PiqueABoo

I felt seriously bereft when The Killing (Danish original) finished, everything about it was refreshing: slow-burn atmosphere; the most believable characters I've seen in a long while (last time I was similarly struck by that was the opening scenes in the film Alien); not something cheesy from US; not another sad UK imitation of something cheesy from US; understated, or rather not massively overstated. Sofie Gråbøl was excellent, but for that matter so was most everyone else. Eeek... they remade it?!? Much of the of the joy of the original is that **it let us imagine** what folk were thinking while gazing into eyes that for once looked like someone actually lived behind them, as opposed to to blatantly spelling everything out 10 times over in the equivalent of single syllable words written in large capital letters. Have they ever merkanized anything European and made it better? -- It's kind of passed me by, are the "The Girl With..." films any good?

Would you really expect that to be the case? It isn't. They [computer law making folk] had figured that one out before the end of the last century i.e. have long endeavoured to make law that either covers or can be easily extended (without pesky votes etc.) to encompass tech evolution. This is an update of the existing law from 2003 which already refers to storage and retrieval of "information" on our kit - the changed/new bit is that our consent must be obtained.

The site set an ASP.NET session cookie which given that there were no others must be the one they say has already been set. If you accept their cookies it sets a cookie to record you have done so. They do not set a cookie to record that you don't want their cookies. IOW there's nothing to criticise re. their example.

I'm sure you need to put these certs in the computer store, if you haven't they're probably in Administrators's store and none of the exchange services can access them How about running mmc, add a snap-in, select "certificates", select 'computer account' etc. Does that work? If so then can you then r-click the relevant store name from their instructions and import whatever cert files you've been given?

OK, some sage advice (I've done truckloads of multi-platform Windows stuff) that is intended to be constructive, alternatively might be patronising but I can't judge that: 1) Ensure you compile your dotNet code for "Any CPU" 2) As Arthur suggested a while back you can run nearly all the native utilities from dotNet code without caring about where they live i.e. just with "gpresult.exe" rather than "c:\windows\system32\gpresult.exe". The process class works for everything I've ever wanted to run and that is a lot, the only issues I've had are the waiting for apps that in turn spawn other apps then terminate variety i.e. inherently more complex. 3) If you must have paths because whatever you're using insists, then everything important tends to be in exactly the same folder on both platforms e.g. "c:\windows\system32\gpresult.exe" gets you to that util on both 32-bit and 64-bit. [On 64-bit, the "system32" folder is where all the native 64-bit utilities and DLLs live] 4) If you do have references to a path beginning "c:\windows" then don't - get hold of the %windir% environment variable to get the actual windows folder path and then append "\system32" or whatever to that. 5) If you have to reference the same full path like "c:\windows\system32" in a lot of places and one basic form class, then have a class-global e.g. systemPath, assign it during initialisation (remembering the %windir" point) and use that everywhere else in your code. If you're Being Very Good[tm] you can have a separate class for this instead of a global, but I wouldn't bother unless I had lots of globals that need to be referenced from several classes. 6) Don't compile for dotNet 4 unless you have a serious requirement for some dotNet 4 feature - I always use the oldest I can get away with because it's bound to be more prevalent (dotNet2 is my minimum and what I mostly target).

I'm of the view that it ought to be a disciplinary offence to conduct school business via a personal account, the same way it definitely can be in reasonably organised parts of the real-world, even without added DPA considerations. Thus the trouble I have is we're being ever so nice and considerate and caring and trying to gently woo those ever-so precious staff back into the fold instead of treating them like employees who ought to act professionally - why is it always so weak in this specific sector? That said, staff leaving is a bit like going to work for another branch of the same organisation so there is very definitely a point to be addressed here - but I'd just prefer them to stop taking the pee first as a pre-requisite to talking about what they can take with them when they leave. otherwise I suspect there is a risk of "reasons why" they use personal accounts becoming a bit of a recipe for justifying use of a personal accounts. [Yeah I know, it's probably managlement who are the worst culprits so this is all a bit moot]

I'm more bothered about the lack of scthweaming about the casual use of "educational benefits". It seems like anything and everything these days is 'educational', few ever bother to say 'prove it' and even fewer ask if it is 'more educational' than something old-fashioned. And of course if you don't have It[tm] (don't forget to pay, one way or another) you are a bad, bad person DEPRIVING all those poor lil' orphans of a fighting chance when they have to go out and fend for themselves in the uhh.. "real" world. Not got your digital citizen certificate? Only got a C- in advanced tweeting? Fewer than 50 friends. [insert future fashionable displacement activities here]. Oh dear.... Once upon a time I was genuinely thrilled by the possibilities of the net.

I started s/w engineering as a day job 20+ years ago and the way I see it, it's all "old" tech e.g. we had thoroughly web-ified a seriously non-trivial MIS system well before the turn of the century, and were very keen to do hosting but the customers were still struggling to grok the net, wanted the servers and data on-premises (was a WAN-based system so comms link reliability was the same issue either way), so they had their "cloud" tech running locally. All that's really happened since is that browsers continued on their already well established journey towards platform independence nirvana with capabilities increasing to match locally installed platform-specific client-code. Oh and bandwidth costs went down and security attitudes softened quite significantly - threats haven't changed that much though, so we might yet see some raped cloud DB splattered on front pages causing a bit of a "rethink" amongst folk who likely never thought in the first place. ::giggle:: In the past I've had to know as much as three national (evil, kafka-esque, tagged) data format experts put together and those skills are a small fraction of the set - largely the ability to temporarily put up with concentrating on very tedious things that others much higher up on the OCD scale probably enjoy. Which bit of their education are they equipped to help with? Consensus seems to be that school's aren't normally interested in any serious IT stuff, just the upgraded "typing" variety as the bloke with the USB-stick PC very aptly put it. Who's bogged down in the areas you have in mind? All the DB apps in my world tend to tick over and have done for years and several versions e.g. SQL databases, Exchanges etc. Putting those in the cloud saves money for the h/w and a bit of time/expertise: a) installing, b) patching, c) health monitoring, but unless the tech concerned is stupid it's not that expensive and can be very easily be offset by new problems that cloud champions coveniently overlook. I see a broad spectrum and some of the most difficult, intractable issues I've had to deal with are genuinely with "cloud" apps and they just keep on coming: A zilllion browser issues; plenty of comms & proxy & filtering & firewall issues where the default is for all the different parties responsible for any given link in the chain is to blame the other ones ('holistic' folk who understand the chain, the protocols and the effects of what they might encounter on their journey seem a bit thin on the ground). -- Pragmatic reality for me is the "old" versus "new" tech thing is misleading and there are no universal conclusions to be drawn: A well-made local system can trump a cloud system both in terms of support overheads and flexibility (cloud may well have more constraints); the converse can be just as true; cloud app bandwidth and QoS might be an issue; native apps can still knock spots off cloud equivalents in terms of usability and features; I can often promptly fix local issues, with the cloud you might have to wait, and wait and wait; cloud obviously triumphs by delivering anywhere-access by default if that requirement is business critical and you're content re. the data security implications etc. But one thing is true: Except in a strictly academic sense I couldn't care less about how a given cloud service is implemented server-side, whether it's traditional web app, TS app or [something else], it's all the various aspects of the client side experience that count and of course the ££££'s.

Recall a conversation with someone around the turn of the century joking that the seriously buzzing Application Service Provider (ASP) thing would put me out of a job any day now - it's just another marketing term for the stupid & gullible, albeit one with a bit more "oomph" now. The best ones are the schools that somehow think the "cloud" will currently wash away all their infrastructure and save them lots and lots of money.

I'll skip the war stories but don't underestimate the potential value of all those other fixes in SPs because one of them might jut save you lots of pain in future. OTOH it might create some new hurt, but this one was a long time coming and I haven't seen any significant screaming about it. PS: SP1 fixed a bug that very nearly stopped me upgrading a 2008 "off-the-shelf" system to R2. [several PSS web-request KBs for that area had done nothing for it].

Ditto - given an initial delete all net printers (one of those things that should make perfect sense with hindsight) GPP delivery has always worked fine for me. If that doesn't fix it then I would turn the relevant GPP logging/tracing policy on because that does produce useful information about what's happening when GPPs are applied.

Precisely: They're based on the risks I've experienced in the bit of the real-world I experience. They're also based on my default "less is more" approach - add a second DC and your system is now more complex, it can break in interesting new ways etc. YMMV, I'm not claiming mine is the only approach. ::shrug:: No one ever asked me, so "best practice" (BP) according to whom and where did they get their extensive hands-on experience of every sector and size? I haven't seen that much BP that hasn't been forged in, or for, genuine Enterprises. I reckon a lot of BP exists to get people who don't thoroughly understand what they're doing, to do something that should work well-enough in most scenarios, but there can be an even better way in some of them. And of course MSFT want to sell you more licences (preferably over and over again), h/w vendors want to sell you boxes, support organisations want to sell you their time configuring and managing the former on the latter. Note: MSFT clearly weren't worried enough about violating BP to stop some of those licences being for SBS. PS: When it's public money I take cost-benefit very seriously and if I don't see a notable benefit for them, won't add something that increases the cost even if there is ample room in the budget.

On my planet, that or a second DC replicating all the data, or hyper-v failover or whatever would cost a "heck" of a lot more in terms of equipment, routine management effort and energy usage than a single DC w. RAID and next day on-site h/w cover. That a single-DC Primary system may be out of action until tomorrow once every few years if they're unlucky, just doesn't seem to bother them much and nor should it. I've had a 3-figure number of systems under my radar and have seen genuine AD corruption just twice - a single DC one I fixed via a system-state restore in < 30 mins, the other was one of a multi-DC but would have been similar except the dodgy RAID system had made "holes" in lots of files so a large full backup needed restoring... and with multi-DC you have a lot more "is everything happy now" checks to do afterwards. The thing I have seen much more often is faux-corruption i.e. typically someone deleted or changed something (or ran something that did that) and then lied about it being a complete mystery - and that is the kind of corruption that replicates to other DCs. Do whatever you feel is best for the school, but I'm on Michaels "side" and would contemplate potential use as a member server with shares for all the photos/videos or something... and subject to the spec we don't know, perhaps just get rid.

Begs an obvious question then: Can this specific signed trumps unsigned behaviour be turned off via local registry fiddling and would your driver definitely "win" then? If so then you've got WAIK installed, so try an offline edit to get that in the WIM's registry and if it works why not use that WIM to build everything? GPO can put the behaviour back post-build if you really want it back.

Here's some MS DS blog text: Windows 7 ADMX files now include support for two registry types: REG_MULTI_SZ and REG_QWORD. The REG_MULTI_SZ registry data type represents multi strings entries within a single registry value. The REG_QWORD registry data type represents a 64-bit number, which is twice the size of the 32-bit number stored in REG_DWORD. These new aspects of the ADMX syntax are only viewable when using the GPMC and Group Policy editors from Windows Server 2008 R2 or Windows 7 Remote Server Administration Tools (RSAT). Group Policy editors and the GPMC from Windows Vista cannot read ADMX files containing this new syntax. My emphasis. I just have experienced and I'm certain you will get a complaints if you try getting 2008 GPMC/GPME to use Win7/R2 ADMXs. Specifically these are about terminalserver-server.admx which I simply removed from the central store because I don't think I'll need that in this scenario. That done it all seems happy and although I can't say anything about the Software and Windows Settings, I have Win7/R2 specific policy settings in Administrative Template using the 2008 tools. As for GPP identical-ness this did nothing for that - go to Internet Settings and the newest IE you get is still IE7, not the IE8 you have with R2. I'm rethinking all of this: On reflection IE is the only GPP that's bothering me and as remarked above I believe you have the same problem on R2 just shifted a version upwards - you can make GPPs for IE8 but not IE9. This is a pain, I really liked the IE GPPs for their idiot-friendliness but if MS aren't going to add GPP support for new versions then I think I'll have to revert to the old method. You can edit the relevant sysvol XML file as an obviously unsupported workaround, but that edit can get reverted very easily.

This isn't going anywhere near the Head's delicate constitution. I'm essentially on your side, but hassle-free remote access to all necessary GPO/GPP config tools on the DC is a *requirement* (remote support=lower cost). I'm prepared to accept that updating the ADM[X]s SYNACK posted will likely expose new Win7/R2 GPO policies in the existing 2008 editing because we all know how they work etc., I'm doubtful about the GPPs.

I especially want to manage Win7, IE8 etc. GPPs on the DC and rightly|wrongly assumed you need Win7 RSAT or the R2 editor for that? PS: Have they sorted IE9 preferences yet?

Server is the only one and it's Enterprise, it's has a few years life in it and has 8GB RAM with more than half of that 'spare' i.e. there are no serious obstacles for the proposed Win7 VM. It's Primary, there is no money in most of those including this one, so a new second server simply isn't viable. I know about the lack of in-place upgrade path , hence "swing" via a (temporary) VM - a significant point in this would be to only replace the (lots of space) system partition, leaving the mountains of user data and it's perms etc. on other logical drives throughout. Nowhere to keep it, so I need to "take down" that VM, which would likely be on my laptop, afterwards i.e. new R2 install on original h/w gets promo'd and all the FSMOs back, virtual DC is depromo'd and disappeared from AD i.e. what is conventionally called a swing migration.

Scenario is a Primary with just the one existing 2008x86 DC (Enterprise). Being able to manage GP from the console (remotely) is a key requirement, but although they're not using it yet Windows 7 isn't supported blah-blah. There isn't any nasty 3rd party s/w with it's claws embedded in the DC, print drivers could be that occasional 65 & 32-bit fail though. So: Option 1: Make a little Win 7 + RSAT VM you can fire up on the server on when you do need to play with GP settings. [We have ample h/w resources available) Option 2: Swing migrate, ensuring the result has the same name as the original via an (external) 2008 R2 VM. May need to fix-up some GPP SIDs afterwards though. Head says the first option, heart says the second (albeit with head heckling about greater endeavour - twice, coz I'd likely run through it virtually first). Anyone have any opinions based on real experience?

I'm niggled by the reverse of a problem I got to fret about in the first 1/2 of the 90's: Adding Internet to WAN links built for a critical business app. Here & now it's adding a critical business app to WAN links used for Internet access. Same as back then I think I want "prioritisation" for the critical traffic, otherwise a lot of kids simultaneously accessing "heavy" net content can seriously harm/randomise an MIS user's experience, especially in a lower bandwidth site e.g. Primary. Are folk leaving all this to chance or attempting to do something about it? As discussed in one of the older threads I'm not sure I'd be entirely happy with cloud-MIS without some kind of light-weight fallback service that could cache critical stuff locally e.g. today's attendance, should the path to the cloud be down (which is what the 90's business app did). Trouble is the chances of getting lightweight anything from anyone these days seem very poor. They don't need that, one server and a dash of not that expensive extra RAM, one VM for jack-of-nearly-all-trades school DC, another for bloated MIS. It's a bit of a no-brainer, but IME quite rare. Increased S/W complexity (your tech needs to grok Hyper-V,/ESXi/whatever) offsets the h/w reduction a bit though.

Bit late on this one, but if people haven't been (metaphorically) beating up Capita with baseball bats yet they ought to. Summer 2012 is what: 15 months away? Schools are still getting their heads around brave-new-budgets, and Capita wiping out 18+ months for getting some of those struggling little schools with very little money, XP + SIMS onto Win7 (inc. h/w that runs it, s/w that runs on it, a new server/system that supports it) is insane. Similarly SIMS server-side: Why must you have SQL2K8 on 2008[R2] when it runs fine on some 2003 box a school could keep using until Summer 2015? If they don't align more closely with MS extended support termination dates they will seriously hack off a lot of folk. Has anyone from Capita defended that roadmap yet?

Despite having an engineer's unlovely sweeping generalised opinion of the types Comp Sci degrees spit out it's not at all difficult to see where he's coming from. But would this gadget do much to solve the problem, not least the school/teacher interest and/or ability though? A VM of anything-you-fancy has long been capable of filling the "kid can play with this to destruction" space, but HDMI implies a key point is that unlike a VM they can (mostly) all do this at home so perhaps there's a little something there. There's an irony in all this: Can't swear it works for all of them but watch most kids grow up and early on they are wonderfully inventive and creative, then over time society but **especially school** knocks it out of them - growing up is largely about conforming, doing exactly what you're told in the "right" way and so on and so forth. May have changed a bit, but the idea going back at least 50 years is that most of the damage is done by the time a child is around seven years old.

And if you don't have the money look at Local Update Publisher as you can then use SCUP...

In D-I-Y land my XP source is SP3 with one of this month's post-SP3 sec-fix update packages applied to it every so often with nlite, but I also use WSUS. Thinking about this for WSUS-less CC3 hurts my head e.g. a machine built this month doesn't need to install a 100 "tools" (KB) packages you have allocated. Primary? I think CC4 is way overkill, period. That's a lot of ambitious, complex architecture/code with much arguably being 'real-time' (=hard =bad) that still has bits missing and still hasn't quite settled down into solid reliability (if you include pre-release development how old is it now?). Ignoring client OS support, what's the benefit? Positively: Background s/w installs, some bells and whistles you can get in a dozen other ways. Negatively: Not being able to have some packages install at start-up and a very significant increase in resources required to manage the system and run all that code on clients. Less is more.

I've been having very vaguely related fun with an EWS app to Live@Edu through a proxy (may be fine with others). Without the proxy in the way it works. If I use standard autodiscovery to get the EWS url, any subsequent action e.g. bind to an Inbox fails to authenticate with the server: Negotiate -> NTLM 3 = Auth. failed. If I manually set the EWS url then any subsequent action works i.e. the NTLM authentication succeeds. It all over HTTPS so in the end I got my app to force basic authentication which lets me happily autodiscover and then do normal EWS things with or without that proxy in the way.