It's still in the development stage - it works but the code and organization needs a big overhaul as I coded it just to get it to work, not be deployable/customizable yet. I'm planning to put it up on github sometime soon.

Yes, the tablets are locked down and the only thing you can do with them is what the teachers set as the current "profile" - basically the apps they choose to be shown on the screen and accessible. When applying the profile from the management, they do push out to the tablets to automatically install. We never really had to make a master tablet - through TabPilot, upon registering them, you can remotely uninstall any of the apps you don't want to start with a blank slate, then go from there. Even if there's 200 apps installed, users will only see the ones set by the profile, so there isn't a big need to change settings and remove specific apps on one and try to clone it over.

I'll contact my state rep just in case, but we don't license anything from Microsoft on a user base, we own the licenses based on device (W7/W8.1 Volume license, Server 2012 R2 Standard licenses) Staff and students all have access to use their own device on wireless so again, it's no different than what they have. The wireless is separated from our internal and has only internet access, it cannot contact the domain at all beyond using AD credentials to authenticate through the radius server. Our AP's (although probably not as successful as they advertise it to be) target rogue SSIDs and contain it. At the very least we become known of any hotspots almost instantly. Partially on our side is the fact there's little to no cell coverage in our buildings (1-2 bars tops).

Certainly could work for something like that. The baseline purpose is to make it more of a self-service or end-user level task for when non-regular staff have a genuine need for authentication access to wifi or AD (computers/etc.) I didn't have one before I was testing with this and testing for our new wireless system we'll be putting in place (Cisco Meraki's). It's actually extremely easy, I had ours up and running and acting as a RADIUS authentication system for testing with Meraki within 15 minutes. Here's their guide on doing it, the general setup can be used with pretty much any system that will take RADIUS auth: https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise

Hi, I completely understand your skepticism at first, and maybe our situation is different than others. This would be more for the teachers or admins use, not a tech departments. The guests are typically guest speakers, presenters, etc. that are presenting in a classroom or auditorium and would need wifi access to use their own device and/or a guest credential to use one of our devices to bring up a presentation or video on for example. It would not be intended for guests in case of people that just entered the building or a short meeting like a salesperson, but strictly for planned guests that have a legitimate need for access. Even if someone (only teachers/admins can create these guest accounts) simply put in "demo user" the staff member that created the user gets attached to it. Right now simply by extra details on the AD account itself, but also I'll be adding logs directly to the script to monitor/track it. The responsibility of that guest ultimately gets attached to the person creating the account, just as someone physically signing in a guest into the school for a reason becomes their responsibility. For licensing, I'm not sure how this is an issue. We don't license our servers via CAL's but by physical cores, so maybe we're different there. I'm not an expert on MS licensing but again, I don't see how this would have any issues for us. It doesn't open it up to hackers any more than giving students and staff AD credentials, and in our experience the students are the ones to worry about. I appreciate the feedback!

Hi All, I put this initially in the edugeek projects ideas forum, not sure if that was right but I found this location afterwards and it looked like a better spot based on other threads located here. I'm working on a system that is mainly for use with our wireless system which uses a Windows RADIUS server to authenticate users onto our SSIDs. Although that's the main purpose it also can be used for general "guest" computer access as well as any system internally that uses AD to authenticate (in our case - helpdesk, booking software, etc.). At its base it's a simple php script that allows any current (or designated - I currently have it set to any "staff" user (in the AD security group "staff")) AD user log in and fill out a php form that will automatically create a new account in active directory. That account will be made with a defined prefix, "guest_" for example, and created in the specified AD OU, "GuestUsers" for example, with an expiration date and time controlled by the form. Also in the form is additional information such as the guests name, location they will be in, what staff member is "sponsoring" the guest. In addition to the script creating the user automatically a separate powershell script is used as a scheduled task on any domain controller which looks at the expired guest users and removes them. This is purely for the fact of "cleaning up" old guests and making the username that was used for them available again. Below are some screenshots of the system. It is currently functional but I will be adding some additional features and cleaning up a lot of the code before actually using it. It works local on a LAN but I also tested it from a remote website and with a little tweaking of the LDAP connection was able to get it successfully working there as well. It also is responsive in its design (uses bootstrap) for mobile devices. A base list of its current features: LDAP/AD login Choose what users can create a guest account Users choose guest account expiration (1 hour, 1 day, 2 day, etc.) Users choose guest username and password for ease of use Additional information gathered for system logging (location, purpose, guest first and last name, staff creating the account) Error catch for duplicate users Printable "ticket" to give to the guest on creation Automated creation of guest account in active directory/ldap with user's inputted information Automatic "cleaning" of old expired guest accounts via scheduled task on domain controller Responsive design (bootstrap) for mobile Some features to add: History for staff users (will show a record of guests they "sponsored" in the past, when those expired, what username/password they gave them, etc.) Log system (for admin/technical use - lookup right in the script user sponsor history, search for guest name, username, etc.) A few more checks to ensure a duplicate is not being created and/or a safe fail that creates a user anyways with a randomly generated number after it. Login screen (uses LDAP/AD credentials) Registration form to fill out guest details Sample form filled, dropdown of account expiration options Successful registration of guest account Duplicate error Printable "ticket" to hand to guest AD user created I honestly don't know if this would ever be useful to others or if it has or hasn't been created before. I search a bit and figured I could just make it myself and customize it to our needs. If it would be useful for others I can share the system once it's cleaned up a bit. I'm also open to suggestions for some improvements or additions to the system. Thanks!

It doesn't affect it on my machines, but I'm not sure if that would be different with different solutions. Again you could test by sending a manually started scan on an older profile and then try deleting with delprof2. It can even be just a day old to test with..

Not sure what you mean by scanning.. easiest way to find out would be check a folder that was "scanned" right after - check it's modified date etc. and you can also test using delprof2 to that folder from cmd line to see if it see's it as "newer" due to the scan.

That GPO is working for us - I have it set to 30 days in various computer labs. Cleans up the entire profile & folder. I have also used delprof2 to deploy a delete on certain computers that the GPO wasn't deployed to and that worked great too (example below deleting older than 2 weeks) DelProf2.exe /q /ed:default /ed:[ADMINPROFILE]* /ed:public /d:14 Not sure what you use for remotely deploying software but even if you don't have something you could go back to basics and make a scheduled task with a batch file setup that runs this on your specified computers every X days, weeks, etc. if you can't get the GPO to work for some reason.

We just had two of our 4065's replaced with new ones as they were disconnecting their usb connection from time to time and not reacting to touch from time to time. So far they've been better but it's still occurring intermittently. No word on smart to us about a firmware upgrade to rectify this.

We use a android MDM with our android tablets. It can also be used for iOS but we use it strictly for our Android. TabPilot MDM for Schools | Mobile Device Management for iPad, OS X, Android It gives teachers easy control over the tablets - they build "profiles" with different apps set to them and can schedule those to change or manually change them. There is a license cost upfront and then a yearly cost on top of that.

Hi All, I'm working on a system that is mainly for use with our wireless system which uses a Windows RADIUS server to authenticate users onto our SSIDs. Although that's the main purpose it also can be used for general "guest" computer access as well as any system internally that uses AD to authenticate (in our case - helpdesk, booking software, etc.). At its base it's a simple php script that allows any current (or designated - I currently have it set to any "staff" user (in the AD security group "staff")) AD user log in and fill out a php form that will automatically create a new account in active directory. That account will be made with a defined prefix, "guest_" for example, and created in the specified AD OU, "GuestUsers" for example, with an expiration date and time controlled by the form. Also in the form is additional information such as the guests name, location they will be in, what staff member is "sponsoring" the guest. In addition to the script creating the user automatically a separate powershell script is used as a scheduled task on any domain controller which looks at the expired guest users and removes them. This is purely for the fact of "cleaning up" old guests and making the username that was used for them available again. Below are some screenshots of the system. It is currently functional but I will be adding some additional features and cleaning up a lot of the code before actually using it. It works local on a LAN but I also tested it from a remote website and with a little tweaking of the LDAP connection was able to get it successfully working there as well. It also is responsive in its design (uses bootstrap) for mobile devices. A base list of its current features: LDAP/AD login Choose what users can create a guest account Users choose guest account expiration (1 hour, 1 day, 2 day, etc.) Users choose guest username and password for ease of use Additional information gathered for system logging (location, purpose, guest first and last name, staff creating the account) Error catch for duplicate users Printable "ticket" to give to the guest on creation Automated creation of guest account in active directory/ldap with user's inputted information Automatic "cleaning" of old expired guest accounts via scheduled task on domain controller Responsive design (bootstrap) for mobile Some features to add: History for staff users (will show a record of guests they "sponsored" in the past, when those expired, what username/password they gave them, etc.) Log system (for admin/technical use - lookup right in the script user sponsor history, search for guest name, username, etc.) A few more checks to ensure a duplicate is not being created and/or a safe fail that creates a user anyways with a randomly generated number after it. Login screen (uses LDAP/AD credentials) Registration form to fill out guest details Sample form filled, dropdown of account expiration options Successful registration of guest account Duplicate error Printable "ticket" to hand to guest AD user created I honestly don't know if this would ever be useful to others or if it has or hasn't been created before. I search a bit and figured I could just make it myself and customize it to our needs. If it would be useful for others I can share the system once it's cleaned up a bit. I'm also open to suggestions for some improvements or additions to the system. Thanks!

See the posts above including the first post of the thread.....

See below for more of my response but the smartboard being used making the computer uncontrollable is one of the exact reasons to do this. If students are using the smartboard or another instructor is using the smartboard (our classrooms have rotating "special" instructors for music, art, health, etc. that come into the students' regular classroom and use that classroom's resources.) the regular instruction teacher cannot use the room's computer if it is not separate. Even with the screen extended any touch as you said on the smartboard takes control of the mouse. In addition to my response to Tom above... A majority our classrooms are setup to have the teacher desk and computer on the opposite side of the classroom (~40-50ft away worth of wire) which poses many issues connecting a smartboard directly to that computer. We've done this with several however it isn't without issues - usb connection dropping, lagging, etc. The new smartboards we're using (4065's) do not work with cat5/cat6 usb extenders either. All of their "recommendations" are to keep the USB length under 16ft to prevent issues, which do occur very often when breaking that suggestion. Not that it wouldn't be teachable in the long haul, but in a couple rooms due to distance we were able to keep the smartboard connected to the teacher desk and use dual video connections to extend the monitor. With our few guinea pigs the teachers got lost countless times on how to move between the monitors, losing the mouse, windows, etc. and it became more of a hindrance than a helpful addition. Have a separate computer entirely, also in our testing, was much easier for the teachers to recognize what was where and how to handle it. They could leave their email, grading software, etc. up on their teacher computer while having teaching content up on the smartboard without having to navigate between them. I appreciate the concern, but please let's not get away from why I made this thread. I was looking for software suggestions to aid with this, not to get questioned on why we're doing it. Thanks

Doesn't need to be "free free" just inexpensive, a one time fee like that isn't too bad so I'll check it out. Just really not interested in a software subscription system or something that's going to bring the charge up to a price point like $50/classroom.

I'm not really looking to pay for a solution like this. We would need about 40 classrooms and almost all programs like netsupport license it 1 teacher/20-30 "student" machines per license which the cost reflects and would be a big waste for our use. I'll look into that, it may be exactly what I needed, thanks!