wrights

>https://www.duosecurity.com SMS2 will do exactly the same functionality for free, Remote Desktop Services will require either pGINA as a linked to above (also free) or Microsoft's Threat Management Gateway software.

Yubikey should work fine as an authentication device. Using the admin console in SMS2 you can specify a manual OATH-TOTP shared secret, using the Yubikey personalisation tool you can load the same shared secret on your Yubikey. As I understand it you'd need the Yubikey TOTP application installed on the PC, when you reached an authentication screen (in my case the Citrix Web Interface logon screen) you'd doubleclick the Yubikey TOTP application in the system tray and it would query the key and paste the correct code into the token box on the screen. Steve

I've never used it but pGina allows you to use RADIUS for Windows Login, so this should work perfectly with SMS2. If you setup pgina let me know - I'd love to document it and put that on the site for everyone else interested.

Hi, I hope this won't be regarded as advertising (as I'm not charging anything). I've been into loads of schools in the last few years installing XenApp / XenDesktop and two factor authentication seems pretty rare (despite BECTA saying it was a requirement if SIMS and similar were published). My guess is that this is down to costs - £45 - £110 per user isn't going to fly if you have 100 members of staff and 2,000 kids. To solve the above I've written a two factor platform that you're welcome to install for free. It works on XenApp/XenDesktop, SonicWall, etc (pretty much anything. The website is WrightCCS - - Citrix two factor authentication As above, no cost, install it, use it, don't pay for it. It supports hardware tokens (I got mine from Gooze.eu for about 9Euro), software tokens on the iPhone/Android/Blackberry (free), text message (you pay for the texts - the beta version will allow you to use any provider), and in the beta release it also supports voice call authentication (via Twilio). The admin interface does single signon and runs over the network so you'd install the software and publish it via XenApp (or install it anywhere you want) and logged-on users can update their own details. If anyone is interested let me know and I'll give you some help to get it installed (free). Steve

You'll get about 50 VMs running on just 8 disks if the write cache IO actually hits the drives, using something like ZFS L2ARC technology should allow the IO to take place on a solid state disk which allows massively more IOPS and hence substantially decreases the number of normal drives required. The solid state disk wouldn't need to be very large, we'd normally be deleting the write cache when a user logs out.

Multiple PVS (Provision Services) servers can run on the same subnet to allow for failover, when you do this they need shared storage to prevent both PVS servers having to have copies of the VM disks that are being provided. It is quite normal to use two Windows servers with a standard CIFS repository and data (the VM disks) duplicated between the Windows servers using DFSv2, thus the PVS servers don't actually have any real IOPS load. The IOPS load on the Windows servers is read heavy, and as the servers are ideally dedicated and do little other than provide the VM disks the frequency of disk hits can be reduced by increasing system ram available as a disk cache. PVS will also allow you to cache data on the VM (great if you are booting on physical hardware rather than VMs, or deploying XenApp) and to separate the temporary file location (which is write heavy) from the data store used for VM disks (which is read heavy). Believe it or not you don't actually need a lot of hardware for a large scale deployment, the key really is to keep the number of VM disks in use to a minimum and ensure ram is available to decrease hits to the disk. I haven't tried it yet but Sun's ZFS L2ARC technology should really help PVS and further reduce disk requirements.

Keeping traffic such as iscsi separate from the other data by using dedicated interfaces is definitely the way to go. If you have other traffic that doesn't need dedicated NICs and is isolated into VLAN for network management reasons you can configure the bonded interface to support this. Select 'add network' after creating the bonded interface, select 'external network', and create a new virtual 'external network' specify the VLAN number that it should use, and that will allow the bonded interface to support that VLAN.

At the bottom of the screen you will see "management interfaces" with a button to configure, press 'new interface' in the bottom left, add a second management interface using the network that relates to the bonded NICs.

Sorry to bounce an old thread but hopefully it will help when you come back after the Christmas break. If you create a "MyCitrix" account (http://www.mycitrix.com), login, select "Product Previews / Beta releases - License Retrieval", and choose "XenDesktop Evaluation" from the drop down list you'll get a trial licence. After you have a trial licence your "MyCitrix" area will allow you to download XenDesktop - I think the trial is for Enterprise but if you don't deploy XenApp it's very similar. For most setups you would be better to look at Enterprise; a deployment of XenApp will allow you to stream applications into the XenDesktop VDIs so you don't have to maintain a collection of applications in each VDI, it will also allow you to publish a shared copy of commonly used software that runs on central servers thereby decreasing VDI resource requirements and making maintenance much easier.

If you have a Linux server available then a PEM file can be created using OpenSSL. What you actually need the mmc snapin or OpenSSL for is to password the key, if it is already passworded then copying and pasting the certificate and key into the same file will usually work fine. The CAG will not accept the PEM file unless the key has a password.

Citrix Secure Gateway is a Windows application, Citrix Access Gateway (CAG) is an appliance; the process for updating the SSL certificate differs. The CAG's (new) certificate can be uploaded via a browser on port 9001, it must be in PEM format and have a password. A PEM format file contains both a certificate and a key that relates to that certificate, you can produce such a file by exporting the certificate and key from a windows server using the certificate mmc snapin.

Difficult to say if thin clients will work without knowing what software you're going to run, what are the plans? Tizzy's Tools? I would definitely look at NComputing's X550 series devices if the computers will be sitting in small clusters.

This may also help Cool Things to Do with Netsh

I think you will need to script it, the script would look something like this: netsh interface ip set address "Local Area Connection" static 192.168.0.1 255.255.255.0 192.168.0.254 1 netsh interface ip set dns "Local Area Connection" static 192.168.1.200 primary ipconfig /registerdns

It might be worth connecting Wireshark to one of your network ports and looking to see where the incorrect DHCP replies are coming from. If you can see the other DHCP server's MAC address then you can connect to the edge switch and start tracing back the route packets are taking from your end device to the server, you'll pretty quickly discover how it is connected.

If the DHCP servers aren't dual homed and the config hasn't been changed on your switches then my bet would be on someone connecting the two VLANs together with a misplaced network cable.

I've deployed HP wireless solutions before. We were using 210 access points with a modular controller in a Procurve 5108xl. It works extremely well and is very easy to configure but the licensing isn't cheap. If you'd like to see a site running then I can probably arrange a demo where I used to work. The HP wireless solution was stable enough to support not only laptops but Mitel phones.

The NComputing devices mentioned earlier could work really nicely for you. The X300 and X550 will let you share one physical computer to multiple users each with their own screen. Using the non-network version of NComputing's kit graphics performance seems extremely good, and it's not all that bad on the network version either. Good system imaging may allow you to extend the computer's life beyond five years. If each of the PCs were to boot from network or be automatically reinstalled on a schedule then hardware faults should be quite easy to detect and repair. Wyse have some good software allowing network boot. Where is the bulk of your budget going? Servers, network switching, or desktops? I believe Neverfail and DoubleTake both do educational licensing. It might be worth looking at reasonably low cost servers with low cost Enterprise grade H/A rather than high cost servers that are far less likely to fail. In terms of supplier you should talk to Axess Systems (0800 023 2226), they are one of the UK's top desktop virtualisation suppliers in the Education market and can advise on Citrix, NComputing, VDI, etc.

I've just been certified as an MCT and am looking to get some training experience. If you're interested then this is your chance for official Microsoft training at the low, low price of next to nothing. I live near Leeds and was thinking about renting a training room in the city centre and offering some 2-3 day courses over 2-3 Saturdays. I'm open to suggestions but was thinking about offering something like Microsoft's 5115 (Windows Vista) or Microsoft's 2285 (Windows XP). The more people (if any..) who are interested the cheaper this would be for you. I'd like to claw back a little towards my own training costs (£40-£50?) if I can but would otherwise just be splitting the cost of room, and materials between trainees. Please let me know if you're interested. Thanks. Steve http://www.microsoft.com/learning/en/us/syllabi/5115A.aspx Installing, Configuring & Administering Microsoft Windows XP Professional

I run the IT for an independant school in York. We could do with a company (other than Capita) that will provide external support for SIMS, can anyone make a recommendation? Thanks. Steve

We installed an MSA1500cs (x2 MSA1000 controllers, x2 MSA30s) to support ESX V3; I think our costs (we already had the disks) were approx £12k. The SAN is one of the best purchases I have ever made and is more than worth the initial purchase price. The SAN's reliability is considerably higher than DAS in each server, this has reduced downtime (and work for my people!). Disk Utilization is far improved as 'slack' unused space is no longer locked on each server and can be used where it is needed elsewhere. Management is simple (the SAN management software is very, very similar to the RAID management software on HP servers). Backups are a dream; ESX can pause a live running server for less than a second, lock the files that make up the disks while writing on going disk changes to a snapshot file, the files making up the disks can then be copied off to storage elsewhere. Instant crash consistant backups for non critical servers.

I've checked the pricing this morning and you're to far away (£10k install, approx £20k per annum)

Dan worked for me in Selby before he started working at Bootham, he left here just before I started, I think he works for IOKO365 on the science park now. Nice lad.

I run the IT at Bootham

I don't know, give me a call (01904 683797 - steve wright) & I'll talk to our account manager at NTL.