old_n07

Same here, 110 AP's (mixture of AP121's and AP330's) provided by LAN3 and installed over the Summer with the VM based controller. All is working well using Radius on the private network and we have deployed an openzone for guest access. The only issue we've found is that the latest firmware has knocked out the VOIP handsets but this appears to be a wider problem than just us and Aerohive are working on a fix for it.

Because they can then take ownership of the directory and change the permissions to lock anybody else out of it then you have to go through the process of taking ownership yourself to get back in etc.

If you are windows based this powershell script will get a list of all folders in your users share and add the following permissions Domain administrators - Full Local Admins = Full System = Full User = Modify Change the path and domain accordingly. ## Script to set permisions on folders in a directory where ## folder name is same as users SAMAccounName $path = "d:\users" #edit as necessary to reflect path where folders are located $shortdom = "somedomain" #enter your domain name #Variables $FC = "FullControl" $Mod = "Modify" $domAdmin = $shortdom + "\domain admins" $locadmin = "builtin\Administrators" $sys = "NT Authority\System" #Search directory for folders $items = get-childitem -path $path #For each item found $items | ForEach-Object { #only perform on directories if ($_.mode -match "d"){ $folder = $path + "\" + $_ $user = $Shortdom + "\" + $_ $acl = Get-Acl $folder if ($acl.AreAccessRulesProtected) { $acl.Access | % {$acl.purgeaccessrules($_.IdentityReference)} } else { $isProtected = $true $preserveInheritance = $false $acl.SetAccessRuleProtection($isProtected, $preserveInheritance) } #Set permissions routine $inheritance=[system.Security.AccessControl.InheritanceFlags]"ContainerInherit,ObjectInherit" $propagation=[system.Security.AccessControl.PropagationFlags]::None $allowdeny=[system.Security.AccessControl.AccessControlType]::Allow $account1 = $domadmin $rights1=[system.Security.AccessControl.FileSystemRights]::$FC $dirACE1=New-Object System.Security.AccessControl.FileSystemAccessRule ($account1,$rights1,$inheritance,$propagation,$allowdeny) $ACL.AddAccessRule($dirACE1) $account2 = $locadmin $rights2=[system.Security.AccessControl.FileSystemRights]::$FC $dirACE2=New-Object System.Security.AccessControl.FileSystemAccessRule ($account2,$rights2,$inheritance,$propagation,$allowdeny) $ACL.AddAccessRule($dirACE2) $account3 = $sys $rights3=[system.Security.AccessControl.FileSystemRights]::$FC $dirACE3=New-Object System.Security.AccessControl.FileSystemAccessRule ($account3,$rights3,$inheritance,$propagation,$allowdeny) $ACL.AddAccessRule($dirACE3) $account4 = $user $rights4=[system.Security.AccessControl.FileSystemRights]::$Mod $dirACE4=New-Object System.Security.AccessControl.FileSystemAccessRule ($account4,$rights4,$inheritance,$propagation,$allowdeny) $ACL.AddAccessRule($dirACE4) $acl.setowner([system.Security.Principal.NTAccount] “Administrators”) #Sets the folder owner Set-Acl -aclobject $ACL -Path $folder #write permissions to folder } }

That is basically the guide we followed, have you installe The Windows management framework on exchange and allowed port 80 through the firewall? Is "exchange.domain.internal" the FQDN of your exchange server? Edit: As a test try disabling the server firewall and try running the script to see if it is a port issue.

Are you running your code on the DC or remotely? If you want to run it remotely add this to the top of the script to create remote sessions to your DC and \ or exchange server # Connect to exchange server if ( (Get-PSSession -ComputerName email.someschool.ac.uk -ErrorAction SilentlyContinue) -eq $null) { $Sessemail = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://email.someschool.ac.uk/PowerShell/ -Authentication Kerberos Import-PSSession $Sessemail } # Connect to DC if ( (Get-PSSession -ComputerName DC.someschool.ac.uk -ErrorAction SilentlyContinue) -eq $null) { $SessDC02 = New-PSSession -computername DC.someschool.ac.uk -Authentication Kerberos Import-Module ActiveDirectory } The enable-mailbox commandlet needs Exchange 2007 or newer, as long as you have created a powershell session to the exchange server with your script you can run the command as part of the main script, you may need to put a 5 or 10 second wait into the script so the new account replicates to the exchange server or you may get an account not found error Start-Sleep -s 5 Enable-mailbox -Identity $_.SamAccountName -Alias $_.SamAccountName -Database "ExchangeDatabaseName" #creates the exchange account in the named exchange database.

Yes, they are parts taken from one script

Does your New-ADUser part of the script work when you provide the users details manually rather than pulling them from SQL?

You can use the script to create the folder and set the path and drive letter in AD We use this to create the users home folder with a hidden "redirected" folder in the home folder ($userhomfolder is a variable for the folder path) # Create folders ------ if(Test-Path $userhomefolder){} else { New-Item $userhomefolder -type directory New-Item $redirected -type directory Set-ItemProperty -path $redirected -name Attributes -Value ([system.IO.FileAttributes]::Hidden) } To set the folder path and drive letter in AD Set-ADUser $username ` -HomeDirectory $userhomefolder ` -HomeDrive "H:" ` -ProfilePath $userprofilefolder ` Setting permissions on the created folders # Set folder permissions ---------------------------------------------------------------------------------------- $FC = "FullControl" $Mod = "Modify" #Users-- $domAdmin = $Shortdom + "domain admins" $locadmin = "builtin\Administrators" $sys = "NT Authority\System" $user = $Shortdom + $username # Permissions on Home folder --- $acl = Get-Acl $userhomefolder if ($acl.AreAccessRulesProtected) { $acl.Access | % {$acl.purgeaccessrules($_.IdentityReference)} } else { $isProtected = $true $preserveInheritance = $false $acl.SetAccessRuleProtection($isProtected, $preserveInheritance) } $account1 = $domadmin $rights1=[system.Security.AccessControl.FileSystemRights]::$FC $inheritance1=[system.Security.AccessControl.InheritanceFlags]"ContainerInherit,ObjectInherit" $propagation1=[system.Security.AccessControl.PropagationFlags]::None $allowdeny1=[system.Security.AccessControl.AccessControlType]::Allow $dirACE1=New-Object System.Security.AccessControl.FileSystemAccessRule ($account1,$rights1,$inheritance1,$propagation1,$allowdeny1) $ACL.AddAccessRule($dirACE1) $account2 = $locadmin $rights2=[system.Security.AccessControl.FileSystemRights]::$FC $dirACE2=New-Object System.Security.AccessControl.FileSystemAccessRule ($account2,$rights2,$inheritance1,$propagation1,$allowdeny1) $ACL.AddAccessRule($dirACE2) $account3 = $sys $rights3=[system.Security.AccessControl.FileSystemRights]::$FC $dirACE3=New-Object System.Security.AccessControl.FileSystemAccessRule ($account3,$rights3,$inheritance1,$propagation1,$allowdeny1) $ACL.AddAccessRule($dirACE3) $account4 = $user $rights4=[system.Security.AccessControl.FileSystemRights]::$Mod $dirACE4=New-Object System.Security.AccessControl.FileSystemAccessRule ($account4,$rights4,$inheritance1,$propagation1,$allowdeny1) $ACL.AddAccessRule($dirACE4) Set-Acl -aclobject $ACL -Path $userhomefolder # Write-Host $userhomefolder Permissions added # Permissions on redirected folder --- $Racl = Get-Acl $redirected $account = $user $rights=[system.Security.AccessControl.FileSystemRights]::TakeOwnership $allowdeny=[system.Security.AccessControl.AccessControlType]::Allow $dirACE=New-Object System.Security.AccessControl.FileSystemAccessRule ($account,$rights,$allowdeny) $ACL.AddAccessRule($dirACE) Set-Acl -aclobject $ACL -Path $redirected # Write-Host $redirected Permissions added To create the mailbox # Create Mailbox ---- Enable-mailbox -Identity $username ` -Alias $username `

You need to get either a Hex USB + CAN or micro CAN interface, there are Chinese copies out there for about £20 delivered from China that run the full version of VCDS. I have had some luck with these but they stop working after a while more often than not, so you might consider getting the genuine article if you are going to use it a afew times. There are a few things like altering the coming home lights functions, coding Navigation units, altering the hazard warning lights coming on under heavey breaking etc. This is all done in the long coding of various modules. Take a look at UK-MKivs as recomended earlier.

Quadrant solutions, Equanet, Primo IT, Academia, XMA, IDN, Dell, Misco The first three get the lions share and that is due to the service from my account managers.

You could paint the unswept area of the discs but be carefull not to get it on the mating face where the wheel fits, next time you have them changed ask for Pagid discs as these come with a silver anti rust coating on them.

You can pick up 300m of external for £40, not sure how that compares to the "more reliable" home plugs cost wise but it will be far more reliable in the long run. External CAT5e

You can block programs by file hash value as well as name so regardless of what they rename the file the hash value will be the same and will be blocked. The problem with using a hash is that each new version of the file will have a different hash value.

As an alternative you could map a share for handing in homework or map a drive and have a folder in it for each teacher. Set the permissions on each folder so the teacher has modify and the students (or security group for a particular class) can list folder\read data and create files but not delete \ execute or modify them, if the student needs to submit another version they will need to give it another name.

The joys of Windows GP's, it used to be that (going back to NT) if a policy had a setting enabled you had to set it to disabled to change it as setting it back to not configured had no effect.

We had two AP330's delivered late Friday afternoon for testing

I can see the appeal of being abble to do the config via the internet cloud if you have multiple sites to look after http://i65.photobucket.com/albums/h208/old_n07/emoticons/thumbs.gif

No, we haven't used their switches got to say cosmetically they'll appeal to the Apple fan boys but I don't know how they perform as we have a Procurve wired network

It is a Macbook Pro about 18 months old IIRC, Meraki have been on the phone talking to one of the other members of our team and they were going to update the firmware to see if it makes any difference. It was just one AP put up in the office as basic test, we will be fitting four AP's (2 x MR16 + 2 x MR24) in the test area next week so we can do some proper testing including voice roaming between AP's.

We are in the process of testing Meraki, Rukus, Extricom, Aerohive, Aruba and Xirrus for the next few weeks before making a descision on a solution after having HP installed and then ripped out again because it didn't work Currently we have a Meraki MR24 installed in the office and it isn't performiing very well, it can't stream a HD video source from a local server without stuttering to a Macbook and we are also having problems with a Toshiba laptop with a Realtek wireless NIC. We are expecting the Rukus, Aerohive and Extricom kit next week so we can do some side by side testing and the other offerings by the end of the following week. We like the look of the Aerohive (with it being controler-less) and Rukus solutions but the price on the Rukus is a lot more than the Areohive when specing the triple stream AP's considering we are looking at 120 ish.

Software restriction policy is the way forward Stopping installation of Chrome, Dropbox, Spotify ? Understanding Windows 7 AppLocker

If you are using powershell to create the accounts you can do something like $user = Get-ADUser some.user $name = $user.GivenName + "." + $User.Surname Enable-mailbox -Identity $user.SAMAccountName -Alias $name I haven't tested the above but we use something similar pulling the variable from an input page when creating staff accounts. This link explains the enable mailbox PS command You will need to check for duplicates when using first.lastname email addresses too

Is it that you want the name to be Joe Bloggs in the GAL rather than joe.bloggs even though the email address is [email protected]?

We run the MF version here too with Richo copiers and have no issues with the system, simple to set up and run.

They have done it where I am, the problem was the web team were tied up with the VLE's and not able to design the modern web site the College needs \ Marketing wants and it was cheaper to outsource than employ another web designer in house. The bonus is that Marketing aren't bothering us every 5 mins with an update to the web site as they can do it themselves through the CMS system and if they have a problem they call someone else