gshaw

GPP seems to be working OK on my test machines this far, adds about 10-20 seconds to login times with mandatory profiles (MS sysprep methods) as far as I can tell (using HP UPD driver). Printers on a 2008 R2 VM with x86 drivers added on. We apply it as a User Policy but looking at the Computer's OU to find which printer to set as default.

Interesting, I'm testing Win7 at the moment and have a mandatory profile with folder redirection and various Preferences (printers etc)... from powered off I get to the desktop in just under a minute (so that's BIOS, boot, profile, GPO, GPP etc). Only thing that might be different is that my redirected folder already exists as opposed to being auto-created on logon... not sure how much difference that makes. Made our mandatory profile on a VM via the MS-supported method then when I want to make changes I just revert to the snapshot I make before running sysprep, rinse and repeat as many times as you want The only thing I do differently to the MS method is I keep the profile machine off the domain (stops accidental contamination with GPOs) and copy the resultant mandatory profile in two stages... first locally to the VM's C: drive then grab it via the admin C$ share. Reason being I found it doesn't like copying up in one stage when not on the domain.

Will keep an eye on this, doing a blog has been really useful for me as a) a technical showcase and b) a reminder for how I've done stuff and where I've put things (already re-downloaded some of my own Moodle themes 2-3 times since

Having fun and games setting this up at the moment as well, see post in Networks section

This is beginning to drive me nuts so hoping someone can help shed some light on the matter I'm trying to set up wireless laptops via RADIUS so we can have effectively the same look and feel as a desktop machine i.e. automatic logon to the domain, applying GPOs, profiles etc. Have been trying to get my head around the numerous ways of defining PEAP etc and seem to see two methods... EAP-TLS... machine certificate used for authentication cert is auto-enrolled via Group Policy PEAP-MSCHAPv2... uses the user credentials to connect (although there seems to be a Computer Account option as well) There also seems to be PEAP-EAP-TLS, which as far as I understand is a slightly more secure version of EAP-TLS? Have been trying the EAP-TLS method but not having much joy - created Enterprise CA - set up auto enrolment for clients and the NPS server as per NPS Server Certificate: Configure the Template and Autoenrollment and Deploy Client Computer Certificates - create a GPO for the wireless settings, used "Microsoft: Smart Card or other Certificate" as the authentication method (I believe this is EAP-TLS?) - set up the NPS server using the wizard, matched the Network Policy to use the same "Microsoft: Smart Card or other Certificate" authentication method - set up Ruckus AAA server as "RADIUS" and configured NPS with the ZoneDirector IP address and shared secret Logged in as Local Admin on one laptop and tried to connect to the wireless, logic being it should connect as it's authenticating as the machine doing the auth... just sits there saying "Attempting to Authenticate". On the XP SP3 laptop packets go back and forth but on the Win7 it's 0 sent \ 0 received. Checking certificates store on both laptops shows machine certificate in Machine\Personal store and CA cert in Machine\Trusted Root Certification Authorities Annoyingly I'm seeing very little in log files on the NPS server or on the client, seems like you have to dig quite deep to get anything of use... time for Wireshark? Also noticed this when using machine authentication, do I really need to make these changes just to get EAP-TLS to connect? http://support.microsoft.com/kb/929847 Any ideas for where I'm going wrong as I can't see it at the moment?

I like the Aero look and it's not exactly causing a problem to my gaming spec PC, nor did it to an x100e basic business netbook so it's hardly that much bloat, losing it takes away much of the slickness of Windows 7 No sign of quick tile theming or background images for the Start screen, both of which would make it much less garish and insulting to the eyes, hardly a difficult set of features to ask for is it? Are we meant to be grateful that MS allows us to specify which 2-bit pattern we can have instead??? Still missing jump lists and not seeing an efficient replacement on the Start screen, also found the Live Tiles very distracting and turned them all off after about 2 minutes of installing. I'm still yet to find one feature in the new UI that's more efficient on a desktop \ laptop than what I have now...

Hehe the joy of subnet calculators, network tech's best friend

One snag is that the current subnet is 10.0.88.0/24 rather than what you might expect as 10.0.0.0/24, hence the /16 leaves 10.0.88.x in place. Yes the VLANs are the better solution and yes it's where it will go once we have a larger network redesign (already starting on this getting FIM etc in place) but if I do that now it's going to give a headache with the other network that's also running at the moment. Will need routing setting up on the core then making sure only the teaching VLANs can communicate with each other... a lot of work for a temporary fix. Too many changes in one go for this summer with everything else going on tbh. Using the /23 suggestion I could have 10.0.88.1-10.0.89.254? That'd do us for now

Upgraded to Windows 8 Release Preview yesterday... still don't like it Horizontal scrolling is so irritating if not using a touchscreen, even worse on a touchpad!

Maybe the UI is meant to be deliberately bad so you install the Core-equivalent GUI-less version and remote manage it

Saves a fortune in support costs vs Backup Exec as well!

Now we're on VMware I keep everything separate... whereas before I had a "management server" that had all the irritating apps like door control, photocopier accounting etc they all get their own VMs now. Less chance of something conflicting (usually IIS) and gives a bit more control for upgrades etc.

Fair point, only reason for the /16 was that it wouldn't need any IP addresses changing but seems the negatives might outweigh that... back to the drawing board for a bit methinks...

You'll need the RDS External Connector for external users if you go down the RDS server route I think. Have you looked at HAP+ on here? Seems like it would do exactly what you need...

Not sure which method is the best for this one, here's my setup... - Ruckus 1100 with 12 APs - primary wireless I need is for my Teaching Network, same VLAN as our desktops i.e. desktops and laptops give exactly the same access and user experience - will also be creating additional VLANs for guest wireless etc with appropriate segmentation and firewall policies - Teaching wireless clients to be authenticated by RADIUS - RADIUS server being in the Teaching Network suggests that my ZD needs to be on the same network (or have access to it) I have the Ruckus APs on gigabit uplink ports on my switches... this is where it gets interesting. The Ruckus ZD sits on our Teaching Network on an untagged port as any other client \ server would. Which of these would you go for (using HP Procurve btw)... a) set AP switch port as untagged for Teaching Network and therefore WLAN setting as no VLAN tag b) set AP switch port as tagged for Teaching and change Ruckus AP management VLAN c) segment Ruckus management into entirely separate VLAN (but this will probably need to be routed for Ruckus to be able to speak to the RADIUS server?) Option a) is neater from a switch config point of view in that the uplink ports stay tagged for all networks but makes Ruckus auto provisioning more difficult (doesn't really matter as all the APs are in now) Option b) is easier for any future additions or AP resets. Option c) is part of a grander future plan but not taking on a network redesign whilst changing over to new desktop OS and VLE version this summer Probably not much in it I guess?

Thanks for the replies so far. Just to clarify it a bit... @SuperfluousAdjective yup it's a 10.0.0.0/24 which is pretty much on the limit for hosts at the moment. Granted the /16 isn't ideal but should do as a sticking plaster just to see us through for a couple of months. The multiple /24 VLANs with routing is my ultimate aim, along with removing the two networks but this depends on business processes changing for me to be able to use a single AD (it's complicated ) Don't really want to mess with routing across VLANs this summer, first part of the wireless is just to extend the network to our institutionally-owned laptops so those can drop in with the standard desktops for now. Have already created an additional non-routed VLAN for guest access with isolation policies etc. Not too much of a problem to change VLAN settings as it's a managed Ruckus system

Better cars with more focus on safety (pedestrian and passenger) will be a major part of it. Increased number of airbags etc will mean you have a much better chance in a crash than you would've had with say a mid-90's Fiesta compared to the equivalent today...

Simple solution for IT geeks, change the bitmaps on your Tomtom etc to pictures of trees or something equally stealthy so anyone looking at it won't know the alerts are still on

There's an amazing way to run someone over as well... - check speed limit constantly for sneaky changes in limit, temporary roadworks etc - stare constantly at speedometer to make sure you haven't gone 2mph over - miss car \ child \ donkey walking out in front of you - clear entrails from front grille, replace front bumper I've always wondered why cars don't have an extra instrument in the dash that knows the limit of each road and changes your dials colour \ image on screen if you go over. Just seen one or two that have started doing it now, one for the inventions thread maybe Then again as we all know, speed cameras are naff all to do with safety but just how much more £££ Governments can extract from motorists. Personally I prefer the Clarkson method of dealing with Gatsos... nothing a good blast with a rocket launcher can't fix

Just need to check my logic on this one... I've got two networks at the moment... admin on a standard Class C /24 which is fine for what it is at present, then a teaching network which bizarrely has a class A subnetted as a C (no idea why) Problem being we've hit 200 odd teaching workstations, 20 odd printers, wireless going in and laptops going onto the network so 254 hosts is going to run out of room very soon. In the long-term I want to merge both networks together and use a bunch of /24 VLANs routed via our 5406zl. That won't happen just yet due to some other issues so need to do enough to keep the teaching network going for a while longer. So to keep amount of reconfiguration as low as possible I'm thinking of changing the mask to 10.0.0.0/16 so I get 65534 host addresses. In theory as well I should be able to leave servers etc with IP addresses as they are (10.0.88.x) and just change the subnet over to /16. Then just make a new DHCP scope anywhere within that range (need to migrate the role to a 2008 R2 VM anyway). Seems like changing subnet doesn't affect DCs etc as much as shifting IP addresses so apart from the manual re-config of printers etc shouldn't be too painful. Input and experiences welcomed

Depends on what compatibles you use... ours are supplied from a company who does the refurb work themselves and they also do printer repairs as part of their business. If one of their toners causes a printer fault they come and fix it. Saved us around 50% on the cost of HP toners. I'd like to move to Papercut or similar for printer monitoring and in time replace more of our admin printers with MFPs... not so sure about the classrooms as there are issues using a shared devices with students \ teachers leaving the room to collect print outs.

I took all the covers off in the end as they were a right pain, they're just a clip so pull them directly downwards and they'll come off, don't remember any of ours snapping but they did have a habit of falling off at random intervals

Tomorrow's article headline... "upgrading to Windows 8 gets you 10 x more girls" Not entirely convinced by the stats but there are certainly features in 7 that make life a lot easier. From an imaging point of view it's streets ahead of XP, even simple things like native support for the Intel AHCI controller saves a lot of time. The 7 usability features are quite subtle but work well (Aero snap etc) although from a support perspective some of the dialog box updates are a bit clunky (e.g. printer settings & network sharing center over complicate things) but compared to the sins of Vista it's a small grumble compared to the positives of 7. As for 8... well... it's a real marmite OS as it stands, I wonder who will be brave enough to go for it on a primarily desktop estate. I doubt those who made the Vista jump early will want to have their hands burnt again...

Agree, once the Public locations are out the way I'll tolerate the rest in order to stay supported, likewise with roaming profiles \ Sysprep... Edit: just did it from the Windows GUI and copied the resulting files across into the mandatory profile

2 years on from this thread, what are people doing with Libraries now? a) disable completely (does this affect anything else?) b) customise the library file to remove the Public locations c) something else?