TheFopp

Fingers and Toes crossed.... thats what I'm hoping for!

Hi Rob We are doing transparant I'm afraid... trying to get 290 kids to all set the proxy in their browsers just seems like too much of a nightmare!

Problem is when we have loads of PCs not on the domain, they won't pick up a GPO.

How does Core Auth work... and what does the user have to provide details wise. I'm toying with switching to SSL redirect and seeing if that works. Downside is that users on PCs that are connected to the domain will have to enter username/password to browse the internet and remember not close the login page... also how can I sign the https certificate for Smoothwall as that always shows as not being certified... something else for people to have to click on.

One step forward... two steps back. Or thats what it feels like with Smoothie at the moment! NTLM Auth is now on. All PCs connected to the domain being filter perfectly. Student's own PCs, which aren't connected to the domain, should get an authentication box in which to enter their network username and password.... .... problem is some do get the authentication box and some don't - it just hangs with the browser URL [url=]http://smoothwall:800/?sgtransntlmdest=http://www.google.co.uk[/url] (or whatever their homepage is) and doesn't bring up an authentication box. The problem is it works on my non-domain laptop in Firefox, Safari and IE8. For some of the students it works in Firefox, Safari and IE8. For some it won't bring up an auth box in IE8 but will in the other browsers, for some it won't bring up an auth box in any browser.... Even two guys who have identical laptops with the same OS, and browsers. For one it works, for the other it doesn't.... Really starting to pull my hair out with this now... it just seems to keep throwing up problems! Any suggestions would be gratefully recieved. Cheers Adrian

Hi Tom Thanks for getting RobF's trick onto our UTM. It may be worth noting howeverm that the trick doesn't work with IE (only Firefox and Safari) as IE tries to send through the local PCs domain instead if its not on the networked domain. So IE users still have to use DOMAIN/USERNAME instead of just USERNAME. If you guys can figure a way around that I'd be mighty impressed. Cheers Adrian

This looks very useful, thanks. Hadn't realised that the gadgets were html based, in which case I can probably create something fairly similar to what we currently have.

Will take a look at this, cheers.

That sort of thing might work (if it wasn't an OS X app), but I'd need to be able to ensure that it automatically opened, and ran the correct intranet page depending on if a student or a member of staff was logged in.

Sorry Quackers, not for sale. Took a lot of time and money to get our website working how we wanted it and the design and brand is very much ours. ... but very please you like it so much. If you are interested it was built by Musgrave Design with a lot of input from them and me. Great guys to work with and very helpful.

I've been trying to find out how to create gadgets - one that just displays the webpage of my choice, but can't find info on how to create them. The only coding I can do is VBScript/ASP but I bet it needs to be done in something different. Does anyone know if you can, via GPO, get the system to always display a specific gadget ?

We are looking to move to Windows 7 in the summer, but desperately want to find a simple way of replacing Active Desktop as we use it on XP to give students/staff direct access to various areas of the intranet. Here is a piccy of how it looks for staff http://www.chethams.com/activedesktop.jpg The students see a slightly different version with access to their areas. I know we could set the intranet as a homepage in IE, but it means one extra click to get to the options and it isn't in sight all the time like our current way of doing it. I wouldn't know where to start with coding a desktop gadget that could do this, and could I get it to load automatically via group policies anyway? And I'd need to make 2 gadgets, 1 for staff, 1 for students. Anyone have any thoughts? How do you direct staff/students to areas of your intranet?

We use them for our internet connection, web hosting and also use their surfprotect system. They are the most helpful ISP I've ever had to deal with. They answer their phones within 3 rings maximum (24/7) and even help me out configuring stuff that isn't really their problem. We've been with them for about 5 years now and have no intention of moving. We used to have 3 bonded ADSL's which worked fine, but have now upgraded to 3 load-balanced ADSL2+ lines (we use one line directly for our servers/email/moodle, and the other two are shared for general internet usage, all balanced across a Cisco 2811 router that they installed and manage for us. Surfprotect was our main filter and it does a pretty good job as a filter across everything, but we wanted extra control (e.g. different filtering for different year groups, logging, etc) so now have a Smoothwall box as our primary filter, but Surfprotect still sits inline after the smoothwall as extra help. Really helpful guys, and a very good product with what seems to me as reasonable prices for the quality of service you get.

Cheers Tom, PM sent.

Got it all sorted in the end. Now happily working with NTLM Authentication.... and the kids will have to put their network username and password into the browser on their own laptops when they want to browse.... .... they are going to hate me... Happy Days!

Good question... don't know. I'll go and find a Mac!

OK, got it pretty much sorted with the help of one of Smoothwall's support guys. My DHCP wasn't giving out the full domain name (just giving out CSM instead of CSM.local) -although it still seemed to resolve OK when we pinged initially - and we changed from using NTLM Auth to NTLM Ident. All pretty much working as I expect now, except that anyone using Safari as their browser is asked to provide a username and password (Firefox and IE are working fine) - although as this is just using NTLM ident then they can add any username without a password and it will accept them and push them through the Unauthenticated IP group. This is fine as they are unauthenticated in the sense of not being a member of the domain, but it seems strange that IE and Firefox can push through a username from the PC automatically but Safari can't. Typical Apple... has to work differently!?

Interestingly though, if I set authentication to No User Authentication and set Unauthenticated IPs to Filtered. Everyone is happily connecting to the web and being filtered by the policies set for Unauthenticated IPs.

If I'm set to NTLM Authentication and have Unathenticated IPs set to filtered, then any unauthenticated PCs that try to access the web don't get as far as the filter logs (as far as I can tell)... e.g. my iphone web browser just says "Cannot Open Page - Safari cannot open the page because the server cannot be reached" - and other users get the Diagnose connection page in IE. Although I might be looking in the wrong logs to find what you want!

OK, here's the problem we have. School Guardian seems to be working nicely for all the PCs connected to our AD Domain using NTLM Authentication. Unfortunately we are a boarding school so we have kids who have their own laptops that aren't connected to the domain, but just use the internet connection, and we would like to filter them as well. Ideally, I'd like them, when they try to connect to the internet on their own PCs to get a log-in screen from School Guardian where they add their School network credentials and get filtered then according to which AD group they are in. I know in theory this can be done, but I can't seem to get the hang of pushing out PAC scripts or WPAD so that they look at the filter. Instead they just get no connection to the internet at all.... Bearing in mind that they could be using PCs or Macs, IE, Firefox, Safari (or anything else) whats the best way to do this... and how?! Alternatively, I'd just like to get their PCs to go through the SG as Unathenticated IPs with a policy applied as a blanket to the Unathenticated IPs group. If I set Unathenticated IPs to Unfiltered, they can access the internet without filtering by the SG as you would expect (fortunately we have secondary filtering by our ISP). Now, if I set Unathenticated IPs to Filtered, it just stops them getting to the internet completely instead of applying the policies I have set for Unauthenticated IPs (I presume they can't see the proxy?) Of course the other problem is that we also have guests who need to access to the internet a lot as well so instead of authenticating them (and therefore having to create usernames and passwords for them in AD), the Unathenticated IP with filtering option makes sense... ... but how do I get it all working!

Ah.... I had the Reduce Overblocking filter applied, but hadn't realised I needed to tick boxes in that filter!

Getting to grips with School Guardian while the kids are on half-term. I have noticed though, that if I choose to filter using the pornography checkbox, then it blocks access to The Guardian website, BBC News and a number of other news websites. Do I really have to go hunting for all the news websites and create and allow option for them... I wouldn't have said the bbc news website was exactly full of porn!

About to start some proper tinkering with our UTM-308. I can type the IP of the smoothwall into IE and it brings up the login page in no time at all, but then takes 30 secs or so to actually log me in and it is taking about 30 seconds to switch between pages when logged in so trying to alter configurations is painfully slow. Any thoughts on what might be causing this?

We had a similar issue when we swapped out the old PCs to new PCs. Found that changing the USB cable sorted it out. The new PCs mustn't have been chucking out quite as much power through the USB ports and as the cables were at least 5m long (even though the distance between pc and smartboard was no more that 2m) they weren't holding the connection. Swapped to shorter cables and it worked.

Another vote for ABTutor. The client software is free and just pay for the workstations that you want the teacher to be able to broadcast from.