minimoo

you can change it - apart from the fact they forgot to update the WIX config for the msi installer generation to take account of the new xml transformation that need to add to handle setting the correct port for the new front end UI - First demo to colleague of the new 'check for updates' that should make his life easier crashed solus as it couldn't connect to server.. We've spent a fair chunk of time trying to ensure that all solus agents are upgrading correctly, although - i'm also quite tempted to look at scrapping solus 3 and looking at using APPV5 to deploy SIM's to reduce the amount of time spent managing solus 3. Don't really want to do that as whilst it should work, if any weird issues occur, it could make getting support slightly harder.

Matt, I know when we first moved to solus 3 - we hit issues early on with solus service(s) not starting due to windows using the same port - fix for that at the time with capita support was to change the port below 49151 (to avoid colliding with windows). This has worked fine up until 3.8.53 where we hit the problem that the MSI installer hasn't been updated to customise the new configuration entry for the local 'check for updates' button (easily worked-around by a custom powershell script). However, in terms of your question - if I look at RFC6335 which covers the port number /service name procedures - the following text seems to state that applications "MUST NOT" use a static port within the dynamic range: " Ports in the Dynamic Ports range (49152-65535) have been specifically set aside for local and dynamic use and cannot be assigned through IANA. Application software may simply use any dynamic port that is available on the local host, without any sort of assignment. On the other hand, application software MUST NOT assume that a specific port number in the Dynamic Ports range will always be available for communication at all times, and a port number in that range hence MUST NOT be used as a service identifier."

The 1-2 second delay clicking on buttons is mildly annoying, however, I find it's the amount of troubleshooting/baby-sitting it requires (when compared to other things e.g. windows updates / sophos deployments etc). As an example, we deployed solus 3.7 on 27/6/2014, and currently have 10 agents that are still running the 3.6.94 release of solus - in some cases, are on the latest sims, but old solus. We've spent the last month gradually trying to locate PC's around site that haven't applied windows updates or solus updates and fixing. Both solus/windows updates etc can get into a state where they don't update due to corruption, power cut at wrong time etc, but it's definitely more time consuming dealing with solus compared to some of the other deployment solutions out there. Although equally, credit where it's due - solus has been getting better at each iteration - and some of the stuck old agents are due to old issues that have already been fixed so won't happen again in the future. However, IMO at least, capita made a bad design decision with their choice of TCP port. Until we changed the port that Solus used two years ago, we used to get random failures due to capita using a port in the middle of the range Microsoft state windows uses for outgoing connections (The default dynamic port range for TCP/IP has changed in Windows Vista and in Windows Server 2008). @PhilNeal: I'm somewhat surprised Capita didn't change the solus port to something outside this range 2 years ago, and request an assignment @ IANA — Application for Port Number or Service Name. As well as microsoft, that form lists "User port numbers range between 1024 and 49151." as the user-assignable port range for TCP... Any idea why the default port currently used was picked? Paul

Do you have NT Authority\System as a SQL SA out of interest?

Updated to autumn last night - and no issues so far with that. Will be looking at sims service manager later today I think

In terms of why solus didn't update for us: seems we hadn't set local system as SQL sysadmin permissions - don't recall seeing that in any of the solus guidance I've read ;/

I seem to recall posting around summer that I thought releases had got better over the years. Summer was only 2 releases, although I'm waiting to see if the reporting functionality that broke in the first release (which support said was going to be fixed in 2nd), and apparently has now been fixed in autumn is actually fixed in the autumn release. In any case, logged a support case for the failed solus upgrade earlier today - depending on whether or not solus agent whines at staff aka shows a "cant connect to deployment service" dialog (I think it might) , or sits quietly in the background, i'll be ringing helpdesk when they open monday If silent error in background = minor fault, if tells all staff deployment service is not running = critical issue affecting all users. The only thing I can't decide is - where we've invested a fair chunk of time making sure solus works - now solus adds "let end users unzip packages to do their own thing" is whether to look to moving away from solus to app-v.

Thought I'd try the solus 3.8 update - now that wasn't such a good idea ;/ Has anyone tried the sims side yet - I was planning to do after school on monday? 2014-11-15 11:43:47.0093|Info|Deployment Service started. 2014-11-15 11:43:48.9525|Info|Agent APPSRV is progressing Tgt 2950, Pkg 46024b59-e348-4e31-a0d4-f8326d954ef1, Update was successfully installed. 2014-11-15 11:43:49.2615|Error|Invalid column name 'auto_extract_folder'. 2014-11-15 11:43:49.2615|Debug|An error occurred while executing the command definition. See the inner exception for details. System.Data.EntityCommandExecutionException: An error occurred while executing the command definition. See the inner exception for details. ---> System.Data.SqlClient.SqlException: Invalid column name 'auto_extract_folder'.

it wasn't a post - that was a copy/paste from the source code.

I know i'm jumping in mid thread, "problem with websites security certificate" - if you hit details in the browser, what does it actually say it doesn't like about it?

What version of HAP are you running? (as I thought i'd taken a stab at fixing this before)

Nick's got a different error message logged elsewhere with a similar line of code: new Exception("I cannot impersonate " + this.UserName + " due to an issue logging onto the domain " + this.DomainName + " using an Interactive Login. HAP+ Requires Interactive Login Rights on the Server it is running on"); So using that for hints: a) has this worked previously? b) I wonder if the account trying to login doesn't have interactive login rights - only thing i'm not sure at this point is whether the *account* is that of HAP , or that of the end user

Hi all, I should add that I'm not actually running this version of the script - I wrote this script with the aim of reducing wireless traffic starting papercut, but never got around to putting it live - tested it on my box wiht various scenarios but never went live. Anyway, disclaimer over, the script I came up with to run as a logon script was a vbs script as follows: Set WshShell = WScript.CreateObject("WScript.Shell") PapercutPath = "\\printserver\pcclient\win" PapercutCachePath = "c:\cache" ClientArguments = " --silent --minimized --neverrequestidentity" LocalVersion = GetLocalPaperCutVersion(PapercutCachePath) NetworkVersion = GetNetworkPaperCutVersion(PapercutPath) Wscript.Echo "Local: " & LocalVersion Wscript.Echo "Network: " & NetworkVersion ClientToExecute = "" Select Case CompareVersions( NetworkVersion, LocalVersion ) Case -1 ' Local Version 'newer' then network i.e. network not found ClientToExecute = PapercutCachePath & "\pc-client.exe-" & LocalVersion & "\pc-client.exe" Case 0 ' Versions match, therefore local ClientToExecute = PapercutCachePath & "\pc-client.exe-" & LocalVersion & "\pc-client.exe" Case 1 'Network Update Available ClientToExecute = PapercutPath & "\pc-client-local-cache.exe" End Select Set objFSO = CreateObject( "Scripting.FileSystemObject" ) Wscript.Echo "Client To Execute: " & ClientToExecute If objFSO.FileExists(ClientToExecute) Then WshShell.Run ClientToExecute & " " & ClientArguments End If Function GetLocalPaperCutVersion( Path) Dim fs, f, f1, fc, s, Version1 Set fs = CreateObject("Scripting.FileSystemObject") Version1 = "0.0.0.0" if fs.FolderExists( Path ) then Set f = fs.GetFolder(Path) Set fc = f.SubFolders For Each f1 in fc If InStr(1, f1.name, "pc-client.exe-") > 0 then Version2 = Replace( f1.name, "pc-client.exe-","") if CompareVersions( Version2, Version1 ) = 1 Then Version1 = Version2 End If End If Next End If GetLocalPaperCutVersion = Version1 End Function Function GetNetworkPaperCutVersion( Path ) Const ForReading = 1 Dim intEqualPos Dim objFSO, objIniFile Dim strFilePath, strKey, strLeftString, strLine, strSection Set objFSO = CreateObject( "Scripting.FileSystemObject" ) strFilePath = Path & "\version.txt" If objFSO.FileExists( strFilePath ) Then Set objIniFile = objFSO.OpenTextFile( strFilePath, ForReading, False ) Do While objIniFile.AtEndOfStream = False strLine = Trim( objIniFile.ReadLine ) ' Check if section is found in the current line If LCase( strLine ) = "[version]" Then strLine = Trim( objIniFile.ReadLine ) ' Parse lines until the next section is reached Do While Left( strLine, 1 ) <> "[" ' Find position of equal sign in the line intEqualPos = InStr( 1, strLine, "=", 1 ) If intEqualPos > 0 Then strLeftString = Trim( Left( strLine, intEqualPos - 1 ) ) ' Check if item is found in the current line If LCase( strLeftString ) = "version-build" Then StrBuild = Trim( Mid( strLine, intEqualPos + 1 ) ) If StrBuild = "" Then ' item exists but value is blank StrBuild = "0" End If End If If LCase( strLeftString ) = "version-minor" Then StrMinor = Trim( Mid( strLine, intEqualPos + 1 ) ) If StrMinor = "" Then ' item exists but value is blank StrMinor = "0" End If End If If LCase( strLeftString ) = "version-major" Then StrMajor = Trim( Mid( strLine, intEqualPos + 1 ) ) If StrMajor = "" Then ' item exists but value is blank StrMajor = "0" End If End If End If ' Abort if the end of the INI file is reached If objIniFile.AtEndOfStream Then Exit Do ' Continue with next line strLine = Trim( objIniFile.ReadLine ) Loop Exit Do End If Loop GetNetworkPaperCutVersion = StrMajor & "." & StrMinor & ".0." & StrBuild objIniFile.Close Else GetNetworkPaperCutVersion = "0.0.0.0" End If End Function ' Bitwise left shift Function Lsh(ByVal N, ByVal Bits) Lsh = N * (2 ^ Bits) End Function ' Returns a version string "a.b.c.d" as a two-element numeric ' array. The first array element is the most significant 32 bits, ' and the second element is the least significant 32 bits. Function GetVersionStringAsArray(ByVal Version) Dim VersionAll, VersionParts, N VersionAll = Array(0, 0, 0, 0) VersionParts = Split(Version, ".") For N = 0 To UBound(VersionParts) VersionAll(N) = CLng(VersionParts(N)) Next Dim Hi, Lo Hi = Lsh(VersionAll(0), 16) + VersionAll(1) Lo = Lsh(VersionAll(2), 16) + VersionAll(3) GetVersionStringAsArray = Array(Hi, Lo) End Function ' Compares two versions "a.b.c.d". If Version1 < Version2, ' returns -1. If Version1 = Version2, returns 0. ' If Version1 > Version2, returns 1. Function CompareVersions(ByVal Version1, ByVal Version2) Dim Ver1, Ver2, Result Ver1 = GetVersionStringAsArray(Version1) Ver2 = GetVersionStringAsArray(Version2) If Ver1(0) < Ver2(0) Then Result = -1 ElseIf Ver1(0) = Ver2(0) Then If Ver1(1) < Ver2(1) Then Result = -1 ElseIf Ver1(1) = Ver2(1) Then Result = 0 Else Result = 1 End If Else Result = 1 End If CompareVersions = Result End Function In theory, you only need to change the first line of the script to point to your server path i.e. set PapercutPath and ClientArguments (if you want to do something fancy) 2nd disclaimer, some of the version check code, I pulled from google so it's not all mine.

Powershell Given microsoft's changes to try and push powershell / gui-less servers etc, it's probably worth spending a bit of time learning it. I've spent last few months on and off porting some old c# code (that used to create AD users etc) to powershell. The New-AdUser cmdlet, generates an AD user, we use similar to the below for parent accounts: New-ADUser -Name $username -SamAccountName $username -GivenName $forename -Surname $surname -DisplayName $display -Path $path -AccountPassword (ConvertTo-SecureString $password -AsPlainText -force) -PasswordNeverExpires $True -Enabled $true -Description $id -UserPrincipalName $upn For students/staff etc, you'd probably want to add some additional options i.e. home directory Following adds a user to a group: Add-ADGroupMember $group $username

ADDS: Deploying the 1st W2K8 R2 or later DC in an existing forest may temporarily halt AD replication to strict mode destination DCs for up to 12 hours seems to imply that isREcycled is set on deleted objects to 1 when the first windows 2008 r2 dc is promoted - which would imply that you can have isRecycled set to true even if before setting the functional level of the domain/forest. Doesn't really help you though.

In windows 7/8 you probably want to be using applocker. You can run it in audit mode and it'll just log to a custom event log. I've been trying to set up a ruleset at work (as we used to use SRP a lot with XP) and haven't really done much since moving to windows 7. As nick says, you probably want to deny all by default, allow network shares that you put stuff on (i.e. sysvol), and allow c:\, then deny folders that end users can write to. (and use the auditing mode to see if you've missed anything before you go live) Accesschk/accessenum from File and Disk Utilities: Sysinternals Center can be useful in finding places where students have write access.

We've got a kemp VM as a load balancer to purely do inbound publishing as they do multi-site authentication a bit like TMG did. Works a bit differently - I *think* it only supports Basic auth onwards (whereas I think windows support kerberos and everything else), but may be worth a look as it's the closest thing I could find. We moved from TMG to Watchguard+Kemp.

what's the full exception?

Capita added a knowledge base article (KB118196) a month ago about removing the date: "It is not possible to Print student timetables without the page number, date and time being printed at the bottom of the page. If the timetable is exported, the page number, date and time will not be printed. " ... and now that you guys have pointed out to me the old 32bit only functionality has gone, I need to remember why we always ended up using it in september over the new functionality before that becomes an issue.

Just done the new summer update - it fixes the assessment manager issues, but the custom report definition we have that worked up until we deployed the first summer release is still giving wrong output for us. So time to ring Capita and see whether they think there's a bug somewhere or a change in behaviour that was planned.

me soon

Hi Pbad, I've done a number of improvements to the booking system in HAP recently, so it's now quite flexible (booking rules allow some quite funky stuff to be achieved), if you let me know whether you've resolved any issues from Nick's advice, I can probably see if I can assist with anything left I notice you are handling bookings for netbook's - where I work, we define a booking rule to show the room as busy on the day. As i'm quite interested to know if other end users find the ability to add rules useful

This will be the 2nd release - we'll be applying it tonight if it comes out. I'm hoping it gets released soon so I can deploy before the helpdesk go home for the day

I've tended to do them at the end of a day, with varying degrees of success: If you do an update at 8AM, there is a risk that it would over run (and still be running at 8:45 for registration). I tend to do a sims update on a Monday/Wednesday after school (we have assembly tue/thu so longer form time for staff) - if I kick the update off at 4pm as soon as lessons finish, I can catch machines before they go to sleep / shut down in the evening). I generally find of 600 Machines running sims (~100 of which are laptops) that I can hit 2-300 with a successful update. However, I tend to find I get about 10-20 failed installs at this time - as either a) staff still have sims open (Phil Neals recent reply to me on the sims summer 2014 thread suggests this will be fixed in solus 3.8), and b) staff shut the pc down whilst sims is installing. In the morning, majority of PC's pick up the update fine - and we get a handful of staff that report issues as they don't wait long enough for it to update which fix themselves. This tends to leave a few pc's that need a manual redeploy/kick in some way which is then manageable. When you say 80% of the machines deploy first time, are you having to visit them / kick them, or just be patient for it to go through?

Cool!!! I still remember Sally (previous solus analyst) giving the answer that came back to her of "we don't really want to kill sims.net if it's open when an update happens", and thinking that's nuts It sounds like 3.8 may fix some of the last 'design issues' in solus3 that actually cause grief on a regular basis - at least for us. The only issue that I think will remain if the fixes you describe go in, and I believe is specific to us - is that we sometimes see the contents of some of the supporting DLL files for the agent get zero'd, if a PC Bluescreen's. I've never seen that in my life to any file apart from 3 dll's in the solus directory, and i'm fairly confident I can't blame Capita for this... So It's definitely getting there