Jollity

Is it just one USB device or have you tried with several different models? Is it just the one Windows 7 machine? Sorry, just feeling around in the dark here.

There may be other circumstances, but it is allocated when DHCP detects an IP address clash on that address. Your mentioning of DCHPNAK responses reminded me of an issue we had where DHCP caused a broadcast storm due to an IP clash with an IP address which had been reserved in DHCP. Now I look back at my notes, I am not sure it is relevant unless the BAD_ADDRESS flag has appeared on a reservation entry - rather than just a regular lease. If you have several DHCP servers on the same VLAN and subnet, it might be worth disabling all but one of them to see if that has any effect.

Do you have any DHCP leases in the list on the server flagged as BAD_ADDRESS?

Just checking: Is the USB stick formatted as NTFS? If so, does it have file permissions set to allow non-admins to write to it.

So it is not a question of the account having local admin rights, iTunes only works on the one account "Administrator"? Have you tried with another local account, either administrator or limited?

That is a disappointing response from Oracle considering how easy it would be for them to fix at least reinstall. I do not understand why they are using an MSI at all if they do not intend to support it properly. What is so appealing about these bizarre MSI sandwiches with an exe installer, wrapped in a MSI, wrapped in another exe installer? I really appreciate your laying out the workaround. I will give your MST a try tomorrow. The person who submitted the bug report to Oracle says of the workaround: "However, using a transform in this manner would likely cause problems with future versions or Updates of Java." It seems to me that it ought not to cause a problem: future updates should still remove previous versions (of the same major version) even with the transform (at least as well as they ever did). Have you had any problems with this?

Hello Russell I see your point. I think the issue with this particular printer probably is sorted. A quickly resolved issue with a particular elderly printer is not really a big deal. It is just unfortunate that this is the first printer I happened to test. I posted here to put my mind at rest that such issues are rare. I am afraid all the praise it gets around here may have given me unrealistically high expectations of Impero. I included the model of the printer when I updated the support ticket.

Thanks, that is good to hear. What in particular needs to be planned in the setting up? We were thinking about doing the install ourselves rather than paying their engineers to do it, as our head of maintenance is a competent electrician - do you think that would be a mistake?

Swapping from the Microsoft driver that was in use to one from the printer manufacturer did fix the issue. I am still rather concerned about the issue because it is the kind of problem that could get missed if it only happened intermittently for a printer.

Yes. They said they have seen bugs like this before with certain printers. They advised upgrading the driver, which I am going to try.

Does anyone use Impero print quotas? If so have they generally been reliable? I am just trialling Impero and have hit a bug where it lets certain documents print even though the account has no credit. It sticks up a notice saying the user has no credit, but still prints. Worse, it does not log the print job. This may be an unusual case as it has so far only occurred with a certain local printer with documents printed from MS Word. But I would like to know if anyone else has had problems.

I have been reviewing our GPO settings in the category: Security Settings\Local Policies\Security Options. Some of them were lowered for compatibility with Windows 98 clients, now long gone, and the defaults do not seem that secure. I have found this Microsoft Support Article useful, but I wondered if anyone had any warnings of compatibility or performance issues caused by raising the settings. I am thinking it would be a good idea to force traffic to be signed, that is turning on: Digitally encrypt or sign secure channel data (always) Microsoft network client: Digitally sign communications (always) Microsoft network server: Digitally sign communications (always) Require strong (Windows 2000 or later) session key Though I don't know that man-in-the-middle attacks are that likely in our environment, and there are warnings of a 15% performance hit. For the last setting the article I cite above says "Enabling the Domain member: Require strong (Windows 2000 or later) session key setting is a harmful configuration setting.", but then appears to spend the rest of section saying what a good idea to set it is unless you have windows NT on your network. I am also thinking it would be a good idea to disable all the anonymous access options. Network access: Allow anonymous SID/Name translation - thinking disable Network access: Do not allow anonymous enumeration of SAM accounts and shares - thinking enable Thoughts? What do you have set?

I don't think they even have to find their own 0-day exploits. Wait for the first security patch day after the end of support. If you reverse engineer a patch for Vista/7, you will quite likely find a working exploit for XP.

themightymrp's suggestion is probably safer if you can get it to work, but the tool I would use in these circumstances is the windows installer cleanup utility. It is a blunt instrument that will kill off all of Windows Installer's record of an installed MSI, though it leaves the files installed by that MSI and (I think) the program's registry settings unchanged. If you run that, then you should be able to reinstall Java update 14 again over the top and then uninstall it properly. I have found it really useful for dealing with these kinds of problems. Unfortunately Microsoft no longer provide the utility - they have released an alternative here that I have not tried, but might work for you. You can also obtain the original windows installer cleanup utility from various freeware sites.

Last time we deployed Java, I did it by extracting the MSI out of the installer and deploying that. It worked initially, but whenever Windows decided it needed to re-install or repair the install on Windows 7 or Vista the install would break completely - most of Java's files would be removed and a file core.zip left in the folder, stored in the zip file were all the files. These re-installs occurred when moving computers between OUs with different group policies deploying MSI, but apparently occurred at other times as well. The root cause of the problem is that the Java MSI is not installing the files properly though the file table. It installs the core.zip file and then runs a custom action to extract the files out. This works for install, but means that during repair/reinstall Windows Installer carefully restores core.zip rather than the actual files. Flash MSIs do a similar thing, and it also causes problems. I am just about to deploy Java again. I might try FN-GM's script this time.

We use DFS-R for replicating just about everything between our two main 2003 R2 servers: home drives, shared drives (read-only and write). Then DFS to provide links that direct each client to one or other server. We started using this setup with FRS, which did not work well at all with this volume of files. However I have had very few problems with DFS. There is sometimes a short delay before replication occurs, but it rarely causes an issue. There was a confusing issue recently with videos produced by powerpoint not being replicated as they were marked as temporary files. But most of the time I can forget it's there. The plan is redundancy to allow us to manage for a significant time after a complete server failure. It was used instead of RAID, which I think was a mistake. It has been useful several times but never really tested for an extended period. The fail-over is not as good as I would like because when a server is down a client will only fall back to the other after a significant timeout. I also use DFS-R to provide robust copying of backups from outlying servers to a central server to be written to the backup disks.

Nope. The current level of our schoolwide broadcast communication is wall-mounted manual bells and hand-held hooters.

Sadly the fire alarm idea turned out to be a non-starter as our fire alarms are on independent circuits in each building. We had a Bodet rep into demonstrate their system. It seems pretty swish: 16 different recorded sounds you can trigger and potential to use the same system to do things like switching off floodlights at fixed times. It is not cheap though.

I have no idea how the fire alarms are set up, but it might be worth seeing if we can make use of their infrastructure. Thanks for the idea!

Rather on the fringes of ICT, but the Bursar has given the project to me. The head has decided we need a bell system to signal the end of lessons. I think everyone is having so much fun learning they lose track of the time. It is quite a distributed site, so I think we will need a wireless system or one that uses the existing network, rather than a system requiring dedicated wiring. I have got some people from Bodet coming into show us their Melodys Sounder system. I was wondering if anyone had any experience with this or similar systems they could share with me. If the dedicated systems end up too expensive, I might be rigging up some kind of computer based reminder system, but obviously that would have disadvantages with computer being off or muted and so on.

Thank you. That works out okay for us then. We may have a lot of computer that the teachers may potentially use, but there will only be two or three in use at a time.

Impero website says "You only have to pay for concurrent Client Access Licences or CALS". This seems to imply that once the clients are licensed you do not have to pay more for teacher workstations. We are planning on having two suites of laptops for the students moving between classes, but stationary computers for the teachers, attached to interactive whiteboards. This means we will need a relatively large number of teacher workstations for the number of clients.

To continuing with the bumping, if you want to prevent users from creating new groups, but still allow them to manage the membership of groups they own, see this helpful article. The commands I used were: New-ManagementRole -Name OwnersCanModifyDistributionGroups -Parent MyDistributionGroups_DefaultMailboxPlan -Description "This role enables individual users to view distribution groups and modify, view, remove and add members to distribution groups they own, but not to create new distribution groups or remove distribution groups." Remove-ManagementRoleEntry OwnersCanModifyDistributionGroups\New-DistributionGroup Remove-ManagementRoleEntry OwnersCanModifyDistributionGroups\remove-DistributionGroup Then in the administrator webpage go to "Roles & Auditing" -> "User Roles" and there should be a new "OwnersCanModifyDistributionGroups" role which you can enable on the default mailbox plan, while disabling the default "MyDistributionGroups" role.

Thank for your suggestions everyone. Here is the current state of the plan: Determining most suitable, best value laptop model – requires consultation with SMT, teachers and governors – 20 hr Determining the best sites for the laptop trolleys, making space, ensuring sufficient power availability - 3hr Ensuring group policy and other settings set up appropriately for Windows 7 – 12 hr Setting up Windows 7 default profile and mandatory pupil profile – 16hr Resolving compatibility issues of SoftEase – 6hr (potentially a lot less if all works fine) Checking for issues with ActivInspire on our system - 2hr Installing ActivInspire and removing ActivPrimary – 2hr Preparing and training Teachers - 5hr Investigating alternatives to Impero - 2hr Installing Impero and removing Netops – 2hr Training teachers in using Impero - 2hr Testing Impero – 4hr (spread over a month or so) Potentially if Impero found unsuitable – installing and testing further monitoring software – not estimated Resolving compatibility issues with microscope and data logging software on Windows 7 - 4hr Unpacking laptops and setting up in trolleys – including admin time, for example for security marking and recording in asset register – 8hr per suite Preparing one laptop to provide image – 12hr Ensuring printer compatibility with new setup - 4hr Setting up and testing image – 4hr Deploying image – 4hr (largely unattended) Training teachers in use of laptops, Windows 7, Office 2010 – training material and training sessions – 8hr Additional support for teachers in use of new laptops, Windows 7, Office 2010 – 8hr (spread over multiple weeks) Removing existing ICT Suite, disposing of or storing machines - 8hr Preparing image for current suite machines for use in pre-school – 6hr Setting up and testing image - 2hr 15% Contingency time

The current front runner is a LapCabby trolley. They do not have customized power, but they do have individual slots at the back for each adapter. You can get to the adapters fairly easily but you have to take a back panel off. The wires to plug into the laptops are clipped next to each laptop tray. Do you see any potential problems with that setup? They will almost certainly be moved too much for that, but I like the idea. We should also velcro down the children.