link470

Ah that makes sense. Thank you very much! Is there any benefit to having the core at full all the time by disabling SpeedStep? Or is it safe to keep down for power saving [i assume that's what it's doing]?

Wow, don't even know why I didn't think of that. Just started up CPU-Z and ran some processes, the processor is almost always at 2800.1 except for when I ran some heavy PHP scripts and the processor core jumped to 3400.0. System performed great, then went back down to 2800.0. Looks like that's it! Thanks!!!

Hey so, here's a fun question. Just upgraded my IBM x226 from a 2.8GHz to a 3.4GHz processor. I'll be adding a second 3.4GHz as soon as I can get a VRM for the server installed. Anyway, just happened to open CPU-Z, is this normal? Haha! Something doesn't look right but maybe it's just me. BIOS is latest version. http://i198.photobucket.com/albums/aa188/link4scott/Uhhh.jpg Thanks!

Thanks so much! I'll update this thread if I have any issues but that sounds pretty straight forward. I'll start testing some policies Thanks again!

Hi everyone! Got a question here about a Terminal Server I'm configuring [Windows Server 2003 R2]. :: Some Background Info :: A department here in the school has a student information database in Access. They use an Access front end, and a MS SQL backend on the servers. I built that for them last year since before, they were using Access back ends and nothing was in sync. Now it is and everything works great. Each person has a file dsn on their ODBC configuration in their computers, and they're able to connect great. It's only 3 users at the moment. They each have their own desktops which are part of the overall staff systems and GPO's applied to Staff Computers and Staff Users. Now they want to expand the database for homestay use. The database is for international students who come to visit the school for a term/year, this is the sole purpose of this department, to manage the international students. They now want to allow select homestay users from their houses access to the database, which currently they don't have. So I'll be making them an account and setting it to Log On To: [terminal server name] so they can only access the terminal server and no computers within our school if they come here. :: What I need :: Since I'll be installing the ODBC driver on the terminal server, and putting the access front end on the terminal server for TS users to access, I'll clearly need to create some policies on the server to restrict them to JUST doing what they need to do, and accessing only the program they need. My question is, how can I create policies that effect existing users on our network ONLY when they access this server? They have their normal policies they use when they log into their own systems, but they'll need more restricted policies when accessing the terminal server. Yes, I could create them new accounts, but I'd rather have them use the same one so they don't have to remember a ton of usernames and passwords since they already use a different one for student information, the access database, their email, their windows login, I don't want them to have another for the terminal server. The only thing I can think of is a loopback policy that contains both computer configuration and user configuration [or two separate policies?] and place it under an OU with ONLY that server in it. Would that mean that any user configuration there is applied only to users who access that machine? That loopback policy wouldn't effect their normal login would it? Only other policies attached to that OU? I know I had a loopback policy awhile back attached to an OU for one thing only, but it effected all the other policies in that OU [i thought it only effected configuration in that policy]. That in theory should work, I think. Now, what do I do about administration of the server? Because I use my domain admin account to login to all the servers and perform updates and administration of the servers via RDC, wouldn't that loopback policy also apply to me, and cause me to be extremely restricted? How can I get around that? Hopefully someone has some information for me, I apologize for making such a long post haha but I greatly appreciate anyone who reads it all and hopefully understands it. I tried to include as much information as possible to make it easier to understand the situation. Thanks so much!

I personally use the Barracuda Web Filter 310, newest firmware blocks HTTPS traffic as well. Plus when you can make custom block pages with the "I see what you did there" lawlcat, kids almost TRY to go to a blocked site so they can see the image and laugh. Only down side is the Barracuda Web Filter and Energy Updates for one year are not cheap. About $500 US for Energy Updates for a year, and the actual unit was around $2000 when I purchased it.

Hello everyone! I'm working on trying to solve an issue with my ISA server here. First off, I'm extremely new to ISA, and I'm trying to configure it as a Reverse Proxy as you guys recommended so I can get several servers behind it all under same port numbers with a single IP address. So! With that out of the way, I'm working on getting some policies installed on the thing to test it. I'm using ISA 2006 Enterprise installed on a single box [configuration storage server and ISA firewall on the same box] so when I open the ISA Server Management I see both the Enterprise policies at the top left and Array's [with my single ISA server] down the left just below it. The problem is that I cannot for the life of me make an Array policy that isn't denied by the default Deny rules under the Enterprise rules. I created a second Enterprise Policy with the name of the server, and went to the Array firewall properties and told it to use that enterprise policy instead of the default one. But that won't work either as by default every Enterprise policy seems to be created with the Deny rule. That's totally ok, I understand why the Deny rule is there for security to block out everything except what's specifically allowed, however I can't make a single Array policy that works. If I create a policy however such as allow RDP access to the ISA server from an IP address [my home network], I have to create that policy under enterprise policies. If I create both an Array firewall rule, and an enterprise policy rule, disable one, then disable the other, I've found only the enterprise one works, if just the array rule is on, the log says that the Default Deny rule is stopping the connection. I'd really really really appreciate some help with this one, I'm very confused and would love to get this up and running soon. Here's the full post I've been making at ISAServer.org, also not yet answered. Thanks so much!

Hey everyone, I hope your start to the school year has been good so far! I have a question for you guys that I've been trying to solve for awhile. Some of you may remember this post I made awhile back. I had a server at the district [still do] that's on our network, but, uses an external address of it's own. I needed a separate domain name pointed to that system for a different organization within our school but it had to be on that server and not our main web server. So what I ended up doing was having the first NIC on the internal network so I could still manage the system RDC style through the local network and also connect it to our domain etc. Then the second NIC had an external IP address I set manually from within our Class C range we get from our ISP. That connection there is the one that never wants to stay alive and accepting connections. The fix? I found that by right clicking on the external network connection and choosing repair, it fixed the issue and external clients were able to connect to the server again. That kept the server up and running for another 5, 10, 15, 20, 25, 30 etc. hours, whatever it felt like that day. But what exactly during the repair process fixed it? I looked up the exact commands "Repair" performed, and tried them individually and testing after each command, and found that ipconfig /registerdns was the command that fixed the connection. For the last year or so that server at the district has been kept alive by running ipconfig /registerdns as a scheduled task once every 15 minutes. Yes, it works, yes, it's a band aid fix and I don't like those. So now I have my ISA server here on my home network as I was talking about doing here. Finally getting some time to configure it, and I've got 2 IP addresses coming from my ISP. One going to my main home network, the other, hopefully going to an external interface on the ISA server. The ISA server works great so far in testing. It's sitting just standalone at the moment. To get the two IP's from the ISP both at once what I do is have the ISP's modem connected to a switch instead of my home router, then one cable from the switch goes to my home router, one cable from the switch goes to the ISA server external interface, and voila, two networks. The problem is that ISA server ALSO fails to accept connections unless I run ipconfig /registerdns. I've checked the connection properties, the connection is set to register itself with DNS, the DNS servers are the two DNS servers at my ISP, and the external address is one that I've been using for ages and decided to just set it as a static so I could hold onto it [i know there isn't a reservation at the ISP level for me but I figured I'd just take the address ]. I didn't think it would be an issue though because the Class C subnet we have at the district is ours and only ours so we can create whatever we want within that range and I'm still having problems with THAT external connection. The situations are slightly different but the problem is identical, with an identical band aid solution. How can I properly run these systems without having to do ipconfig /registerdns? I've been searching google for around 8 hours now that I know the issue and what's happening, but I can't find a solution. The odd time though I'll find someone who has to do the same thing on google, type ipconfig /registerdns, but they haven't found a solution either. So I came to the best resource I know of. You guys. This only seems to happen when using a static IP it looks like. Thanks a ton!

All great ideas so far. Another thing you can do is just create a new DNS entry in your DNS server and set the domain.TLD you want to block to point to 127.0.0.1. The address never gets resolved, and you get nothing but a blank page. Or, change the IP address it points to to google.co.uk's IP address so at least they get Google.

I was able to edit the permissions and still block the registry and everything seems to work great. No problems!

Original Title: How do I allow students access to a required registry key when regedit is blocked? Alright so I've got an interesting situation. Like I'm sure many of you do, I prevent access to the registry editor via GPO to the systems here at the school as one of the many applied policies, however, one of our software packages, Vectorworks 12.5.3, requires reading the registry at start up of the application in order to run, otherwise it can't read the programs registration information, and says Vectorworks requires a key to properly run. If I log into an account that doesn't have the policy enabled for blocking access to the registry, Vectorworks starts up perfectly. Is there a way I can still prevent access to the registry editor, but ALSO allow Vectorworks to read the registry and start up properly? Thanks!

Ya I think that's what I'm going to do. Run a backup to a local folder and then run ntbackup to send the contents of the local backup folder to the backup server.

Thank you very much for taking the time to clarify that. I'm going to give er a try today and see what I can do. Thanks so much! I'll let you know how it goes if I remember. Edit: I think I have everything right with the syntax. I've got the script outputting a log. The backup doesn't want to take place because I'm still receiving the access is denied message. I researched on Microsoft's website and found that the SQL Express service has to be started with an account that has access to that share instead of the local service. So I created a new account and made the changes to the share so the new account could access the share. Then I edited the services to start with the new account I had created. It worked, fired up the service great. SQL's running correctly. Now I go to run the backup script again, and it fails with the same access denied message. Is there anything else I'm obviously doing wrong? Thanks!

I was wondering about that but I'm not sure if that would work, it looks like you call the database in the first part of the script up top. Then down below in the bat file you have to do servername and something else for "instance". How is that written? Thanks!

My bad, but what's a "server instance"? How would I write the server and then instance there? Thanks!

Hi everyone, Got a question here on MS SQL. I have 2 MS SQL servers, both the 2005 edition and running the SQL Server Management Studio. One of the servers is the full software suite, the other is the express suite due to not having a second license. Both work great. So here's the issue, I've been programming proper backup schedules over the summer. Everything runs at it's specified time, all files etc. and important items on the network are now backed up automagically, and the only part I'm wondering about now is these two SQL servers and how to back them up. I started with a Maintenance plan in SQL Server 2005 [Full] and thought I could program a backup there, but it didn't like that. I'm trying to backup to a UNC path. However, when I enter in a UNC path the backup errors out and doesn't like it. When I was originally configuring the backup, it took me about 12 clicks of the OK button at the bottom before it finally accepted the UNC path, it kept saying it couldn't resolve the path I had placed in there for where the backup was to be sent. Somehow I had the great idea of continuously clicking ok, and it accepted and allowed it. Now if I go in and edit it, place in the same UNC path, it accepts it [weird]. So anyway, I tried to run the backup and again I get an error. I checked the logs and it said access is denied when trying to create the backup at that location. I've been backing up with an account for backups only, and my domain administrator account, those are the only 2 users who have access to the backups, no other users can read them or write to those shares. So I thought ok, MAYBE it's because I'm using the SA account as SQL authentication and not my integrated Windows login. So I tried logging in as integrated while logged into my domain administrator account and to verify I had access, I entered in the UNC path into the run command in windows and made a new folder in the share when it came up. So far so good, nothing wrong with the share. So the only issue now is getting MS SQL to actually write to the share. Am I doing anything wrong that you can see? As an alternative, I know SQL Express isn't going to allow me to do that since there's no automated backups. Is it possible for these two database servers, to just backup the database folder in program files that holds the actual databases using NTBackup? Or is that a bad idea? Thanks! Edit: Just changed the backup location to my desktop in a new folder and it works perfectly there.

Excellent thanks guys, that confirms what I thought it was. I enabled the wait for the network GPO, and staff were still having problems, and that's when I realized wait, that GPO will be applied at the same time the new password policy was so I'm starting up some systems, leaving them on for a couple minutes, and turning them off again until staff come in haha! So far they're working! Thanks again.

Ah, makes sense. I'll give that a shot, thanks!

Original Title: Users are required to change their password...but only takes effect at second logon? Hello! Hope everyone's been having a good summer. I'm back at the district now and I thought well, since the policies at the school here haven't been enforcing password policies at all, I'm at least going to go through all the staff in Active Directory and click "User must change password at next logon" and make them have a password at least 7 characters long. No problem. Oh wait... I start getting a few staff members who have come in early [only 4 so far luckily but all with identical issues] who have come up to me and said when they login they don't have access to any network drives, network services, or anything that they need to be authenticated for. When I ask each of them if they received a dialog box asking them to change their password, they all said they didn't. However, if they log off, and log back on, the box appears instantly, and they change their password, login, and they're good to go. No problems. But why is there that delay? I understand cached logins, but why the second time and not the first? I don't want people to be panicking or to put out a notice to log on, log off, and log on again the first time they log in. Any help would be greatly appreciated on how I can easily resolve that issue. Thanks so much!

That's the problem I'm having here and expected. Only a couple complaints so far, but to be expected. I'm trying some things and am going to revert back to no screen saver policy for a couple days while I test some systems. To revert back, I can't just set those policies to Not Defined again can I? Cause won't whatever was applied last stay? Do I need to set them as disabled if I wish to remove it?

So last night I decided I'd enable a Screen Saver lockout policy. All Screen Savers in the building for staff accounts only lock out after 5 minutes. I taught them the Windows Key + L combination for locking their systems last year and you guys as systems engineers as well would know how many people actually do that, I'll give you a hint, it's less than 5 So I enabled the Screen Saver policy. Of course, it's now the next morning, and I've received one complaint. The only complaint was that the office staff didn't want it. What was funny about that was they said "ya we just get up and go to the file room for a second and get some files, go to put my lunch away in the fridge, and then come back, and it's locked and we have to type in our password" as I give them a rather blank look thinking to myself "yes, there lies the vulnerability, that's why it's locked. I'm sorry I took a second out of your day to retype it and secure your system while you left it " Oh well, I bumped it up to 10 minutes for them, we'll see how it goes. So anyways, what I'm wondering is, well, first off, what are your opinions and successes of the lockout policy? I enabled it first off because of course we have some people called students in the building and as charming as a lot of them are, as a security precaution I prefer the systems with raised privileges, the staff, have a locked system. What are your stories about using the Screen Saver and a wake up password prompt? Ok, now for the question. The teachers can log into projector laptops, as can the students. Since the GPO is applied to all staff, if the staff log into a laptop, the policy still applies. Now, for PowerPoint and Windows Media Player, that's not a problem, because as far as I know those programs temporarily disable the Screen Saver, but if the teacher has a word document up on the screen or something with notes for the students, or even a youtube clip, the screen saver will activate after 5 minutes. Is there a way to NOT apply the policy IF the teachers are signed into a certain system? I know that might be hard, and I have bad experience with loopback policies screwing things up, but if anyone has similar situations or suggestions that would be totally rad. Thanks again! Stay cool. It's getting hot out here where I live. Thank God the server room is the coolest place in the building due to AC.

Just to check is that 1 or L ? It's a one [1]. The event I was prepping these for is over so no pressure for time now [event went great! ended up just having the machines start Starcraft from the Startup folder, and luckily, they never wanted to quit Starcraft! They just played that all night then shut the machines down lol] but I'm keeping the machines and making modifications to them so I can use them again I'll give that a shot, thanks!

Just tried this solution out of desperation. Still doesn't work. I end up getting a command prompt window that comes up with the first line, start /wait "C:\Program Files\Microsoft Games\Age Of Empires II\EMPIRES2.EXE" and then just sits there and another command prompt window pops up and starts the command at a wierd place that has nothing to do with the script. I close that window, and the original command window asks me if I want to terminate the process. If I say no, it shows shutdown /1, disappears, and doesn't logout. If I choose yes, it closes, and doesn't log out as well. Thanks anyway!

Just tried that, and it worked perfectly, started notepad on login, and logged me out when I closed notepad. I tried the game path again, and it gave me the cannot find the file specified message again. So I copied the location directly from the code, between the " signs since it has spaces in it, and pasted it into start>run, and the game launched perfectly, so I know the file path is good. Could it be that it's not accepting spaces? I tried something else too. I added the C:\Program Files\Microsoft Games\Age Of Empires etc folder to the system path, and tried just adding EMPIRES2.exe in the code to see if that was the issue. Doesn't work then either, system cannot find the file specified. Thanks for your help!

Hmm, I'm getting an error on Line 3 character 1, the system cannot find the specified file.