ScottLogan

I use GPO client side extentions to distribute the delprof2.exe file to the computers. Then i run this vbs script on computer start up Set WshShell = WScript.CreateObject("WScript.Shell") strExe = "c:\delprof\delprof2.exe /u /q /i /r" Return = WshShell.Run(strexe, 0, false) Wscript.Quit I don't get any folders left behind. If you do this may be because something is still access the folder like an AV. Hi David, I can't remeber exactly what happened it was about 4 years ago I played with that setting. I just remember coming to work one day and having massive user data lose becuase of that one policy. Yes i have roaming profile

I have had massive issues with Computer Configuration > Administrative Templates > System > User Profiles Delete user profiles older than a specified number of days on system restart Enabled Delete user profiles older than (days) 7 this caused data loss on my network so please test well. from this i use delprof2. have been testing and works well so far. just google it, some guy as modified delprof to work with windows 7

As your using 2003 server this may not e revelent but may point you in the right direction first please note my first comment here http://www.edugeek.net/forums/windows-7/87876-windows-7-slow-initial-logon-cold-boot-fast-second-logon.html now with 2008 r2 you have to install all your drivers for that printer. So when your setting up your printers on a 2008 r2 sever you add under print mangment > print servers > *server* > drivers the driver for xp, vista, windows 7 and x64 bit drivers. This then allows the OS to pick up the right driver for that printer. see if you can fire up a virtual 2008 r2 server and test (if you can)

Hi netadmin, Just so you know there is a massive logon time hit with printers and windows 7 at the moment. Basically delploying printers via GPO for windows 7 with item level targeting causes massive logon delays. I am currently working on a solution to this. My solution so far has made me scrap every single GPO and start again. So far my basic setup has lead me to loopback proccessing for each computer room. I then apply a vbs logon script for each room which i will paste an example of below. I now have 11 second logons and 32 second logons for new profiles. I also use delprof2 to delete old profiles on computer startup so these times are valid for each logon. now to add to this use your computer logs to find out what is causing logon delays. Event viewer > Applications and services logs > microsoft > windows > group policy. You will find some intresting times in there. Another logon delay on my network is IE client extensions. (please note IE extensions do not work for IE 9 unless you apply this update to your machine Internet Explorer Group Policy Preferences do not apply to Internet Explorer 9 in a Windows Server 2008 R2 domain environment) this script below i simply apply to logon scripts. rather than upto 5 mintues of logon times to install printers this takes less than 1ms to run. you will need to modify for your network On Error Resume Next ' Option Explicit Dim network Set Network = CreateObject("Wscript.Network") set objShell = WScript.CreateObject( "WScript.Shell" ) 'Calls the isMember function with the specified group to see if the current user ' is a member of that group. '---------------------------------------------------- 'Removes any existing networked printers strComputer = "." Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") Set colInstalledPrinters = objWMIService.ExecQuery _ ("Select * From Win32_Printer Where Network = True") For Each objPrinter in colInstalledPrinters objPrinter.Delete_ Next If isMember("FollowMe Printing") Then Network.AddWindowsPrinterConnection "\\followme\FollowMe" Network.SetDefaultPrinter "\\followme\FollowMe" Else Network.AddWindowsPrinterConnection "\\hecate\it2-colourlaser" Network.SetDefaultPrinter "\\hecate\it2-colourlaser" End If ' ***************************************************** 'This function checks to see if the passed group name contains the current ' user as a member. Returns True or False Function IsMember(groupName) If IsEmpty(groupListD) then Set groupListD = CreateObject("Scripting.Dictionary") groupListD.CompareMode = 1 ADSPath = EnvString("userdomain") & "/" & EnvString("username") Set userPath = GetObject("WinNT://" & ADSPath & ",user") For Each listGroup in userPath.Groups groupListD.Add listGroup.Name, "-" Next End if IsMember = CBool(groupListD.Exists(groupName)) End Function ' ***************************************************** ' ***************************************************** 'This function returns a particular environment variable's value. ' for example, if you use EnvString("username"), it would return ' the value of %username%. Function EnvString(variable) variable = "%" & variable & "%" EnvString = objShell.ExpandEnvironmentStrings(variable) End Function ' ***************************************************** ' Clean up Set objShell = Nothing

I completly understand where you are comming from. But not every one is evil in this world there are still some genuin people out there. I have been completly inundated with messages of people wanting help. This has exploded into a situation which I cannot handle. I am happy sat here with the way my life is at the moment. I dont have any spare time to give what is now 100's of schools help with setting this up for their individule network setup. I bearly get enough time with my son at the moment as it is. I don't want a life of doing the same thing day after day I like new problems new things to discover. Then I get all the abuse from people on this forum with comments that just ends with answers with me going around in circles because they know nothing about the product, wasting even more of my time and being unhelpful to other readers. Basically I have gotton fed up of the whole thing and decided someone else can take it on. I don't need it, I don't want it and you have all made something that was meant to be helpfull for all those people who want it very negative with unhelpful comments. I understand where people are coming from but I have also answered every question. another example of a circle in order to answer previous posts "This has been setup very quickly to meet the demand and is still in progress. all that information will be put up soon." I'm not having an indivdual go at any particular person i'm just fed up and venting. So lets bring this back to basics DirectAccess now works behind NAT's, If its not for you try something else there are plenty of very useful comments on here that show alternatives. If you want to see what else is out there for example try SonicWALL, Inc. - Dynamic Security for the Global Network - United Kingdom I am trying to be as fare as possible in my comments and have suggested alternatives and even suggested using more than one product. Just because I am suggesting products doesn't mean I am selling them. There are many post doing the exact same thing here. They are just posts to try and be helpful. I am still happy to be a school who demontrates this for anybody its not a problem I am trying my best to be helpful and give everyone the best information. On a side note to those people contacting me, yes I will pass your details on and they will contact you soon. There is just alot of details to pass and should get through them all this weekend or soon after. or just go direct. sorry i'm just tired and fed up. 2am wake up with kid = long day.

I own the domain but they have bought rights to use it. I was setting it up as a blog but gave up because its to complicated to write with some many different networks out there. It will eventually fall over to them its just red tape at the moment. This has been setup very quickly to meet the demand and is still in progress. all that information will be put up soon. As far as company and stuff i think i might have confused you by my wording. your not buying hardware / software / any special programs etc etc. It is just the knowlegede of how to put everything together. Simply you will if you want it just be paying for a guy to install it. Just the same way a non technical user will ask for an IT guy to pop round and fix their home computer and pay them for it. If they decide to turn it into a company its upto them I am out of the loop now. "It is not compulsory to register a business name but you can do so with the National Business Register" I don't understand whats fishy? you think i'ts a con or something? I have been very open about what is going on. Do you think the system doesn't work? Your more than welcome to pop down Gillingham School and have a look. I don't mind showing you a demonstration. I think this is a brilliant piece of kit and would gladdly help other schools see how it will help them. Just send me a PM and we will arrange a time and date. The only reason I posted on here was to let people know it is now possible and to get DirectAccess when orginally it was not. The reason i have let it go is because the people now running it have the funds to do so and the time. I'm quite happy with my well paid job and with a 1 year old baby i don't have the guts to leave it and start a project on my own. Anyway this is going to be my last post on the subject its nothing to do with me anymore. You can draw your own conclusions but I wouldn't slate a people with out trying them or the software first hand. Have a good snowy day everyone

Hi sidewinder, Sorry I have just sold the technology to a company.

I have attached a rough picture of what our network is doing with DirectAccess to help people understand what it looks like.

With RemoteApp we now have sims .net on our internal macs. all you need is Download: Microsoft Remote Desktop Connection Client for Mac 2.1.1 - Microsoft Download Center - Download Details

Heres a link for people which may find very interesting RemoteApp on MAC This is how you can use RemoteApp on Mac's You should be able to take this further because all you need is a device that supports RDP and it will work. You can use 3rd party RDP software vendors to achive these goals. I'm going to test this on my internal macs tommorrow. This will mean from my NAT network i have directaccess for home users who get work stuff at home transparently, Ill setup RemoteApp for sims at home via directaccess and internal mac's so it runs much quicker. And its all built into windows (assuming you have the right versions) This then gives me the option to have home users pc's (non domain) capable of running sims (not as transparent but quick). However this is not an option we want to give users here yet as the massive headaces of using random unprotected OS systems and supporting them. This is why VPN software has never been on the cards for us. This solution suits us down to the ground and is all running from a 1U server.

When a user connects on our VPN. Exactly, when a user connects. Again if your situation means that your happy doing that then thumbs up you have exactly what you need. But not everyone is like you. And i have made many valid points why this is not always ideal. And not everyone has the means to fork out 4k on that particular piece of software that does your job + training yourself and every user that wants to use it, installing specilised hardware and software in order to achive that goal. It's again just all down to your tastes, if you want VPN then get it but have a look at DirectAccess features and see if this will help to.

Transparency in working with your network programs is another. How long do you think it took the guy to develop the software and hardware for VPN's to work. I didn't happen over night. You are simply buying a product that could of taken years to complete and write the code for. The reason it took me 8 months is because i bought the hardware before relising it wouldn't work behind NAT's. 8 months ago i didnt have a clue about what i was getting my self into. I have since then been trying to come up with a solution and have succeded and i am now an expert on it. I can set this up within a day or so now dependant on the complexity of the network. VPNs: IPSec vs SSL. Internet Protocol Security vs Secure Sockets Layer. Difference and features of protocols for virtual private networks. Wireless security. there is another article about pro's and con's Again everyone should come to their own decision on what will work for them. This is not a solution that will fix everything and there is probably no solution out there that will fix everything but it can certainly run along side other solutions to get what you want to achive on your personal network. There are so many different networks and setups it is imposible to come up with one solution.

Yes you are looking at a VPN solution. You can use DirectAccess along side this to support your windows 7 range and give those users a some what better experience.

Sonicwall is a VPN connection. DirectAccess is 10 times better. The reason no schools except directly connected to internet schools are not using DirectAccess is because it does not work behind NAT's. I am the only person who knows how to fix it. Thats the reason it took me so long to set it up. For our school to go directly on the internet was a big no no. I don't have the time to do all my own firewalling, filtering etc. To be blunt, please write up how you did this so that others can do it. Its no use to anyone else if you simply say you can do it and leave it at that! It is impossible to write up how to get the job done when there are so many different network configurations out there. The simple fact is if you have never used directaccess or set it up you will not know how to implement the fix. The fix is not a simple check box you tick. It is an array of complex settings, tricks and software. Here are some reasons schools want this; Some users find it difficult to understand how VPN's work and so don't use them so they miss out of features they could use. With DirectAccess it is always on, the user has to do nothing. A lack of training does not get resolved via technology in my experience. The solution to a lack of understanding is better training. Your experience is valid but i have staff here that a) refuse to use computers b) get very grumpy when they have to learn something new c) just don't have the time for training. DirectAccess fixs all that Directaccess works through all firewalls because the last tunnel that it could setup instead of Teredo is HTTPS. So you can support every home users routers. SSL VPNs are HTTPS. IPSec works across every single home router I've ever come across - both are standards used in VPNs. Nothing special there. see here VPN's: IPSec vs. SSL DirectAccess will log the user on to your internal intranet. As will a VPN. as far as i am aware not without user intervention. DirectAccess is transparent. The user gets the same internet filters at home as they would at work. Same on a VPN. Again not without purchasing expensive and complex VPN solutions. DirectAccess is built into windows. It can be years before IT will see the laptop again and in some situations when a laptop finally goes back on the network that user could lose all their work becuase GPO's have changed so much. With DirectAccess all laptops will always be up to date with settings. I don't know what kind of school you work in where laptops disappear for years, but that is simply not the case in every school I've ever been to, near or worked with. If staff aren't bringing their laptops in for work to be done on them, then that is a management issue, not a technical one. Yes some schools don't have this problem but it is an issue here. Laptops are mobile but some staff do not have the need to carry their laptops with them all the time. I have a users who have their laptops permantly sat at home and all they use it for is writing reports and saving it on pen drives. Why would that user feel the need to ever bring the laptop in? Again it is just another situation Because users save work to a mapped drive on a server when the laptop breaks the user will not lose anywork and IT don't have to spend weeks trying to get the stuff back. Same with a VPN. Only if the user initiates the connection. DirectAccess is always on. The schools current infrastructure does not have to change in anyway. IPv4 is supported. Nor does it with a VPN - just stick an appliance in, plug it in and NAT it across via your firewall. Like the VPN solution another user comented on you have to buy sometimes buy complex equipment. DirectAccess it built into windows. All network programs work at home so IT do not need to spend time installing it on every laptop. Same with a VPN. Again DirectAccess is transparent combining it with RemoteApp users could get up to date programs instantly without having to install the program and will run in a resizeable window on the users computer. Imagine running one sims update on one server and every single user has the update instantly no matter where they are in the world. Same with a VPN. Again transparent Connections are much faster over Teredo than VPN's Proof needed. Every site is different. I can only quote what other companies have stated. Advantages of Direct Access (copied and pasted off the internet) User doesn’t have to establish the connection Double clicking an icon isn't a big issue generally, so I don't really see the advantage. It's not practicle for every user. User doesn’t have to reconnect if the Internet connection breaks This is just the same as the above. It's not practicle for every user. Group Policy settings get active before user logs on Active directory settings are, for the most part, irrelevant when a computer is being used at home for most schools. This is a very relevent issue in some sites for reasons already stated Users can log on to Active Directory, just like in the intranet What's the advantage of this? A user takes their laptop home, they're going to be the only person using it, so cached details are fine. you cannot cache your intire intranet. again it logs you on transparently to your internal IIS websites Works together with NAP (Network Access Protection) and NAC (Network Access Control) solutions So do VPNs, as you can hook most up to a RADIUS server with rules in place or whatever you like. yep Communication to the corporate network is encrypted with IPsec So do many VPNs. The majority of IPSec VPN solutions require third-party hardware and / or software. In order to access an IPSec VPN, the workstation or device in question must have an IPSec client software application installed. This is both a pro and a con. "Dont get me wrong the transparency of DA to the end user is a fantastic feature but remote access to school is about delivering secure access to school resources from virtually any device anywhere." DirectAccess uses IPSec encryption. it is more secure than any VPN connection. You can also attach mobile phones to it. You missed the point there - What about a Mac user? What about someone who is out at a meeting with their iPad and/or the only access they have is HTTP/HTTPS? This is not a solution for everyone or a complete replacement. There is no reason to use both technologise together to achive everything you want "When your school is snow bound and the staff need to access the network from their home PC's any one of the commercially available solutions would work whereas DA would only be able to provide a handful of pre defined corporately configured laptops to have access." All our staff have laptops from the school. A contingency plan to say if snow is expected take your laptops home will solve that. (but do you really think there will be that many people wanting to work when they can play in the snow with their kids?) That isn't a contingency plan - that's hoping that the weather forecasters get it right, which over the last few years, they haven't. Also, it requires kind of a large investment, requiring the school to maintain laptops for all staff! This is never an issue for us here. again this is not a solution for everyone or a complete replacement. There is no reason to use both technologise together to achive everything you want Yes i have read that very good article and to quote from it here is another enhancement over VPN's - Teredo technology, its much faster. Teredo DirectAccess 3.39 Mbits/sec IP-HTTPS DirectAccess 1.37 Mbits/sec PPTP (Watchguard x1250e) 2.87 Mbits/sec 6to4 DirectAccess n/a* More comparisons needed really. you will never know unless you run your own tests. I hope this helps. The bottom line is that if you put VPN's and Directaccess side by side in my opinion DirectAccess is much better by a mile. However what changes about what is the best solution is your own personal circumstance. If you have a more of a need for VPN's features then of cause in your opinion will be that VPN's are better. Its just a matter of taste. Again the bottom line is that it is now possible for schools behind NAT's to consider using DirectAcess when they never had the option. All the comments stated are simple pro's that could tick the right box for your site. again it comes down to personal tastes.

You will need to get an anytime upgrade to windows 7 enterprise. And buy a 2008R2 Enterprise server because this will support upto 4 VM's to get this working.