minimoo

I *thought* they did a fair chunk of the logic in sql stored proc's. In any case: "I remember when we looked at one large db (thats the mdf) we found the audit table was huge, it had entries from 2004 when someone changed there password!!" -> I suspect sometimes it's things like that which help to slow some things down. The DB's completely split out, everything has a start/end timestamp etc - for whilst it should be indexed etc, everything is growing over time. I've seen a couple of times where things have got deadlocked waiting for each other (P.S. thought SQLSRV normally tried to avoid deadlocks) And equally, regarding LDF log file sizes - pretty sure i've seen one of the patches that sets the sql recovery mode to basic to get rid of a large LDF (and doesn't set it back)

Personally, I find support team do a good job - I normally feel sorry for them when raising cases as I've normally found something obscure that tends to end up with them sitting in the middle. In terms of "Windows Handle Win32Exception" specially - I'd wait and see what comes back - you can probably prove if i'm correct in this particular instance by opening task manager, showing the USER/GDI object columns, and clicking refresh on my messages until it gets to 10,000 and seeing if it crashes. At the same time, that's not to say this is the only place this occurs - I might leave my profiler running next week as I use sims, and compare some memory snapshots.

Out of interest, given the 9GB size, do you ever delete anything ? (aka old students). We haven't, but i'm wondering if we should under DPA - should probably log a case for guidance as another school raised about them deleting students on the "my-account" forums. We've never deleted leavers (As you need to keep them for a while, and as I've never seen Capita publish guidance on when schools should remove them, *and* there's no bulk routine to remove leavers at the moment). This must have a knock-on effect - i.e. I can raise a case that part X of sims is slow - to which sims support will give indexing patches or/and otherwise spend time diagnosing - but is the reason it's slow in the first place that they've never had time to give schools a method/guidance to tidy it up.

screenshot's were from red-gate's tools, and yea, something like dotpeek could be used to see what's going on behind the scene's, but there's no point spending the time really

@Tefters - just realized a really easy way to see /diagnose what's going on - especially on the basis that it's the message window - you can just click refresh Step 1: Take a memory snapshot Step 2: Hit refresh multiple times on the "my messages" window Step 3: take a 2nd snapshot If you look the below, can see the memory in "other classes" has increased: if we do a compare between the two memory snapshots, for new objects: Ok, so we've got 1000 more "NativeWindows" controls - which if you look at the crash you were getting you might recognise So.. where did they come from: To go any further, you'd need either the source code, or to look at the interpreted stuff that dotnet generates - which I'd expect that would break the license agreement, so not going to do that. In any case, I'd take the guess that what's happening here is - the autumn release updated the my messages box to show those new icons to let you tick/categorize the messages, and there's probably a missing .Dispose() call on something within the MyMessages widget - so each time a refresh occurs, the messages get removed from the list so they are no longer visible (or even in the list), but the memory is never free'd(). This is something i'd hope/think would take about an hour of time to diagnose and fix - it's taken me about 15 minutes to come up with the above analysis - and in theory, we now know what object we are not cleaning up.

@Tefters - *sigh* let me see if typing @PhilNeal can get him to get an answer on whether capita require more information from the sims core product manager... - Whilst I don't expect an immediate fix - it's a real shame that a crash bug in the summer release looks to have missed the autumn release. It shouldn't be that hard to identify if sims is the issue in this case and they came back to me last week suggesting I close google chrome as it had one of the highest handles (once the application fault occurs, the handle count drops to ~0 as it closes the main sims screen and garbage collects), so i'm not even sure if we've got to the point that a fix is in progress. I'm not quite sure how capita have got the ticket I submitted set up (1508-3368857) as it shows as 'closed' on their my account website but the support guys are still updating it/asking questions, and it's linked to an problem report of PRB11652 which has status of "closed(inactive)" When I submitted the original case on the 25th August, I spent the time to load up windbg, catch the ~10,000 objects and send off about 10MB's of logs, which I thought would help illustrate the problem to the developers, and allow a speedy fix for an issue that's likely to affect more customers then just me. When I did this, I dumped the list of handles/objects: Handles: Strong Handles: 50 Pinned Handles: 14 Ref Count Handles: 152 Weak Long Handles: 627 Weak Short Handles: 3182 A few hours later: 54cbc988 9995 319840 System.Windows.Forms.NativeMethods+WndProc 54cbbc04 10397 582232 System.Windows.Forms.Control+ControlNativeWindow Total 22994 objects Handles: Strong Handles: 50 Pinned Handles: 14 Ref Count Handles: 109 Weak Long Handles: 10218 Weak Short Handles: 12603 On a simpler level, if you watch task manager/process monitor - and add in the "user objects" and "GDI objects" column - what you will probably find is that just before it crashes the user objects has leaked to around 10,000. Mark Russinovich has a blog post @ Blogs - Mark's Blog - Site Home - TechNet Blogs has some links that basically outlines there's a 10,000 max object limit in windows. On the basis that it'll crash on it's own (if left overnight), and during the day (if admin staff using), i'm inclined to think that as the homepage is refreshed and people move around within sims, there's a few places where a object isn't getting released completely - to allow it to be garbage collected, and therefore it's creeping up to 10,000. I'd be inclined to guess it's probably the home page causing it (and therefore if you were to close the initial home page you might find you don't see the issue) - and as it's new - wonder if it's got anything to do with the message/inbox changes that happened in the last release.

Support Staff Vacancies | The Latymer School

Looking at this... I'm inclined to think key point is "Secondly, how do VLANS play with unmanaged desktop switches?" - as that's going to mean that all data hitting that unmanaged switch is going to need to have been tagged when leaving the device that sends it right? We are also talking a small number of devices. I'm inclined to think that 3-4 VLAN's probably make sense and keep it simple: 1) VLAN -> "Public/Guess Wifi" -> non-school owned devices etc can sit on here. IF switches allow, keep seperate to being able to hit main network 2) VLAN -> "Private/School Wifi" -> school owned devices live on here - that's 45 laptops + 35 ipad's That would mean that AP's would need to be able to tag devices to 2 vlan's, and I'll assume the AP's go directly into one of the HP switches (and not hit the desktop unmanaged switches) This then leaves the following devices: 7 servers (2 physical, 5 virtual) 77 desktops 24 printers 5 IP phones (the rest are digital) 2 NASs i.e. 100 devices. At which point, unless the network is going to grow a lot, I'm kinda thinking it's probably not worth the hassle of trying to split those into multiple vlan's (especially given the unmanaged kit knocking around). Also assuming from the numbers it's likely to be a primary school so kids aren't going to be fiddling too much. So Vlan 3 would then 'hard-wired devices' basically That splits off the wireless (where you might care about broadcasts) and the wired - without having to worry about updating things if stuff moves around.. Equally as Oaktech says - for such a small network, could easily put in the effort to do things properly. IF you could keep existing ip's on devices, and add new vlan's with different ip's for private/public wifi, i'd probably be inclined to keep the devices together. If you need to change everything's ip etc, splitting out completely might be a better way to go (assuming the unmanaged switches knocking around don't then cause issues)

@Zoom7000 - I might be wrong, but I think there's more content (curriculum wise) geared at primaries. At least - and it might be unique to the type of school we are - our staff don't seem to be that interested in the content for secondary, and as the corporate types just said - some of the offering's e.g. MS/google are FOC. In terms of sophos if you have 500+ pc's and are able to sign up for >1 year at a time to get a discount, 500 pc's should be around 1500/year. It does however come down to how much you use their versions of the various offerings - we are currently looking to sign up for google docs / office 365 - and will probably do it direct with Microsoft / Google. It'll be less work for us to sync against our AD users - as we have some users in our AD who do not have a USO. What is a shame is that LGfL do not break up their offering. I suspect that the LGfL broadband price has a good chance of beating whatever David can offer - however once you throw in the development of solutions like AD sync, the my drive service etc (which has to be paid for) and then the curriculum content, the price jumps right up.

I think they may be looking to add something like that, but can't atm. To do a MITM attack - I believe you'd would need to force people to trust a certificate on their device(s)? As you are probably in a better position then me to answer this - am I right with my estimate of a internet link being 7-10k for say a 200-300 mbps link (if you ignore cost of firewalls etc/filtering / other optional extras). I see on your website Schools Broadband | Prices Schools Broadband you state that a leased line starts at 6495, but don't say any speeds...

As an aside, I believe you can also ask virgin to do a quote for a connection directly to compare bt vs virgin vs lgfl. If you take a 3 year view, and only using LGfL for broadband (and not making use of their extra services), I'm thinking it probably comes in more expensive. I believe a business can get virgin fibre for around 7-10k and Sophos in education i'd expect to be around 2.0-2.5k for 1 year - with discounts for longer. A fortinet firewall or similar would probably work out around 2k/year over 3 weeks... My maths is saying you'd come in slightly cheaper then the LGfL offering. IF however you make use of audiocentral, videocentral, and the resources they try and purchase... I suspect the argument goes the other direction. We currently sit on the LGfL and put our own firewall in between atomwide/lgfl and us, so you run the risk of paying for services that are not used, whilst also paying for 2 firewalls. In terms of "I’m told the new filter system they talk about in the flyer that came with the offer address this and also ssl filtering" - I know they've been looking at something, but waiting to see how that works - in my eyes, there's two ways you can filter SSL traffic: a) Look at the certificate that's getting passed around at the start of the conversation. b) decrypt, inspect, reencrypt / pass-through traffic in some manner. In this case, you'd need to trust the certificate doing that - something that I'd not want to outsource. It's also something that one may need to warn end users that's being done if their personal passwords/bank details etc are going through that sort of system.

mm, I was thinking this evening that sims was being slow adding classes to templates for marksheets. Whilst I would not say I've seen issues as severe as described above, nor had staff reporting slownesss - the regular users (office staff) have definitely reported seeing more crashes recently. We applied the summer release early, and shortly afterwards I logged 1507-3354788 when sims was crashing - and got told to run the DB maintenance patch. I logged 1508-3368857 with output from windbg showing a handle leak (sims.net leaked 10,000 handles, hit the .net limit of 10,000 handles and then crashes) if left alone for a period of time. That case is currently needing me to send a copy of our sql db off - bit surprised as i would have thought the windbg output of the leaked objects would be more useful to the developer on its own. I've received this one and a 2 other types of crashes about about 10 times in the last 2 weeks of coming back. @PhilNeal In terms of 'crashes', do you feel they are too rare, or what about using the solus3 infrastructure to collect "errors"? i.e. when sims crashes locally, store stack trace (maybe not crashdump as that might contain personal data) - upload that locally into solus3. Use the guid/stack trace there to report back the areas/errors that schools are receiving, and number of times.

I thought state of deployment stayed same as initial run - however, the reports that show what version is currently running should at least update.

There's at least some result analysis on JCQ's website: GCSEs - JCQ Joint Council for Qualifications DfE normally publish something in a few months i think and I guess various newspapers depending on what you are after

@rpmoore Maybe I'm confusing technology here, but I run a watchguard firewall on site, do SSL inspection for https - this does not require proxy.pac files or a proxy configured on the PC, as it does it transparently - or are you saying that the difference here is, the transparent proxy only works on known port numbers, whereas this would work on any? In any case, in a school, i suspect that people after SSL decryption probably are normally after seeing traffic hitting HTTPS ports only as i'd assume they are likely to have locked down other ports in some way.

@matt40k - missed this post up until now - I think 3.10 probably goes some way to addressing your comments (albeit in a weird way) Having used solus 3 since quite early on - it's progressed a lot. I was feeling that 3.10 was really the first version that fixed/handled issues schools might hit and even with the previous release of 3.9 - that it was really the time that people should move from solus 2 to solus 3 (and i think i've stated that on this forum before) - but then, I had to spend 1 hour writing a script to fix the fact the solus 3 service crashed on start. That "bug" basically puts solus 3 into a non-recoverable state - which is a critical issue for an "update service". I've investigate a fair chunk of time into making sure agent deployments across 500 workstations are working, and it was going smoothly. SIM's currently is one of the only applications we don't put into APP-V. I'm currently wondering whether that's a sensible move...

@PhilNeal @matt40k - not sure i'd agree on the slow pc's front - I was seeing the issue on PC's with i5 PC's with SSD's - I wouldn't consider that "slow".

Capita's fix is a new .exe and .dll file for solus, and a "agentpatcher.exe" to apply it. That's fine if the PC's are on when you run the agent patcher - as it'll try and copy across the dll files and start the service, however not so good if the PC is turned off or it's a laptop that's not on etc. As i'm lazy, i've just knocked up a quick script that i'm going to test and probably use tomorrow so I don't get to play a game of "which of the 500 PC's on site haven't been turned on when I ran the agent patcher", i've knocked up a quick vbscript i'm planning on using to deploy the update in a startup script. I've not (yet) added anything to start the solus 3 service, so currently would need 2 reboots to fix. Whilst i've only done testing offsite at the moment, in case it might help others to tweak and test properly in their environment, i'm posting a copy here. My plan at the moment is to test this tomorrow at work, and use as a start up script for a week or two until all laptops/pc's on site have updated and then remove it. ' ##### Solus 3.10 ##### ' This script fixes a broken solus 3.10 initial release to 3.10.73 to fix solus 3 startup issue in a start up script. ' ###################### ' ### Configuration Paths ' *** UNC Network path to fixed solus files to patch ' *** Sims.Solus3.Agent.AgentService.exe and Sims.Solus3.Agent.Business.dll SPatchDir = "" ' *** Local Path to Solus3 e.g. c:\program files\solus 3 SSolusDir = "" ' ### SCRIPT STARTS HERE ### Dim SDLL, SEXE SDLL = "Sims.Solus3.Agent.Business.dll" SEXE = "Sims.Solus3.Agent.AgentService.exe" Dim oFSO Set oFSO = CreateObject("Scripting.FileSystemObject") CheckSolusVersion(SDLL) CheckSolusVersion(SEXE) ' ### Functions ### Sub CheckSolusVersion(oFile) Set fso = CreateObject("Scripting.FileSystemObject") If fso.FolderExists( SSolusDir ) Then Wscript.Echo "*Checking: " & SSolusDir & "\" & oFile LocalVersion = oFSO.GetFileVersion(SSolusDir & "\" & oFile) WScript.Echo "* Installed Version: " & LocalVersion VerParts = Split(LocalVersion, ".") if (VerParts(0) = "3") and (VerParts(1) = "10") Then If fso.FolderExists( SPatchDir ) Then Wscript.Echo "*Checking Patch: " & SPatchDir & "\" & oFile PatchedVersion = oFSO.GetFileVersion(SPatchDir & "\" & oFile) WScript.Echo "* Patched Version: " & PatchedVersion Select Case CompareVersions( PatchedVersion, LocalVersion ) Case -1 ' Local Version 'newer' then network Wscript.Echo "** Local Version is newer then patch - Skipping" Case 0 ' Versions match, therefore local Wscript.Echo "** Local Version matches patch version - Skipping" Case 1 'Network Update Available Wscript.Echo "~~%%~~ Update Version Available - Updating" fso.CopyFile SPatchDir & "\" & oFile, SSolusDir & "\" & oFile, True Wscript.Echo "~~%%~~ Update Should be done ~~%%~~" End Select Else Wscript.Echo "** Network Patch Location is not available or does not exist - skipping" End If else Wscript.Echo "** Solus is not a version of 3.10 - skipping" end if Else Wscript.Echo "** Solus is not installed - skipping" End If End Sub ' Compares two versions "a.b.c.d". If Version1 < Version2, ' returns -1. If Version1 = Version2, returns 0. ' If Version1 > Version2, returns 1. Function CompareVersions(ByVal Version1, ByVal Version2) Dim Ver1, Ver2, Result Ver1 = GetVersionStringAsArray(Version1) Ver2 = GetVersionStringAsArray(Version2) If Ver1(0) < Ver2(0) Then Result = -1 ElseIf Ver1(0) = Ver2(0) Then If Ver1(1) < Ver2(1) Then Result = -1 ElseIf Ver1(1) = Ver2(1) Then Result = 0 Else Result = 1 End If Else Result = 1 End If CompareVersions = Result End Function Function GetVersionStringAsArray(ByVal Version) Dim VersionAll, VersionParts, N VersionAll = Array(0, 0, 0, 0) VersionParts = Split(Version, ".") For N = 0 To UBound(VersionParts) VersionAll(N) = CLng(VersionParts(N)) Next Dim Hi, Lo Hi = Lsh(VersionAll(0), 16) + VersionAll(1) Lo = Lsh(VersionAll(2), 16) + VersionAll(3) GetVersionStringAsArray = Array(Hi, Lo) End Function Function Lsh(ByVal N, ByVal Bits) Lsh = N * (2 ^ Bits) End Function

I think I ran pretty much what is in that post, in any case, current script i'm running is: I found that, I had to replace $Domain = (Get-OHDomainInfo).Domain (just after BEGIN) with $domain = "actualdomain.sch.uk" and at the end of the script, need to specifiy the actually GUID of the gpo to look at. I think there's a few posts on internet of this technique, so script i'm actually using is from a different author I believe. There's a better write up (With screenshots) at from the original author at How to speed up login times using Group Policy Preferences and Powershell » Fear The Monkey . I've included version i'm running below in case i'd made any tweaks, but it looks same. 2 other things i've noticed causing slow mappings: 1) We use HP printers - mix of pcl5 and pcl6 universal drivers here - there's an issue with slow mapping @ "User may experience long delays when printing from a point and print client when host and printer are on different subnets" that's fixed in version 6 drivers for PCL6, but i think PCL5 still has issue until next release ;/ 2) if you see slow printer dialog boxes - Solution: Very slow printer dialog boxes in Windows (network printers) | GeoPlanIT is intersting read - suggests adding a local port to the shared printer, instead of mapping to the shared printer. I'm definitely seeing something similar on a PC with a few different drivers, so want to experiment to see if there is any merit to that article. #Requires -Version 3.0 #region General Script Info <# Author: OH Date: 17 November 2014 Rev. 1.4 Purpose: Reads the Group Policy preference item for printers and deploys \ deletes printers via Powershell script. Change Log: rev 1.4 Some targeting may include one or more 'OR' conditions. Eg the computer must exist in this OU OR that OU. This is now taken care of in the script. rev 1.3 Fixed setting default printer. rev 1.2 Added a check to see if there is a printer that is not targeted. In other words, a printer that is deployed to all users that receive the GPO. #> #endregion function Deploy-OHPrinters { [CmdletBinding()] param ( [Parameter(Mandatory=$true)] [string] $GPOGuid ) BEGIN { $Domain = (Get-OHDomainInfo).Domain [xml]$PrintersXml = Get-Content "\\$Domain\sysvol\$Domain\Policies\$GPOGuid\User\Preferences\Printers\Printers.xml" $ComputerOU = (Get-OHDomainInfo).ComputerOU #GPP Target object info (Added for code readability) [int]$Computer = 0 [int]$User = 1 } PROCESS { foreach ($Printer in $PrintersXml.Printers.SharedPrinter) { #If there is no targeting information and printer is set to create or update ie, this printer is targeted to everyone that receives this GPO... if ($printer.filters.ChildNodes.UserContext -eq $NULL -and ($printer.Properties.action -eq 'C' -or $printer.Properties.action -eq 'U')) { if ($printer.Properties.default -eq 1) { Add-OHPrinter -Printer $Printer.Properties.path -Default } else { Add-OHPrinter -Printer $Printer.Properties.path } } #Continue only if the target item in the GPP policy is against a computer object. if ($printer.filters.ChildNodes.UserContext -eq $Computer) { #The following 'foreach' line: The GPO could contain an 'or' target. eg 'If the computer exists in this OU OR that OU' so we had better check this... foreach ($OUTarget in $printer.filters.ChildNodes.Name) { if ($OUTarget -eq $computerOU){ switch ($Printer.Properties.action) { 'C' { if ($printer.Properties.default -eq 1) { Add-OHPrinter -Printer $Printer.Properties.path -Default } else { Add-OHPrinter -Printer $Printer.Properties.path } }#end 'Create' 'U' { if ($printer.Properties.default -eq 1) { Add-OHPrinter -Printer $Printer.Properties.path -Default } else { Add-OHPrinter -Printer $Printer.Properties.path } }#end 'Update' 'D' { Delete-OHPrinter -Printer $Printer.Properties.path }#end 'Delete' }#end Switch }#End Inner If }#end inner foreach }#End Outer If }#end outer foreach }#end process }#end function function Add-OHPrinter { #region Function Notes <# Using the com-object model for creating a printer connection as we are using Powershell 3.0 here with Win 7SP1 Computers. #> #endregion [CmdletBinding()] Param ( [Parameter(Position=0)] [string[]] $Printer, [switch] $Default ) BEGIN { Write-verbose "Creating COM object" $Printers = New-Object -ComObject WScript.Network } PROCESS { foreach ($p in $Printer) { Write-Verbose "Adding the printer" $Printers.AddWindowsPrinterConnection($p) If ($default) { Write-verbose "Setting default printer" $Printers.SetDefaultPrinter($p) } }#end foreach }#end process END {} } function Delete-OHPrinter { #region Function Notes <# Using the com-object model for deleting a printer connection as we are using Powershell 3.0 here with Win 7SP1 Computers. #> #endregion [CmdletBinding()] Param ( [Parameter(Position=0)] [string[]] $Printer ) BEGIN { Write-verbose "Creating COM object" $Printers = New-Object -ComObject WScript.Network } PROCESS { foreach ($p in $Printer) { Write-Verbose "Deleting the printer" $Printers.RemovePrinterConnection($p) }#end foreach }#end process END {} } function Get-OHDomainInfo { #region Function Notes <# Using this method to obtain the Computer OU and Domain as this script is run on domain computers that do not have access to the Active Directory powershell module. Otherwise, we could have used Get-ADComputer and this whole function would have been a lot easier and more 'readable'... #> #endregion $objDomain = New-Object System.DirectoryServices.DirectoryEntry $strFilter = "(&(objectCategory=computer)(name=" + $env:computername + "))" $objSearcher = New-Object System.DirectoryServices.DirectorySearcher $objSearcher.SearchRoot = $objDomain $objSearcher.Filter = $strFilter $ComputerOU = $objSearcher.FindOne().Path $pos = $ComputerOU.indexOf(",") #Now get the domain... [string]$Domain = $objdomain.distinguishedName $domain = $domain.Replace("DC=","") $domain = $domain.Replace(",",".") #And the OU the computer belongs to... $ComputerOU=$ComputerOU.substring($pos+1) #Return an object... [PSCustomObject] @{ Domain = $Domain ComputerOU = $ComputerOU PSTypename = 'MyTypes.OHComputerDomainInfo' } } #Entry point to the script Deploy-OHPrinters -GPOGuid "{***ENTERGUIDHERE***}"

For printers, and mapping them, we moved to using a GPO object with all printers in, but not linked to any OU's, and then a powershell script to map - a modified version of Dramatically Reduce Logon “Time to Desktop” By Moving From Group Policy Preferences to Powershell Logon Script | AtumVirt

Should be fine - assuming you haven't got sims summer release waiting as well - if that's already on, whether solus is running or not will be irrelevant Evidently, there's a issue where at least some pc's are hitting an timing issue with service starting (so that's going to need a new dll to fix) - I'm probably going to write a script next week to copy dll down to pc's with broken version to fix solus 3, or write a start up script /schedule that runs in background and waits 5 minutes after boot and starts solus3. Waiting to see what capita do / say their plan to fix for affected pc's is first.

Sim's support had a look this afternoon and tried out a test DLL file for solus that might fix the issue with the agent not starting. I think there's a "timing" issue that some pc's are seeing. Given there's not likely to be a sims release for a few weeks now (given normal pattern of capita), I suspect there'll be a solus update before the next release - and I'd be inclined to think waiting for that might be a sensible move for people that haven't yet pushed out 3.10 and sticking on 3.9 for now.

Just want to see if anyone else is seeing issue we are seeing with solus 3.10, or if it's unique for a few of our pc's: Is the solus 3 agent service running on the PC after a reboot ? Paul

What happens with physical access ? (surely site manager needs to un-alarm/unlock school?)