burgemaster

Finally sorted. Had to recreate the staff_default_policy. Looks like it may have been corrupt at some point. Now all working. Turned off the proxy with GPP and set the PAC with GP Thanks for the help.

test PC is now in a new TEST OU, only GPs that are applying are the "Default Domain Policy" and the "Smoothwall Proxy" GP.... This works, looks like i need to slowly add them in one by one.. GPUPDATING each time..

Thanks for that... But it didnt help.... Grrrrrrr Problem: My old tech manually entered the proxy settings into the "Default Domain Policy" instead of the "Apply Smoothwall Proxy" GP.... When I came in next morning and tried to remove them from the default domain policy and add the changes to the correct GP, everyone was getting blank proxy settings!!! PANIC no internet for the whole school.... so for the last few weeks ive left the settings in the default domain policy.. We have now moved on to using a PAC file instead of entering the details manually. But now the same is happening. I've tried right clicking on the "Connection" folder and "Reset Browser Settings" but this hasnt worked. GP result says that the settings are being applied buy they just arent! I have some machines that are pulling the old proxy settings from somewhere but there is nothing in the GP results... so confused Can anyone please help?

I need to clear the old proxy settings that were previously set on the "default domain policy". Im sure that there were two places it could be set and the 2nd one gave a warning saying "These settings will override any settings set in...." 1) User Settings > Administrative Templates > Windows Components > Internet Explorer 2) ? Can anyone please help?

Morning all, Our Dept head has discussed that if he wrote a text book in school during work hours when he was being paid to do it, the school would retain full "Intellectual property rights" of the textbook if he was to leave. Does this also apply to a School Website or a home grown "School Learning Portal / VLE" ????? These both are based on WordPress with free plug ins. He would like to know where we stand. Our technician spent hundreds of paid hours creating these, his question is what is to stop someone else or our old tech recreating this in a few minutes for another School? The hours of development was done here whilst being paid by the School. There is no copyright in place, and as everything is based on free software, does anyone have an idea where the School stands? Thanks in advance

On a whole, I think we are taking about support here not snooping, I doesn't matter if a user knows that we have remoted in or not there will always be a valid reason.

Can you rdp into an a users session then? Without permission? This is how we do it on our terminal server with ts manager. Can you do this with win7 too? Thanks

Surely asking for permission is a huge hassle? What if you want to grab a few computers to test something on? Maybe we need to look at our windows 7 ultraVNC installs as other don't seem to have a problem! Glennda - sorry for confusion

Great thanks, I read glendas post as she has the same problem with tightvnc! ! Will try in the morning. MSI? ?

I wonder if anyone has already done something like this: We have several displays or screens around the school, they are plugged into a full size old noisy retired desktop pc stored away somewhere.. they run XP and automatically login and display the "intranet" webpage etc.. BUT... I was wondering if there could be a Linux solution? we could even possibly replace these PCs with a raspberry PI, saving power, space, hassle! Thanks in advance!

We have been using UltraVNC with XP for years and its been perfect. I wouldnt say the same for windows 7. It regularly freezes and crashes when connecting or while connected, it crashes out whenever you log off or switch users. It also sometimes LAGGGSS really badly meaning you have to disconnect or click the refresh button to see what your doing Has anyone got a better solution to VNC into windows 7 ?

Everytime i see a computer monitor on the TV in the background, I always have a little glance at what OS they are running. They all seem to have windows XP (and 99% have same dell cut out keyboards)... NHS - every hosptial ive seen The Police British Gas the TA Army the BBC (news) Fire Service - even in there new build super station Watchdog Mythbusters All banks ive seen. a nuclear power station on the news ........ the list goes on... I never see a windows 7 login screen. Makes me feel a little better about the fact that we are still predominately windows xp!! Does anyone see windows 7???

It was as simply as an IIS reset! Thanks

ok, problem 2 is sorted.... To get OWA/Webmail to use the correct SSL, The correct SSL needs to have IIS enabled on it under services. Enable-ExchangeCertificate – Thumbprint “9E1B647EA0BAD8ACxxxxxxxxxxx6B4478A5CCB” –Services IIS This sets the IIS service to the correct SSL for OWA use, where as it was previously listed on the self cert.... Now just the security popup....

We have 2 certs, one purchased from from Geohost ({autodiscover.{school}.sch.uk, webmail.{school}.sch.uk} and a self-signed cert. {mail, mail.{school}.local} I've just renewed our self-signed SSL certificate as it had expired. I used the command "Get-ExchangeCertificate –Thumbprint “XXXXXXXXXXXXXXXXXXXXX” | New-ExchangeCertificate" This worked fine..... But now we are getting popups saying "webmail.{school}.sch.uk - The name on the security certificate is invalid or does not match the name of the site" at school and also now when we try and access our OWA (https://webmail.{school}.sch.uk), it appears to be using the self singed cert instead of the GeoHost cert? Ive run through http://support.microsoft.com/kb/940726 and this hasn't changed anything. Here are the results from: Get-ExchangeCertificate |fl Get-WebServicesVirtualDirectory | fl Get-ClientAccessServer | fl Can anyone please advice what I have set incorrectly?? AccessRules : {System.Security.AccessControl.CryptoKeyAccessRule, System.Security.AccessControl.CryptoKeyAccessRule, System.Security.AccessControl.CryptoKeyAccessRule} CertificateDomains : {mail, mail.{school}.local} HasPrivateKey : True IsSelfSigned : True Issuer : CN=mail NotAfter : 15/03/2013 11:03:04 NotBefore : 15/03/2012 11:03:04 PublicKeySize : 2048 RootCAType : None SerialNumber : 16C35989EB2BDEB14623F89348ED650D Services : IIS, SMTP Status : Valid Subject : CN=mail Thumbprint : 0437788E65A3652B83A7CD25C143A650709E2F73 AccessRules : {System.Security.AccessControl.CryptoKeyAccessRule, System.Security.AccessControl.CryptoKeyAccessRule, System.Security.AccessControl.CryptoKeyAccessRule} CertificateDomains : {autodiscover.{school}.sch.uk, webmail.{school}.sch.uk} HasPrivateKey : True IsSelfSigned : False Issuer : CN=GeoTrust SSL CA, O="GeoTrust, Inc.", C=US NotAfter : 06/03/2014 08:59:05 NotBefore : 02/02/2011 06:42:39 PublicKeySize : 2048 RootCAType : ThirdParty SerialNumber : 60A4 Services : IMAP, POP, SMTP Status : Valid Subject : CN=autodiscover.{school}.sch.uk, OU=GT94688674, O={school}, L={town}, S={county}, C=GB, SERIALNUMBER=XXXXXXXXXXXXXX/ Thumbprint : 9E1B647EAXXXXXXXXXXXBE4546B4478A5CCB InternalNLBBypassUrl : [url]https://mail.{school}.local/ews/exchange.asmx[/url] Name : EWS (Default Web Site) InternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated} ExternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated} BasicAuthentication : True DigestAuthentication : False WindowsAuthentication : True MetabasePath : IIS://mail.{school}.local/W3SVC/1/ROOT/EWS Path : D:\Program Files\Microsoft\Exchange Server\ClientAccess\exchweb\EWS Server : MAIL InternalUrl : [url]https://mail.{school}.local/ews/exchange.asmx[/url] ExternalUrl : [url]https://webmail.{school}.local/EWS/Exchange.asmx[/url] AdminDisplayName : ExchangeVersion : 0.1 (8.0.535.0) DistinguishedName : CN=EWS (Default Web Site),CN=HTTP,CN=Protocols,CN=MAIL,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN={school},CN =Microsoft Exchange,CN=Services,CN=Configuration,DC={school},DC=local Identity : MAIL\EWS (Default Web Site) Guid : 3f902766-008a-47d5-9ab1-9b426fa049b1 ObjectCategory : {school}.local/Configuration/Schema/ms-Exch-Web-Services-Virtual-Directory ObjectClass : {top, msExchVirtualDirectory, msExchWebServicesVirtualDirectory} WhenChanged : 15/03/2012 12:37:09 WhenCreated : 31/07/2007 14:46:49 OriginatingServer : DC1.{school}.local IsValid : True Name : MAIL OutlookAnywhereEnabled : True AutoDiscoverServiceCN : mail AutoDiscoverServiceClassName : ms-Exchange-AutoDiscover-Service AutoDiscoverServiceInternalUri : [url]https://mail.{school}.local/autodiscover/autodiscover.xml[/url] AutoDiscoverServiceGuid : 77378f46-2c66-4aa9-a6a6-3e7a48b19596 AutoDiscoverSiteScope : {Default-First-Site-Name} IsValid : True OriginatingServer : DC1.{school}.local ExchangeVersion : 0.1 (8.0.535.0) DistinguishedName : CN=MAIL,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN={school},CN=Microsoft Exchange,CN=Services,CN=Configurati on,DC={school},DC=local Identity : MAIL Guid : 83fdfee1-eb98-4942-b34e-e0e103b59757 ObjectCategory : {school}.local/Configuration/Schema/ms-Exch-Exchange-Server ObjectClass : {top, server, msExchExchangeServer} WhenChanged : 15/03/2012 11:03:49 WhenCreated : 31/07/2007 14:40:33

Have you looked at deploying printers via GPO instead of GPP? We tried using GPO to deploy the printers but this was limited and the removal seemed impossible, it seems to store settings in the profile. When a printer was replaced there were always problems. Also you could not set a default printer. It worked great for XP, but not so good for Vista/Windows 7. Ive now split our one large GP down to individual GPs, and changed the server address from "PRINT" to "PRINT.domain.local". I now seem to be getting 2 sets of the same printer... will keep at it.

I am now splitting our one "Map Printers" with 48 printers in, down to 48 individual GP objects that will apply to OU`s.... This really is GPP`s last chance!

I have really tried with GPP printer deployment, but windows 7 machines just seem to randomly hang at login at "Processing Group Policy Printer Policy" today for a record 45 minutes! Has anyone please got a decent old fashioned login script to map printers. Working with windows 7 and If possible also with event logging? In our group policy to deploy the printers we have all our printers deployed in one large policy at the domain root with our domain default policy, then the printers are assigned due to the OU or security group etc. (See screenshot). Do you guys have separate GPs for each printer? Is this the way that other have successfully used GPP to printers? Have you turned off UAC? Thanks in advance

We have regular powercuts, occasionally leading to win7 machines deciding to repair themselves at startup! This as a computer startup script sorted it for us: Disbale_Repair_Win7.bat bcdedit /set {default} bootstatuspolicy ignoreallfailures

The XP profile for me does the same for me. GPs dont apply on it for some reason.

Thank you all for the replies. GREED - This is exactly how I would like it to be, I really want him to gain something in the year that he is here. Thanks all.

Thanks Ben, I guess I am jumping the gun a little. I forget we will have to be first showing him how to clean projector filters and change toners first. But we only have him for a year and I really don't want him to leave us after 12 months without the learned skills to get a great tech job somewhere instead of being as some teachers would call him a "Toner Monkey" . Oh well nothing like planning in advance!

We have a very strange problem that has been around since we created the domain, if anyone is added as a local admin to any computer at any point, then roaming profiles just stop working on any other future computers for them until their AD account is recreated, I have no idea why and there are no errors, the replication back to the server just doesn't happen! Luckily now as the bursar`s use SAP, we don't have anyone in the school that needs to be a local administrator or power user! Thanks for replies

Thanks, Students reset their own passwords and if they cant manage it themselves staff do it for them, we use "Self Service Password Reset" which is a great edugeek project I will set him up as glennda suggested and maybe have a read of the 114 page, "Best Practice Guide for Securing Active Directory Installations.doc" tomorrow!! I did start to read about setting up "service administrator" accounts and thought that someone might have already done this and have a great set for a beginner. Thanks again

Can anyone please suggest AD account permissions for an apprentice technician we have starting? Sorry if this appears lazy, but as I'm sure many of you have been through this before. Previously there has only been an experienced technician and a network manager, we have just been full "domain administrators".... Obviously I know it depends on what roles we wish them to be able to do, but could anyone please suggest what set-up they may have for there trainee technicians? I do not want our computer/user accounts deleted whilst he is learning! Thanks in advance