Mustang

30 seconds is not the default although this is the default when you configure the policy and if you read the description of the policy. Here is the official wording. "if neither manual or group policy setting has been defined then the value is picked from the following registry location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History Since there is no time out period defined, the system now uses its own algorithm to calculate and arrive at an Average time out period and this value is stored in the above registry location. This could vary system to system and depends on various factors like previous login attempts. "

Again, AutoPKG and Munki

This is all off the top of my head For the license do the following As an admin register ableton then open terminal and run the following sudo mkdir -p /Library/Application\ Support/Ableton/Live\ 9.1.5/Unlock/ sudo cp ~/Library/Application\ Support/Ableton/Live\ 9.1.5/Unlock/Unlock.cfg /Library/Application\ Support/Ableton/Live\ 9.1.5/Unlock/ sudo chmod 755 /Library/Application\ Support/Ableton/Live\ 9.1.5/Unlock/Unlock.cfg For the packs do Install the packs as admin then within ableton move them to a shared location e.g. /Users/Shared/AbletonPacks close ableton then open ~/Library/Application\ Support/Ableton/Live\ 9.1.5/Options.txt and replace the reference to your username with %%USERNAME%% and save the close. open terminal and run sudo mkdir -p /Library/Preferences/Ableton/Live 9.1.5/ sudo cp ~/Library/Application\ Support/Ableton/Live\ 9.1.5/Options.txt /Library/Preferences/Ableton/Live 9.1.5/ sudo chmod 755 /Library/Preferences/Ableton/Live 9.1.5/Options.txt

This will not work. Apple has an built in update that blocks software versions it considers dangerous, the safari flash plugin being one of them. I would look into AutoPKG and Munki. You can use them so flash player gets downloaded, packaged up and then deployed automatically without lifting a finger

PowerShell.exe -windowstyle hidden \\PrintServer\Script.ps1

Why bother with a prf file?? just set the group policy to auto configure outlook for you

At minimum any fibre cable fitted these days should be at least OM3 ideally OM4 if your run is under 300m, fitting anything else is a waste of money. OM3/4 can actually support up to 100GB so its totally future proofed, for our switches the prices between 1GB links and 10GB links is only about £400 so to too bad. If your run is over 300m you need to be fitting OS1/2 fibre and then the cost of the modules will rise sharply. For internal cable there isn't any point using Cat6 is doesn't really give you anything over Cat5e, you should be looking to fit Cat6a or even Cat7 (but thats mega money and very time consuming to fit so costs more to install).

If i were you i would download a copy of mavericks now because Apple tend to hide the previous operating system from the App Store for a number of weeks when they release the latest operating system. This will give you the option to have it at hand it needed. We currently have 300 Macs running Mavericks and i would stay they run pretty smoothly, all Macs are joined to AD and users use there AD username/password to authenticate against a number of resources (Printers, Shares, Websites) without any issues. We did suffer from the permissions issue in testing but this only affects users when the Mac is setup to use network homes, we have since moved away from network home and now run local homes with the users network home share mounted at login. You will actually find a that some of the Apple applications and all of the Adobe Creative applications don't support using network home, another major advantage of this setup is its much quicker as almost everything is local. The only issue i am currently aware of is that a number of Macs (12) when resuming from sleep won't allow network login, this is cured with a reboot which isn't much of an issue as these machines have SSD's and reboot in under 10 seconds. All in all i would recommend Mavericks but i suggest that you do some serious testing first because as stated by other people in the thread there are a number of issues that may or may not affect you. As for Yosemite, we are currently using the beta version and SMB performance has massively improved but as i am sure you know everyone avoid Apples first couple of point revisions as they are normally very buggy and it takes a while for application support.

I haven't done 8 yet but i have done 4,6 and 7 on mac and pc This is all off the top of my head so it might not be accurate but it might give you a direction to head in. Server Setup ========= Activate all the licenses on propellerheads website Transfer all the licenses to the dongle using the authorizer software Insert dongle into a server and install code meter software Run code meter software and click web admin. Once in the web admin tick run as license server. Manual Client Setup ======== Install Reason on machine Open code meter software and click web admin. Enter the license servers ip Unattended Client Setup ======== Install reason with reason7.exe /slient /norestart Copy soundbank files to reason 7 install directory export license register information from a working machine and import or write powershell script to write registry information etc copy reason dat into users profile file to remove license agreement

This is the way we do it, keeps it up to date and don't have to worry about adding new versions to MDT

So did the output of "net accounts /domain" match any of your group polices You can't just do your GPO from the ground up, "Default Domain" and "Default Domain Controllers" are special policies and should NOT be unlinked or ideally edited. There is a tool to reset them to a basic state but you need to know what your doing and what will be changed.

The settings in your staff and student policies for passwords would NOT effect network users. These settings only effect local accounts on the workstations/servers so setting anything at this level is pointless, you need to be looking at your default domain policy or maybe someone has already setup Fine Grained Passwords. Logon onto a workstation and run "net accounts /domain" from the command line, does the output match your default domain policy??

"Real admins don't use a GUI" I can't remember who said it but it was someone big in the IT world. HP switches are by far the easiest switches to configure from the CLI, you will pick it up in no time and actually find it quicker. What things are you trying to do??

Surely if you are really interested in the job you might actually click the link and read the advert information. You might have just demonstrated to a future employer that you aren’t willing to investigate/research things. It seems like a really good job and if i were a little closer i would apply, good luck to everyone else.

Any reason you disable the command prompt?? There are plenty of free command prompt replacements that will run when the main one is locked down, also if the students aren't admins what are you trying to protect? As for running things as the system account, i was always taught this was a big no. If something gets hold of the aiStarter program or someone replaces it with a command prompt or something else then they have full system access.

If your users are logging in with there AD username and passwords you only need the Alias on the Desktop or in the Applications folder, when it is double clicked it will mount the share using there kerberos ticket. So mount the share on your mac, icon should appear on the desktop (if you have show connected servers turned on) Right click share name Select Make Alias Now copy Alias to all the Mac's you need Repeat for each share Job done Now all the users have to do it double click the Alias and the share will mount as needed.

Sounds like your lan driver isn't in your boot image, at the mdt login box press shift+f10 (i think) this will open a command prompted, run ipconfig /all to see if you have a network connection/ip

For 3 clients i wouldn't bother with a mac server. You can use a process called local mcx. + you download a free program called workgroup manager from apple. + run workgroup manager and point it at the local machine. + apply settings as needed (note some newer settings can't be controlled) + repeat process on remaining macs As for connecting to your windows storage, this shouldn't be a problem at all, the mac will mount the users home directory path that you have under the user account in AD. i don't know what the permission issue is that is listed above but i have ran macs connected to AD and SMB shares for 9 years and never seen this, but everyones network is different.

For those using pre shared keys and saying only IT know the key, you do know there are lots of tools out there that can recover the key once its on a system??? usually the tools require admin rights which all users shouldn't have but with it being there personal device then they will probably have admin rights. so my question is how do you stop this?? To the original question we have a separate SSID with a captive web portal which uses AD for authentication, this puts the users on a separate vlan with ACL's and then our firewall also filters traffic and only allows some ports out. For email we run exchange 2010, we only allow SSL connections to the server and if the user wants to connect there phone they are required to encrypt there device and setup a passcode.

If you already have the macs you don't need anything else you just join them to the domain like you would with a windows box. The Magic triangle setup is where you join your mac to Active directory for authentication and also join the mac to open directory so you can apply settings/lockdown to the AD user/group.

We currently use deploystudio and have done for the last 5 years, never had any trouble with it as it just works. We can deploy our thick image with OS,Office,CS6 Master Collection,Maya,Mudbox etc in about 5mins. The only downside with deploystudio is that sometimes you have to wait for it to be updated to be compatible with newer hardware models or newer OS builds but this doesn't happen that often. Although deploystudio is great, it is considered the old way of deploying things. The recommended way now is to use complete thin imaging, which means use the OS that came with the Mac and deploy the software to the Mac. We are moving over to this method and are currently using munki to deploy the software to our new Macs, with all our new Mac having solid sate drives it only takes about 20mins to install Office and ADOBE CC Master Collection. Another bonus of this approach is no thick image to maintain Both deploystudio and munki are free and are worth a look. We had a trial of casper last year and it seemed way over the top for our needs and very expensive.

Best practice is to leave the default domain and default domain controllers policies alone, both policies have special GUIDs that active directory knows to look for so if you break one you could be in trouble(depends what gets broken). They can also be used as a fail safe if somethings goes wrong, as you could unlink your custom settings knowing the default settings should work. Your current password polices settings in that policy will only affect local accounts on your windows 7 machines, you may not have noticed this if all your polices have the same settings configured i.e. Default Domain,XP,7,8 If your Forrest/Domain functionality level is at 2008 or higher you should be looking to use Active Directory Password Polices if you require different settings. If i were you i would migrate all your custom settings to separate polices but link them at the same level if needed, I would consider linking some of your settings at lower levels if possible as setting them at the top of the domain isn't good practice either. Then use the Microsoft tool to recreate the default domain policy so you know its in a good state

If your DC is running DNS which is probably is then you don't need to disable DHCP. You just need to change the clients DNS entry to point to your DC

I remember reading somewhere that you need a minimum of 3 DC to provide redundancy for the FSMO roles.

I agree with this and i have yet to see anything else that says this isn't best practice. This set is also more friendly when throwing osx into the mix.