PiqueABoo

Seconded and when that works, throw away whatever made the original mess, leave that delete-all GPP entry there in #1 position and add new ones to deploy the printers...but endeavour to keep the targeting consistent/comprehensible - with great power comes great responsibility etc.

I think the chances of that (police report bit and for that matter the entire image) being genuine are close to zero. The question is, why don't you folk think the same?

Thinking aloud... your appear to have AutoDiscovery configuration stuff in "our policy" mixed with the PRF configuration stuff, and it's not obvious to me which one is winning. I would definitely want to see what happens if you temporarily turn off the 'auto configure' setting, and logon as a CC3 account that's just had it's profile reset. Plus, for O2K3 and O2K7 at least, having just the NetBIOS name e.g. EXCHANGEBOX rather than a FQDN for the HomeServer= setting definitely works for CC3 systems - might be a reason but I don't really get why you need the FQDN in there.

If fiddling with RAM doesn't help then how often and what did it happen on e.g. server (make? mainboard make?) or something else? The first parameter is 0x0, and in principle that's an MCE (machine check exception), as in a CPU complaining. One thing you can do (that may or may not help) is ensure it's got the latest greatest BIOS because I have seen mainboards where they worked around MCEs with BIOS updates. PS: The "Win 7" updates arrived while I was typing.

I'd made a little app with an idiot-friendly pie-chart before I hit that one. IIRC it gets it wrong if you try and get the quota on a drive mapped to a folder below a share e.g. to \\server\usersshare\Joe Bloggs. In principle if you have a drive mapped directly to a share it gives you the right numbers, but it was too late for me to change that and I hate having lots of per-user shares, so who knows... MS blamed no capability for getting it right in the SMB v1 protocol XP uses, but said SMB v2 fixes it..

I hope it is easier now, but when I tried that with dotNet a few years ago it was rate limited i.e. your callback code would be thrown a new event record at a maximum rate of something like one every two seconds i.e. if 100 happened in that period you only saw one of them. That behaviour was explicitly mentioned in the kind of MS documentation you only find *after* you've spent a while wondering if you've done something so incredibly stupid you can't see it. [Already had 'old school' code that polled the logs and was contemplating updating/simplifying it with the subscription method, but gave up on that ].

Around here in Primary it is very common to see one Nearly Everything Server[tm] and usually with next-day h/w cover. SIMS might be on someone's decent spec. workstation in the school office, or on a modest h/w member server. Their dependency on tech isn't that great that they can't survive < 24 hours without the system, and of course teacher laptops are usually configured to work without the domain at home etc. This model does work, and realistically an outage isn't that much more troublesome than having a working AD without profiles, my docs, shares, run-from-server apps etc. that are resident on the dead box. Try fixing all the continuity problems and before you know it you're designing serious failover clusters with redundant n/w infrastructure..

I've argued this before, but for 1-form entry Primary my OTS vanillas, a large number of other folks and lots of RM CC3/4s have all been perfectly happy running single server i.e. 1 DC. Ditto for lots of small orgs. using Windows SBS. You obviously need a good backup regime but that's true for any system. Far as I'm concerned adding a second DC to a such a school because you "should always" is a waste of money they usually haven't got. [Not arguing with what you should do when getting a new server.]

Assuming it exists, you can just use find for the same effect e.g. tasklist /FI "IMAGENAME eq mstsc.exe" | find /I "mstsc.exe" if ERRORLEVEL 1 (start mstsc.exe C:\rdpfile\studentterminalserver.RDP /f /public) ELSE (goto:EOF) There's also findstr that would work, albeit with another switch in front of the search string to say it's a literal.

Based on an onipotent view of quite a few CCx sites: Deep Zoom - nowhere. AIUI it's a Silverlight tech not an app. Should this be Deep Zoom Composer or something else? Microsoft Mouse Mischief - nowhere. This is a powerpoint add-in, but appear to need 2K7+ whereas O2K3 is still the majority here. Photosynth - nowhere. Movie Maker XP - everywhere (as above it's just a shortcut). County Primary ICT advisors like this in primary. Live Movie Maker - a small handful. Photo Story 3 - everywhere. County Primary... Kodu - one secondary. Songsmith - a small handful. AutoCollage - a small handful. Live @ Edu - lots Live [anything else] - nowhere. Much as I love to hate them, the idea that RM don't help because it's free/unsupported/whatever. does NOT chime. They do make "blueprints" which are fundamentally video instructions plus some WIX- based tech that help idiots turn apps into MSIs with the requisite RM package wrapping. There are RM blueprints for MS Photo Story, Scratch, VLC, 7-Zip, Paint.Net plus a few hundred assorted other things. If there's an MSI that in the worst case can be edited/transformed so it doesn't prompt for serials/registration, or if there's an EXE installer that does silent, then there shouldn't be any noteworthy problems for making deployment packages on any Windows system including CCx... well provided it uses profiles properly, you can stop self-updating mechanisms, doesn't keep data in silly places, the usual stuff. Likely won't help with the schmoozing but: Despite the loving marketing, those MS education friendly app docs always strike me as being a bit desperate. The apps rarely seem that significant/valuable, especially compared to some of the other free stuff. With this in mind I've never figured out what prompts RM to make a blueprint, but it probably involves sufficient demand from customers somewhere.

Ensure security? Cue the now very old favourite, the Ranum 'ULTIMATELY Secure Firewall'. I'm not kidding, much. If pen test kind of territory is now a de-facto ICO hurdle, then you either swiftly drop most of the visionary-external-access-involvement-engagement ICT panacea tat from the last decade like a shot (ditto probably, for any cloud-fluff), focus very seriously on the security arms race yourself which is a bit of a full-time job, or sack some internal staff so you can afford to pay someone else to fret[1]. And given the latter doesn't excuse you entirely, how do you determine that Org X, Vendor Y, Pentesters R Us at al, will actually deliver at some arcane level that's way beyond your ken? Do you know what any gobbledygook certs do or don't prove? What may or may not be genuinely good value in this area? Etc... The main difficulty I have is that should someone clever exploit some subtle hole despite having lots of "appropriate" boxes ticked, whatever they may be on the day the ICO reviews the breach, will they say: a) OK you took reasonable precautions vis-a-vis the genuine risks, were obviously unlucky, so we'll let you off, b) A hole existed and was exploited ergo you hadn't done enough? [1] You might also discard one or two products from some 'well-known' vendors in this sector, because I'm 100% certain that some won't withstand serious scrutiny (not that you'd likely afford tests like that, but the vendors probably could on behalf of their customers interests).

Private Eye is entertaining today, but that's not (sufficiently) online. Meanwhile, subject to your inner-child, this US (John Stewart) video is *very* funny in places

I've got a friend who works in PR for Herts. police, perhaps I should take them out to dinner? Note for The Guardian: That person actually has genuine Integrity[tm] same as other folk I'm content to associate with - the only thing I've ever heard about their job is that they'd had a busy week attempting to correct some erroneous claims in [my words:] a very silly story that went national during an apparently very slow news week. -- Both the select committees today were extremely boring and repetitive. I never imagined their were so many different questions which have the same answer from anyone you care to ask. Sorry folks but Douglas Adams clearly got it wrong, forget all about "42" it turns out that it's: "At that time I wasn't aware of...". Did Tom Watson, almost the only person asking any decent questions today, leave the even more torturous Rebekah session in frustration? Could have sworn I heard a "..waste of time.." and abracadabra, he wasn't there.

This is my clear favourite comment on the story so far: Murdoch’s Frankenstein. Worth a read, seems obvious with hindsight but it didn't cross my mind.

::fizzle:: Sympathy is tempered by the bloke being such a significant part of an Orwellian government that wanted to get as much data as possible about us, especially our kids, in their lovely big databases that half the bleeping country could legitimately access. The most significant story here appears to be the long overdue implicit acknowledgement that the system, politicians, police et al, has (always?) been been sufficiently "bent" to be scared of upsetting the press. A supporting quote from Tom Watson: "I stood up in parliament and, for the first time, I told the truth that dare not speak its name – that we were scared, that the whole of British politics had been terrified into silence, become complicit in a cover-up of the illegal methods of a corporate beast that was out of control." My emphasis. Don't know about you, but I could survive publication of my medical records, bank details, voicemail, e-mail etc. - might be some mild embarrassment, but I've got nothing significant to hide. I'd like to see the word "prosecution" substituted" for "resignation" in the phrases about the characters in quite a few of the sub-plots here.. would restore some faith, but it won't happen though will it?

Put the twittering classes in charge of educational "vision" and of course all the tosh they waste half their paid work and home lives on, the social networking banality (thank you Helen Wright!) is suddenly absolutely, extremely, definitely very important. History will look back and laugh.. well assuming we haven't produced so many generations of slackers that they're incapable of keeping the lights on.

Yes, or rather in principle they will be migrated to "Office365 for Education" at some date I haven't heard yet (and wouldn't trust in any case). Depends on your requirements i.e. exactly what you want to set up, but provided that's not too special and you treat your Exchange boxes with respect i.e. not for anything else at all, they tend to just work. The very real, significant problem with that is that owing to lack of practice and familiarity with the underlying technology/tools a lots of techs haven't got a clue what to do if theirs breaks.... keeps me in work I suppose, but I don't really need it on top of everything else and those lengthy DB scanning/fixing resolutions are a bit of a pain. -- Back in the day when Exchange was more sensitive and there were very few books/guides, what seemed like half of the MS book I had was about disaster recovery... how you should practice this and that on your lab bench etc. There was a point to that and it hasn't gone away. If you have got Exchange then: How patched is it? Is it on a decent UPS? Are the UPS settings sensible e.g. allow for how long it takes to shut down gracefully and don't try to start it up again until there enough battery oomph for the normal startup time and another graceful shutdown (plus wriggle room)? When was it last backed up? Have you verified, as in actually tried from start to finish, restoring a DB to recovery storage with your current backup s/w?

But did you trust that enough to hold your breath?

Live@edu has (link) limits - read them, because some might be less than you have now and might hurt. Is anyone sending 1000+ mails to parents now and again? Does anyone ever ask for some deleted mail from a couple of months ago to be restored? Etc. A trend I've seen is local Exchange for staff, Live@Edu for students but that's typically schools that already have an Exchange i.e. they want to retain the full control/flexibility for staff, but are happy to dump the h/w resource requirements for all those student mailboxes in Microsoft's lap where of course you have less control (it's a subset of the local Exchange 'power', but to be fair there's not much that's reasonable that you can't do).

I'd recommend it for MY requirements. Trick here is to figure out which features of your current e-mail system are important to the org, then check whether you get them, equivalents or perhaps better replacements via Live@Edu. Try not to get dazzled by any shiny stuff until you've done that.

Judging by another thread, first thing to check is whether "County" are happy for you to implement your options i.e. will let the appropriate traffic in/out.

What happens if you go get the "WSUS 3.0 SP2" download and install it with that?

That's reasonable, but if it's XP SP3 then I'd add: a) GPP update so they immediately understand 2008+ GPPs, b) IE8 because that's the end of the IE line for XP i.e. you won't be uninstalling it and putting IE9 on, c) Anything else global that satisfies the same kind of reasoning. You obviously haven't looked at the code then ;b It has been a couple of years, but I looked enough to submit a few bugfixes back to the project (was adapting it slightly) and it's actually jolly complex. The winning WPKG concept is simple though: Is-it-installed/has-it-installed checks.

Variation on the dhicks theme: If it's just one server you want to RDP to, then tell them you've put a TSG on the relevant IP address to get 443 opened/mapped. Pop stunnel on the server using port 443, and *importantly* configure it for mutual auth i.e so you need a client cert to connect the tunnel from home. Tunnel RDP over it. Or perhaps tell 'em you want to do that and ask them to justify why it is less secure than TSG (which it probably is NOT unless TSG folk are also using mutual auth).

I've just finished testing that: If you set the Primary DNS Suffix it does get used with WSUS e.g. set that to "example.local" and a standalone box DOES now show in WSUS console as "alice.example.local". Or at least it did for me fairly quickly after a wuauclt /ResetAuthorization /DetectNow. Next trick I need then, is how to set a Primary DNS Suffix from the command line. Still working on it, but it looks like it might be a case of setting the tcpip\parameters registry values "Domain" and "NV Domain" & restarting. Unless anyone knows of an 'official' MS util that can do it?