CAWJames

I'll second NPS, it is the highest policy for entry and overlooked frequently

The internal card of the RRAS server is 192.168.100.3 Thanks James

I would get 192.168.100.200 , 100.0 is our home subnet, where the RRAS is. Then we have a SW router with interfaces that provide 102.0 and 103.0, which are DMZ, then 2.0 3.0 and 200.0 are subnets at remote sites provided by the site to site VPN on the sonicwall.

Thats my route print for IPv4. 192.168.100.0 being our home subnet, which the RRAS is at. 192.168.100.200 is the local default gateway SW which has the various VPN's and DMZ's on. The other 192.168.x.0 are the other subnets. Still seems strange I have lost all connection after turning on the IPv4 routing option, and stranger that turning it off doesn't return any connectivity! Any light? Thanks James

Thanks for the options, the deployment toolkit looks interesting! Unfortunately, we have drilled it into people to shutdown when they go home, and I have found WOL to be lacking, at least in our environment, so it needs to be done when they login, to ensure an install. We can't have a mixed environment of 2010 and 2016, mainly from a support headache point of view. Thanks again, James

SCCM here, love it until we have a new type of computer, then its install, add driver, reinstall, add x, reinstall, add y, etc ad infinitum! Hoping the mention of DoubleDriver above will help things. Oh and bonus of "free" AV(and control of Defender on 10) paid for it, Symantec were not happy to not receive their multiple thousands of AV tax pounds that year

Evening all, Whats the best way to deploy an Office 2016 upgrade to all users, and have it do it at "Welcome" so they have to wait for the upgrade before getting a desktop or not give any access to desktop till its done? I don't want to give them the choice! Usually I deploy applications with SCCM, but not sure how it would work, as the first thing users do is open an office application. Even if I tell them not to(Outlook is Office, who knew!!). If I advertise the upgrade, then they would get policy after logon + x minutes, then it would start while they have office open, or is there a tick box for do it at login on next login and wait till its finished? We are currently on 2010 and have access to SCCM with MDT integrated and have full AD. I'm sure I did this in the pre-SCCM days when we went 2007 to 2010, but time has passed and the past is misty! Thanks in advance, James

Good evening learned people, I have a strange one! I have setup directaccess and sstp vpn on a 2016 server, which works great out of the box when accessing the immediate subnet. I am now trying to route to our various external sites(different subnets) and DMZ subnets, which are connected to or are on our Sonicwall NSA firewall. I have added the static routes using the gateway address of the SW with the default metric of 256(this could be wrong?) 192.168.xy.0,255.255.255.0,192.168.x.200,256 where xy is the remote subnet and x is our local subnet. This didn't work, I could still only access the local x subnet. I then thought I'd turn on IPv4 routing in the RRAS console, made sense in my head! But while the vpn connects, I now have no local subnet access at all. Everything looks fine in the console, logged in person, no errors, etc. I then unticked the IPv4 router and I still have no subnet access! Does enabling the router turn something else screwy I don't know about? The only way back to a single subnet accessing working VPN is borking the server and starting from scratch, so back to square one! Any networking RRAS gurus got any tips or pointers in how to get RRAS working over multiple remote subnets and DMZ addresses? Thanks kindly, James

We have just purchased 4 Watchguards, 2 M300 and 2 M500. We are moving away from Sonicwall units. We used to be a Watchguard system years ago, but SW looked like a better bet at the time, then Dell bought them...

Thanks for the mention of DoubleDriver @dblight I've been looking for something simple like that, for our more exotic PC's!

yeah no problem, always happy to help!

Yes works fine for me! I can download anything on the page, do you have any filters blocking you?

I know SCCM feels like a faff to begin with, but when it is set right, you have all your clients in it, collections set up for rooms/departments/tests whatever, all the drivers you need, deployment is a breeze. Make a TS, test TS on a PC, iron out any crinkles(usually an app or package not distributed), then build those PC's! I especially like the system where you can create standalone media, ie distribute everything in a TS to a memory stick, and just boot from the memory stick and let it build with no network access. Perfect for small rooms with crappy network, and easy to keep in the pocket for those, "f**k it, can't find the problem, just rebuild it" situations!

When you deployed it to the collection, did you make sure to select PXE from the drop down box? You have to explicitly tell it what kind of client can use it, I think its the third choice which includes clients and PXE. As long as the client you are PXE'ing to is the client in the collection it should work, boot to PXE and F12 to boot, if you don't get the F12, then it isn't the right client. You can check by pressing pause on the PXE boot initial DCHP transaction(ie the keyboard pause) and note down the MAC address, then go into the SCCM console, right click on the client and Properties, and double check they are the same.

You have to add the computer from devices into a collection, then deploy the TS to that collection, I usually make one called Test, also making sure you make it is available to PXE clients in the drop down box in the deploy wizard, and stay away from Required, just keep it Available. Also make sure you click on the TS itself and distribute it, so it is at the required DP, sometimes just having the component parts distributed isnt enough, but distributing the TS itself makes sure all dependencies are there.

It usually has to be a completely new VM, as unknown is a computer with no known MAC address, not name or IP, if you have recycled a VM that had a MAC known to SCCM, it doesn't treat it as unknown, if that makes sense?

0x80004005 is a rather generic error! Have you got the right drivers injected into the boot image? Is the BIOS time correct? This is before any task sequence is selected I assume, so shouldn't be a dependency not distributed. I would look at having the correct drivers for the NIC you are deploying to injected into the image. What kind of machine are you deploying to in your test? Have you tried deploying to a blank VM, if you have some kind of virtual infrastructure.

Good afternoon all, Not sure where this fits in technical, so thought I'd post it on general. We have a small team of people who go out and assess on site, and we would like to start getting them to check in when they return home from a safeguarding/wellbeing point of view. It has been suggested that they text their manager, but this has been deemed not quite good enough, what if the manager isn't available, single point of failure etc. Then WhatsApp groups were mentioned(which we block for social media in our centres). does anyone else have this kind of situation, and have a solution? Doesn't need to be all singing all dancing, just a way they can check-in at the end of their roving about, so everyone knows they are safe. Thanks James

+1 for OSTicket here too, does everything we need, hosted on one of our Centos7 HTTPD servers, AD integrated, use it for IT and Maintenance tickets

I just port forward all relevant ports locked down to Gamma on the IP I gave them and pass them to my internal FreePBX box, so 5060 and 4000-60000. Works fine and I have a Sonicwall....(Notorious sip killers) Also note that you might get calls coming from an IP adjacent to the one given by Gamma... I find our 2 gamma trunks use 2 IP's each not just the one given.

https://365lab.net/2014/04/15/office-365-assign-licenses-based-on-groups-using-powershell/ This may help, extracts users from a group and splits the members, then uses Set-MsolUser and Set-MsolUserLicence to apply to each group member

I think Get-DistributionGroupMember is only for exchange/O365 mail distribution groups and I'm not sure it would output what is needed for the script into the variable

http://www.edugeek.net/forums/cloud-services/157567-password-management-office-365-a-2.html See post #17 for my auto script that takes a list of students/staff etc from a CSV (created by SSIS from our home developed MIS in my case) and auto creates an account and assigns a licence to them and sends them an email with their username and password. It also checks O365 to make sure it isn't trying to create an address already created. HTML is a bit crappy, but has been updated many times since this post in 2015! It also now reassigns an alumni exchange online licence to a student when they are no longer studying, so we can keep in communication for CPD etc. Not sure its any use to you, but there it is! Bit of hands off admin

We get the odd(and I mean odd. single numbers in a month or less) Zero hour ones, but O365 soon kicks in and kicks them out. I have it blocking encrypted Zips, EXE and malicious scripts in email anyway, so even if they did get through....hopefully our unprotected would be safe too.

I run a script every morning that looks for unlicensed staff or students then powershells them into licence submission the student script even emails them the details. Love the no admin for this one