jonathanhaddock

Yep that's what I'm planning. Any experience of doing it cross-vendor?

Good morning edugeekers! I'm planning to setup port trunking between a HP Procurve 4108GL and Netgear Prosafe GS748TS - want to take 2 fibre connections and trunk into a 2GB link. Has anybody done this before? I'm conscious there may be subtle differences between the 2 manufacturers so figured I'd check out the feasibility before I jump right in. Looks like I don't have a spare GBIC in the HP so can't do this immediately anyway! Thanks in advance, Jony

Hi Guys, I appreciate I'm tagging on to an old thread but thought people might like to know MST is open again: MST | Simple Software Solutions

I've just created 127 new users and run the script against their OU and it still seems fine in my environment. Now slightly paranoid but like Ric_ says, it's not "my fault" so I'm guessing there's a bug in Exchange's powershell somewhere?

Hmmm, that's odd but thanks for saying it's not my fault. Unfortunately, I don't have a test environment that mimics what you've got so can't test - might set one up at home to satisfy my curiosity though. I'm guessing the AD recycle bin doesn't work at that functionality level? So you've got: 1x 2008 R2 DC 1x 2003 R2 DC 1x Exchange 2010 server ? When I ran the script there were users that errored if they were disabled or already mail enabled but they definitely still exist here, must be something to do with the combination....

@Ric_ Thanks for the clarification - you certainly had me worried that I'd done something wrong. I appreciate it doesn't help you but I'm happy to say it wasn't the script that did the deed. Was anything else happening in your domain at the time? What OS and domain/forest functionality level are you on? Jonathan

The script shouldn't be able to delete anything - there's no delete line in the script anywhere! If it encounters an already email enabled user it errors saying it can't create one but I've not had any users deleted or vanish as a result. I've run the script on about 10 OUs in my domain and all was successful. If the script encounters a disabled user it won't create the mail box. @Ric_ - can you confirm the users are definitely gone? @AlexPilot That's what I was doing, targeting a single OU at a time... Jonathan (sorry for delayed response, was on holiday with no Internet)

Ok, at the risk of sounding presumptuous I'm going to mark this post as the answer. I had to write a powershell script to do this. Naturally I ran it up in a test environment first. Attached is a txt with the script which is also below: # PowerShell find UPN of users in the given OU and create Exchange Mailbox with the alias == UPN # If the mailbox already exists, the script errors on that entry. # Author: Jonathan Haddock, following an example PS foreach script from Guy Thomas # ([url=http://www.computerperformance.co.uk/powershell/powershell_active_directory.htm]PowerShell - Active Directory LDAP DirectoryServices.DirectoryEntry[/url]) # Version 1, August 2010, tested with WinSvr 2008 R2 Stnd and Exchange 2010 Stnd $Dom = 'LDAP://OU=Dummy;OU=Students;OU=User;DC=bcgs;DC=local' $Root = New-Object DirectoryServices.DirectoryEntry $Dom $i=0 # Create a selector and start searching from the Root of AD $selector = New-Object DirectoryServices.DirectorySearcher $selector.SearchRoot = $root $adobj= $selector.findall() |` where {$_.properties.objectcategory -match "CN=Person"} foreach ($person in $adobj){ $prop=$person.properties $i++ # In AD the property is userPrincipalName however, PS makes the attribute lower case, hence userprincipalname $upn = $prop.userprincipalname[0] # The UPN contains @ followed by the suffix, we only want the UPN prefix so we use split: $upnsplit = $upn.split("@") $alias = $upnsplit[0] # Output the alias to the screen: Write-host $alias # Enable the exchange mailbox Enable-Mailbox -Identity "$upn" -Alias "$alias" } "Total $i" Please note: I take no responsibility for what this script may do to your Exchange 2010 system. I have tested the script and it works fine in my environment but there is no guarantee it will work the same in yours. Thanks for everyone else's help on this! MakeMailboxesForAnOU.txt

Hi Again, I'm in the process of writing a script which does what I outlined above, without using Set-MailUser. Running it up in a test environment first - if it works I'll provide a copy...

No worries djm, just slightly depressed that although alias should automatically set to username that it doesn't seem to be. Do you know any good powershell tutorial sites? I'm thinking my script needs to: 1) Connect to AD 2) From the specified OU, run a for each against all user objects (CN=user) that: a) finds the upn prefix for the user b) runs the Enable-Mailbox command with -alias set to the upn prefix 3) Report when complete Forunately, I have a test domain already for this - just going to be a pita learning power shell in a hurry! Jonathan

Thanks for the reply but unfortunately that's not the answer. This only allows you to base the email addresses on: I think I'll need to learn PowerShell quickly in order to do this en masse and get this done, looks like exchange doesn't allow you to use username@ by default (which you'd think was an oversight).

Afternoon all, I'm setting up our new Exchange 2010 server, moving away from Desknow (DeskNow - Mail and collaboration server, hardly anyone's ever heard of it, falls into the "poor" bracket, not my choice gladly). What I'm stumbling on is the email addresses. My internal domain is of the form bcgs.local, externally that's bartoncourt.org - no problem, I've created an email address policy and set up the accepted domains that covers that. The problem is, the email address the email policy sets up isn't the same as the present email address users expect: * previously, email addresses were of the form [email protected] * the email address policy, set to "alias@accepteddomain" (so "[email protected]") isn't the same - although alias should equal the username ("By default, this field is populated based on the User logon name (User Principal Name) of the user." (How to Create a Mailbox for a New User: Exchange 2007 Help) ). So, does anyone know how to fix this frustraing problem? Otherwise I'll end up setting up each account individually just so I can specify the email address (alias) correctly. Thanks in advance, Jony

Hi all, We've got controlled assessments coming up and for some subjects that means disabling the proofing tools (both spell check and grammar check). Does anybody know how to do this using the Office 2007 Administrative Templates and Group Policy? I've looked for the obvious disable proofing tools but that hasn't yielded anything helpful...any suggestions? Thanks in advance guys, Jonathan

Hiya Craig, Here's a copy of my script - looks like I heavily commented it at the time of writing. When the script starts to run it files an event in the Application log (event source of WSH if memory serves), then another entry explaining what it determines the printer to be and then one entry when the script finishes. The script determines what printers should be mapped dependant on the computer name so you'll need to customise that a bit. Any problems shout me! Never seen "Loading your settings failed. (access denied)" other than a profile error - is it definitely coming up as a result of the logon script? I trust you're only specifying logon scripts at one point in the GPO tree? Jonathan ' VBScript to map printers - Windows User logon script ' ---------------------------------------- ' Put in place on Barton Court's network Summer 2008 ' Jonathan Haddock, Network Manager ' Last modified: ' 2009-05-28 (JHA) to add logging to the script. ' Previously modified 2009-05-21 to take into consideration the art room and actually fix the code I left broken. ' this script: ' 0) Removes all old networked printers ' 1) Checks to see if the computer is in the library (computers called LIBx) or IB Center (IBx) ' 2) If not in either of the above, checks to see if the computer is in a "room" (i.e. has computer name rmxxyy) ' 3) Dependant on which room the printer is in, we set the vales for the black and colour variables accordingly ' 4) If the computer name doesn't show any of these rooms, do nothing ' ---------------------------------------- ' If a variable is not defined, complain: Option Explicit ' If there's an error, continue: On Error Resume Next ' Define the variables (if you don't define the variables here you WILL get an error: Dim WSHNetwork, WSHPrinters, LOOP_COUNTER, net, workstation, location, multiPrinter, black, colour, Message, Logit, Logit2, IntoLog 'Add code for event logging Const ntSUCCESS = 0 Const ntERROR = 1 Const ntWARNING = 2 Const ntINFORMATION = 4 Const ntAUDIT_SUCCESS = 8 Const ntAUDIT_FAILURE =16 Set IntoLog = WScript.CreateObject("WScript.Shell") 'End code for event logging 'Place an entry in the log to show the script is running: Message = "START - Printer mapping script now running" Logit = IntoLog.LogEvent(ntINFORMATION, Message) 'Remove ALL old printers ' This code is from http://www.tek-tips.com/faqs.cfm?fid=5798 'Enumerate all printers first, after that you can select the printers you want by performing some string checks Set WSHNetwork = CreateObject("WScript.Network") Set WSHPrinters = WSHNetwork.EnumPrinterConnections For LOOP_COUNTER = 0 To WSHPrinters.Count - 1 Step 2 'To remove only networked printers use this If Statement If Left(WSHPrinters.Item(LOOP_COUNTER +1),2) = "\\" Then WSHNetwork.RemovePrinterConnection WSHPrinters.Item(LOOP_COUNTER +1),True,True End If Next ' First, we see if the computer is in the library (LI) or the IB center (IB) Set net = CreateObject("WScript.Network") workstation = net.computername location=LCase(left(workstation,2)) ' DEBUG : Uncomment the line below to be shown the first 2 figures of the computer name ' WScript.echo location ' Set the variables for computers in the LIBRARY (LI) or the IB Center (IB) select case location case "li" black="\\printers\library" case "ib" black="\\printers\ibblk" case "AR" 'If the computer is in ART (ARTxx) colour="\\printers\ARTCOLOR" End Select ' If it's not in either of those, we'll see if the computer is in any other computer room that starts with rm ' if location <> "LI" OR location <> "IB" then WScript.echo "Not in the library or IB Center" if location <> "li" OR location <> "ib" then location=LCase(left(workstation,4)) ' Get the computer name from the workstation ' DEBUG : Uncomment the line below to be shown the first 4 figures of the computer name ' WScript.echo location select case location case "rm06" colour="\\printers\rm06clr" case "RM06" colour="\\printers\rm06clr" End Select ' Now we map some printers Set multiPrinter = CreateObject("WScript.Network") ' Map the black printer first, if a printer has been specified if black <> "" then ' WScript.echo black multiPrinter.AddWindowsPrinterConnection black multiPrinter.SetDefaultPrinter black End If ' Map the Colour printer second if one has been specified if colour <> "" then ' WScript.echo colour multiPrinter.AddWindowsPrinterConnection colour if black = "" then multiPrinter.SetDefaultPrinter colour End If 'Place an entry in the log to show the script has finished running: Message = "END - Printer mapping script now Finished. Black printer was: "&black&" and the colour printer was: "&colour&" (if no colour printer name shows it may be that none was specified). Check the printers are installed" Logit2 = IntoLog.LogEvent(ntINFORMATION, Message) ' Cleanly end and exit the script WScript.Quit

I use a assign printers by logon script (VBS) - I'll dig that out and paste it here, give me a sec...

Morning deathjester, I have an engineer with me doing an upgrade for us - she specialises in FMS upgrades. To upgrade to 6.128 you must be on 6.124 minimum first. You can do a 6.120 -> 6.124 upgrade and then go 6.124 -> 6.128 Fortunate post, she's only here today! Hope that solves your problem - I know nothing about FMS myself. Jonathan

I have a query regarding the security implications of this solution, if I may. I notice from Website\HOW TO INSTALL.txt that you have to customise the logon and logoff scripts to include an administrative username and password and the database credentials. Given that all authenticated users on the domain can read group policy scripts from Sysvol, it wouldn't be difficult for a student (or any user) to obtain administrative credentials by finding the relevant Group Policy Container, searching for all .vbs files and then reading the details from the file (which is stored as plain text). Given the clear implications here, could you advise of some methods to limit / remove the risk. I appreciate, it would take a user with some knowledge or luck to do this but it wouldn't be difficult and there are some nosey users out there. Don't mean to pooh pooh the product but I am concerned. Jonathan

Afternoon all! A while ago (3+ months) I revoked staff administrator rights over their laptops - something they should never have had in the first place (they were installing all sorts of unlicensed software). The level of malware / virus infection dropped considerably as a result and we've got a better handle on things so I've no reason to change this back. However, just recently a few laptops (Windows XP Pro SP3) have started to request elevated privileges when connecting a USB memory stick or other mass storage device. Previously this worked fine. Anybody experiencing the same problems? Given these are plug and play devices which should be installed straight out of Windows' driver cache this shouldn't be happening. Thanks in advance folks, Jonathan

Morning all! We found this problem a while ago and I have posted the solution on my wiki: Synchronising issues (XP) - Jonsdocswiki To give a quick overview: According to a MS KB article, users need to be able to traverse the folder structure in which their home area is stored. After granting this permission (it needs to be set via advanced permissions for "this folder only") you should find the problem is resolved. At worst you'll need to re-initialise the client side cache (Re-initialise the Client Side Cache - Jonsdocswiki).

Hmmm, the only suggestion I can make then is that on one of the affected machines you check it's synchronised correctly (I presume there are files that get used offline) and then re-initialise the client side cache: * Open My Computer * Click Tools > Folder Options > Offline Files * Hold CTRL + SHIFT and click Delete Files. Allow the re-initialisation (can't remember exactly what the prompts say) and restart. See if that solves the issue on one PC perhaps?

@MaxBerzon Do these symptoms persist even with the share setup as described (I think that's what you've just said but for confirmation)? I'm surprised the laptop doesn't just "try again" after the outage and suddenly work. Is this the only machine with the problem? Jonathan

In case anyone else tries this, I spent about 3 days looking into the problem on my own. Then 2 days with an EIS support desk supervisor, and then a further hour or so with Ranger. I then requested a refund...

To reply to this thread, I've now resolved the problems. As most are probably aware, you cannot edit the local users and groups on a Domain Controller - the local SAM database is disabled at the point AD is installed. However, it is possible to make additional users/groups administrators of Domain Controllers via Active Directory's Builtin section. If you open Active Directory Users and Computers and browse to the Builtin container there are a number of groups, including Administrators. This Administrators group relates to domain controllers (as, to my knowledge, do all of these groups). By mistakenly adding users to this Administrators group, users can become administrators of the entire domain (test that, quite terrifying). To make a separate group, say PCAdmins, administrators of workstations the PCAdmins group should be added via Restricted Groups in GPO. Hope this info is useful for others at a later date. Attachment is how MBSA shows the additional administrators, taken from a network I consulted on after the company had discovered problems.

Hi James, We had to do a similar thing here and it requires you to re-author the profile as the keyboard layouts available are stored in that. I did look for a GPO method, think I posted here and TekTips some time ago, but couldn't find one. Hope that helps? Jony

Hi all, I've just read, and hopefully helped on, thread, hoping it was a similar problem to this. Unfortunately it wasn't. So, is anybody able to shed any light on this problem? I'm somewhat stumped with this XP offline files problem. We have some SEN students that are assigned laptops and they're allowed to take these home to continue working. One student has no problems with offline files at all. The other appears to work successfully but only the folders are synchronised, not the files. They both run the same version of Windows, XP, and even the hardware is the same (not that hardware should matter). The users are in the same OU so they're being affected by the same GPOs (there's no changes to the security settings) and their computers are also in the same OU as each other so again, same GPO. I've created 2 new users, copies of the working and non working, and attempted to logon to the "broken user's" laptop - the same happens, only folders are synchronised. Any thoughts anyone? Otherwise it might be a rebuild...