azrael78

While this may not be entirely relevant... I've managed to mostly automate a Windows XP/Vista/7 install using WDS/MDT2010/SCCM - it can just be done using WDS/MDT2010. If memory serves though you have to use the WAIK (Windows 7/2008 R2 version) and use Windows SIM (System Image Manager) tool to create your unattended XML files. These in turn can be used instead of sysprep.inf which 2K/XP/2K3 used - however the newer answer file format is much more robust - does include joining to domains and perhaps OU placement also. As for XP - I'm afraid you'd still have to use sysprep for this, but once you have the image prepped like you normally would (for something like ghost) - you can then switch over to using WDS which will treat the image as a flat image - just don't apply Windows SIM stuff to your XP build and it should just work. I'm not 100% what either of you are trying to achieve exactly - if you can condense it down into what exactly you'd like it to do, I can hopefully come up with a better answer for you Az

Can you provide more information on your DNS setup? You say you have 2 DNS servers each on a DC. Are these DCs the same - as in do they serve the same domain (as in PDC/BDC relationship) or is it 1 DC for 1 domain and 1 for another. If the former - your FQDN -> IP zones should be AD Integrated. You could then try this: 1) Remove the PTR zones from both DNS servers, ensure that after a stop/start of DNS, that no PTR zones exist. 2) Recreate the PTR zone on one of the DNS servers - set it as a 'Primary' Zone but make it AD Integrated (which means it's replicated between your DCs). 3) Ensure that the PTR zone is correct for your subnet and that secure updates are permitted. 4) On the general Zone properties page - ensure that replication scope is to all DCs in the domain. 5) Create some PTR records of your choice, either by updating your A records and then setting 'Create PTR records' or by manually putting some new ones in that match your existing A records. On the other DC - repeat the above - except for #5. When you refresh your second DC's DNS - you should find that it already has the PTR records you set on the first DNS (assuming that AD replication is all working) - this now means that both DNS servers have a copy of the same Reverse zone and it's replication is handed by the AD. Ensure that on both DCs your DNS servers are: DNS1 - 127.0.0.1 (DC points to itself) DNS2 - IP of other DC If you have 2 DCs and they DON'T serve the same domain/forest - try this: 1) Remove the PTR zones from both DNS servers, ensure that after a stop/start of DNS, that no PTR zones exist. 2) Recreate the PTR zone on one of the DNS servers - set it as a 'Primary' Zone but DO NOT make it AD Integrated. 3) Ensure that the PTR zone is correct for your subnet and that secure updates are permitted. 4) On the Zone Transfers page - enable Zone Transfers to 'only the following Nameservers' and put in the IP of your other DC. 5) Create some PTR records of your choice, either by updating your A records and then setting 'Create PTR records' or by manually putting some new ones in that match your existing A records. On the other DC do the following: 1) As above step #1. 2) Recreate the PTR zone as a secondary DNS zone - specify the IP of the other DC as the master for this zone. 3) As you set-up zone transfers earlier, it should transfer your Reverse zone to this DC. 4) If all went well, you should see PTR records in your reverse zone that you created earlier. I realise that this particular method isn't very nice in that you can only update PTR records on one DNS - you could get around this by installing DNS on a 3rd server - simply to act as the master for your reverse zone - then set both DCs to be secondary zones, so you only need change the PTRs on one server, however this will complicate your DNS setup a little. The other way to handle it would be to have 2 primary zones - 1 for each DC, but this means you'd need to make 2 sets of changes on each server and there isn't any replication between them to ensure that PTR records are kept up-to-date - but it depends on what you want, if you need the resiliency or not. Hopefully the above has helped somewhat - if you give this a shot and let me know - plus additional information regarding your DNS setup, I can give it a thorough look over during work tomorrow (we have a lot of DNS servers and I do have a perverse liking for DNS ) Az

Glad to hear you are okay mate - it could have been damned nasty. As has already been said - your car can be replaced - but you - cannot. I hope things pick up for you and work out for the best Az

Absolute class! Az

Hmmmmm We didn't have this particular issue - I did pretty much the same as you except used SQL 2005 (not Express). We updated the schema first, prior to installing. Once you configure client push - and then run discovery, it should automagically push the client out to the PCs it discovers - assuming it can. Check to ensure you have a network access account and a client push account setup so that it has local admin rights on the pcs you want to install the client. It also may not install the client on ALL PCs in AD - particularly if you have old computer accounts or the PCs are turned off... (as I'm finding out... hurrah) I too - like the site code, that's what I set my first SCCM install to - it was a test install so I wanted to give it a totally unique site code we would never use in production HTH, Az

I can't say anything about the Comptia stuff that Ken mentioned but in terms of MCSE/MCITP I'd strongly recommend going MCP -> MCSA -> MCSE -> Upgrade route. I'd recommend that because it will give you a solid grounding with XP/2003 in terms of what MS expects and how you will be tested - which will make you more prepared for the MCITP route, not to mention there are many places still using XP/2003 technology and may not see the need or have the funding to simply jump to 2008/Vista/2008 R2/Win 7. HTH, Az

While this isn't strictly an O/S deployment question - I wasn't quite sure where else it would fit. We currently run SCCM 2007 with WSUS 3.0 on Server 2008. We are looking at rolling out ForeFront using SCCM which is interesting to say the least - however what I'm curious about is how the rest of you handle Client Updates (WSUS). We currently have 2 WSUS servers. What we'd like to do is have ALL ForeFront updates automatically installed on clients - but only if they have ForeFront installed (I know WSUS can do this by itself - bear with me). We'd also like to be able to either install or push out additional windows updates as we see fit. Now ideally - we'd like to use SCCM to just push them out as we can with other software but the instructions on how we'd do this aren't clear. We could just approve the updates and let WSUS handle it - but we don't want it rebooting clients during the working day or scheduling the installs when the clients are turned off (hence - why we wanted SCCM to handle it). Is this asking too much of WSUS and SCCM? (We have 2 WSUS servers mostly because 1 of them was in-place prior to SCCM being implemented and now SCCM also hosts its own WSUS server) Any thoughts - ideas - anything useful regarding SCCM/ForeFront/WSUS ? Thanks, Az

Aha... I'm not sure you CAN do what you want with a single ISA. We have a similar arrangement where I work - 2 connections but we had to have 2 ISAs to do the job. Assuming you have a network that can control proxy settings in IE/FF or whatever other browser you may use - having 2 ISAs may well be the quickest and simplest way. Have 1 ISA that handles the bulk of the internet traffic - so it has 2 NICs, 1 for internal (the network) and 1 for the SWGFL connection. Setup a proxy on that ISA and then enforce the proxy for all users who MUST go through SWGFL. However - if you are using SWGFL, are you aware of a feature called 'staff proxy' - it does allow unfiltered internet access via SWGFL. You can't access it unless it's setup via your RM Safetynet page AND you have to give staff individual logins for the service. It may well be a more efficient route - perhaps put a smaller ISA on the DSL line and use it for an emergency backup line instead? You may not be using RM Safetynet but if you are SWGFL I'd imagine you would be - have a look into the 'staff proxy' option in SWGFL - it may well satisfy your requirements meaning you only need 1 proxy. We use our DSL line as a backup line incase any mission-critical stuff HAS to work via the net or if SWGFL's restrictions (not filtering) stops any mission-critical processes working correctly (such as accurate network time, some finance tools we use...). Az

I'm not hugely familiar with ISA 2010 - however I do know that I tried the same thing back with 2006 and there was no way I could actually get it to work reliably. However - you could try turning on the proxy services for the internal network and the DSL network objects, point the people you want at one proxy and the others - at the other. Combine those with using Integrated Authentication and some access rules and you should be all set. Just remember to put your most restrictive groups at the top. So if you have a group called 'IT Staff' - but it grants them the ability to use all traffic ports etc... then put that BEFORE any restrictive rules - so ISA doesn't mistakenly restrict someone who doesn't need it. Another example may be this: 1 - 'AllAccess' - Allow ALL Traffic - Only usergroups 'IT Staff' (etc) 2 - 'Locked' - Allow only HTTP/HTTPS Traffic - Only usergroups 'Students' (etc) ISA will take the first rule that matches, so if you had a student also part of an IT group - they would get the first rule - but that's highly unlikely and in this scenario you'd want certain users to have more privilege than others. Actually - rethinking it - not sure how you'd do it with 3 NICs as all users would be going via the 'internal' network. TMG may have some nice enhancements in it to handle this specifically but I doubt it - could you not enable routing (as in add a network rule for 'route') and then enable proxy on the 2 seperate LANs (not internal) and then add the appropriate route statements? I mean it all sounds feasible - can you give some more details on what exactly you'd like and what exactly you currently have setup? Are you in the position to be able to add extra ISA boxes or reconfigure the one you have? Hope this helps - somehow Az

Yeah it is - another thing you should double check is that your Local Admin account does NOT have the same password as your Domain Admin account. This is another way he could have potentially messed around with shares and NTFS permissions on the network - however in order to get that password, he'd either have to guess it, crack it or somehow take control of the account itself without a password change. I've never heard of anything except perhaps an NT Service able to run-as an account without the need for the password (SYSTEM, NETWORK SERVICE, LOCAL SERVICE). However that 'Do not store NTLM hashes' thing noted above sounds good - can't believe I overlooked it before now - will be turning that one on. Az

Yes I have tried version 7 and yes - your version 6 VMs should be fine - just remember 2 things: 1) Back them up BEFORE you start - just incase it doesn't go smoothly. 2) Remember to upgrade the VM hardware before you power on the VMs... that way the tools can auto-install and you can be ready to go after 1 reboot. HTH, Az

Ready for this list? I have a vast array of pets - while they aren't all mine - I will include them here Without knowing whether you meant current pets or past pets, I'm including all information I have. Rats: Psychorat, Mallow, Pest, Sweeney, Brownie, Sox, Sparkle, Stripe, Spot, Jay, Kara, Spooky, Alice, Sarah and lastly... Arwen. Mice: Maisie, Spooky-Mouse, Mabel, Harriet, Ying, Yang and Coffee. Pets that aren't mine (are my parents): Rabbits: Daisy, Bella, Oscar, Ozzie, Murphy, Harry, Sally, Blair Doves: Lovey. Semi-tame Pheasant - Phil. Lastly... Squirrel - Nutkin. As you can see - quite a list, some have stories behind them, some not. 'Psychorat' is because she was crazy, she didn't stay still and was generally hyperactive - lovely rat though. 'Sweeney' - she used to rip hair out by the roots. 'Spooky' - was purchased during one of the earlier series of Spooks. I hope this list is enough - if you need more information I'll be happy to provide it when I can Az

He's rather keep the whole 'restore from backup' facility inside the IT department as he doesn't entirely trust the end users to not restore over what they currently are working on. Az

I'm not sure I entirely understand what you are asking - however I don't think you can do what you are asking. In order for a laptop (or any device) to connect to a wireless network, it has to conform to whatever the wireless network requires - if the wifi uses WEP, then you have to setup WEP on the laptop, same for WPA etc. Having the laptop connect to the wireless network initially means that it can obtain it's IP information, which in turn will allow it to connect to AD and then allow the user to login. If I'm understanding what you want - you want the following: 1) Laptop to connect to a wireless network. 2) User cannot use wireless network without logging in. Assuming this is right - then all you need to do is set up the laptop wifi as the local administrator, join it to an AD domain and then the wifi should be available for the user - allowing them to login. Sound about right? Az

Thanks for this guys. Have been instructed by manglement to progmatically clear them as we don't want the users getting to them. (They can't really anyhow as they are hidden) Shadow copies would be nice but with the current setup we have, it may not be the best solution - boss is also against VSS Az

Now your mis-read was amusing... I like that idea rather alot In any case, yeah you can disable the recycle bin via GPO but if I do that - it disables it locally too which is fine and well but people delete files and then say 'Uuuuh I didnt mean to delete that...' and are reliant on the recycle bin. I wonder who's great idea it was to turn on network-based recycle-bins and then not include a method to turn it off? Az

Hey all, Just hit upon this annoyance (we'e only just noticed it). We have redirected student folders via DFS - however we seem to have lots of RECYCLER folders, almost like a network-recycle-bin. Is there any way to turn this off as it's using up their quota when they believe they are deleting things. Thanks, Az

*cringe* Not wanting to sound like an arse here but why would you want to grant the students any kind of extra permission to C:? In any case - if you want this to run at logon you have a few options... 1) Group Policy - You can use Group Policies to assign local security rights over files and folders, this would be far quicker and easier than a local script. 2) As already mentioned - RunAs - There are versions of RunAs that can take an admin login and password and run your command as an administrator, but these are unsecure at the best of times. 3) Create an AutoIT script to do this change, package it to run as an administrator - This is a good idea but only if you know AutoIT or can learn enough to just do what you want. The best idea is to use Group Policy if you have to grant them the rights, if you can't do that - then I'd seriously look at #3 long before I would look at #2. HTH, Az

The side effects are simply put that you'd get more broadcast traffic when the workstations ask for new IPs and such. 8 hours shouldn't kill anything but an hour may push it - but if you are really reluctant to rebuild your scope and such then you may have no choice. As for DNS... it's possible that you don't have the correct scavenge interval set-up. Your DNS record scavenging interval (ageing) should be similar to your DHCP lease times. You also want to make the DHCP server do all the work with this - rather than assume the clients are happy to simply update/remove their own A and PTR records. Inside DHCP are settings that basically treat the clients as if they are NT 4 (incapable of dynamic update registration) - which means the DHCP server will do all the work regarding DNS registration for you. This may be helpful - or more trouble than it's worth. If your laptops are particularly troublesome you may have to set it and then undergo the procedure that teejay suggests. If it were me - I'd drop lease times right down to an hour, turn off dynamic DNS (or set it so DHCP does the actual updates) and then completely purge the DHCP leases last thing on a friday when most clients are off - then I'd turn on conflict detection. By Monday - you may get a few leases from a few clients who are left on, but conflict detection will handle anything nasty from them and the new clients should simply ask for new IPs by then. But to be honest - you would be far better off merging your scopes into one larger one. If you made a note of all static IP addressed systems (except servers) and got the MAC addresses, you could give them a reservation in DHCP. Then all you'd have to handle are the servers - which you do first as the clients would use DHCP for the most part. The choice - is yours mate Az

Why giving your IT department cakes and biscuits is a good thing. Hmmm... hard to think of legitimate things that aren't already covered. Perhaps something like - what can I and what can't I do with my LFT (assuming you have those)? Az

This may or may not be relevant but try turning off 'Large TCP Offload' in your network adapter settings. (Under Network Connections - Right click adapter -> Properties -> Configure -> Advanced) There are some issues with W7 and XP certainly with file copies if that's turned on. I've generally made a habit of turning it off everywhere I go just to be on the safe side. Az

That's great - I ended up using GPO instead - no idea why I didn't think of that... probably losing it Az

Mike: That's what I was wondering - you could simply superscope them both couldn't you? Giving them the shared subnet? Az

Try this - see if it helps. On the DHCP Server console - right click the DHCP server and go to Properties. Go to the Advanced Tab. Set 'Conflict Detection Attempts' to 1. This means when your clients will try to renew their IP, the DHCP server will first check to see if the IP the client is asking for is already in use by someone else. If it is - it will allocate the next available. As I said previously, you should probably turn Dynamic DNS off for now (DHCP Server console again). What strikes me as a little odd is that you have 1 subnet using 255.255.248.0 and another using 255.255.252.0. These 2 subnet masks cover different ranges which may well be part of your confusion. What is your TOTAL IP range? (As in, what numbers can you use) Az

We are using Mandatory profiles for our students and we have now found a reason to move to WMP11. However, every time they login - it runs through the initial setup each time. How can I get around this - I've used an MSI packager to track changes and have updated the profile with registry entries but no matter what I do - it keeps kicking off. Any ideas? Az