PiqueABoo

MDT without WDS [it wasn't behaving on my virtual lab bench so I used another TFTP]

It would make a difference to my strategy: How big is this school (# of servers, workstations)?

Don't people usually do that the other way around?

Yep (strictly speaking they're MS programs I want to talk to e.g. Help & Support service etc.)

On reflection I'll give you that one and call it 2 servers, but cache/filtering must be a regional-by-region thing i.e. it's largely central filtering for Primary here.

It's just XP again, Vista Win7 changes the firewall considerations a bit. They're kind of pragmatic in the sense that I thought about the risks and backed away from very serious security in favour of usability/administration/budget. Local subnet gets in to do: Ping File & Print, Remote Admin, Remote Desktop, Remote Disk Manglement, A few specific EXE exceptions I only vaguely recall having to make (but obviously did) for unsolicited Remote Assistance TCP port 135 which IIRC was so some remote WMI calls I make would work (might be included in one of the generic categories) For most I ought to change local subnet to an IP range containing boxes where remote admin happens, but that wouldn't slow down my idea of a Bad Guy[tm] who could exploit the current scenario very much.

Mmm... interesting times ...won't say I'll agree with all of them given the inevitable MS-centric nature, but nevertheless this is useful stuff. My averages is ~1.5 (some have a dedicated MIS server). Likely to head closer towards 1 once VMs get more popular and/or MIS heads off into the clouds.

Well I did allow for existing CC3 domain recycling in my earlier post It's a case of weighing up a variety of pros and cons for each approach and those are overwhelmingly site specific (to include local politics). I wouldn't want to do gradual at all, but as above an Exchange would give me pause for thought re. a new domain, as would any serious investment in account/group permissions in any network service or parts of the file system. Anyway since you're doing the recycle angle.. What I like best about a new domain is almost psychological in nature i.e. there seems to be a much better chance of folk using different, and one hopes better, approaches when they start with a blank slate. More pragmatically you know what *all* the deltas are i.e. you made all those changes to the OOTB defaults and know why you changed them. Share/folder permissions wouldn't bother me simply because I wouldn't have very many shares. You can design it so you don't have a zillion per user shares, especially if it's Win7 & 2008 R2 where thanks to SMB2 you can get sensible numbers for folder quotas from sub-folders below shares. I would also want a script (or something) that resets user profile/home folder permissions regardless - one you might make to sort out permissions after copying lots of user folders from the CC3 domain can be reused later should for instance, an Admin need to start fling folder/files into user folders and subsequently need to get the permissions/ownership reset to the relevant users. -- With either approach, I will always maintain that the most significant area in terms of time & effort is the GPOs/GPPs. CC3 has a lot of policy settings for generally good reasons and if you want a credibly comparable D-I-Y system you'll need a similar number .. and likely have to think quite hard about the best approach to more than a few of them.

Yes, but which one? The workstation or the server they talk to? I have a firewall GPO on the OU all workstations get moved under somewhere by MDT, and it doesn't cause any issues. Again it's XP, but that GPO doesn't have a lot in it - mostly just lets all the necessary Windows stuff, including Remote Admin happen if the source address is the local subnet.

Well that's coz you're not a security geek: CSEG is part of GCHQ. Amongst many other things they certify pen-testers (CHECK) and more generally provide "advice and assistance on the security of communications and electronic data" And for context I take it everyone has read the intimate details of Stuxnet (symantec paper) that all sorts of security orgs have been spinning for all its worth recently? There is at least some substance in the perceived threats. PS: To make this more relevant I recall suggesting that BECTA security guidance was likely a watered-down-for-schools version of CSEG stuff for gov. Might not be the case, but the data security classification and tagging certainly made it look that way.

As I said extremely dense. That looks like it's from Wizard.log, so tells us what it was going to try and do (comp name and other parameters you'd fed it) but tells us nothing about what it did next to get itself in a mess. Is that the only log you have? If not which ones have the newest modified dates?

Important question: What's the "mail server"? Exchange or something else? And do you have any other service kicking around on CC3 domain member servers? I would recommend a new domain, but subject to what you've got now that might involve truckloads of icky migration work you could avoid by recycling the current one. It's not too hard to keep AD with the bits you want and ditch the RM stuff (apart from a few completely harmless attributes), but I wouldn't contemplate that if the system has had a rocky history. In either case you will need to rebuild all workstations/laptops with whatever tech you pick for your new system. PS: Personally I'd either go to Win7 everywhere (which may kill some of your apps), or XP everywhere and leave Win7 as an incremental phase #2 when it's all settled down PPS: Make an R2 VM and a couple for workstations and start designing/playing with file system structure, AD structure and GPOs (hint: especially GPPs) ASAP.

Yep. If that's happening it definitely means the task sequence hasn't finished (at the end it cleans up those folders and IIRC moves all the extremely dense logs from one of them in the Windows\temp folder). If it's getting into the right OU, then lets assume something after that is killing it... maybe around Windows Updates (I disable that).. are you installing any applications? Do you get to see the summary with info about what failed at the end or do you have it set to reboot?

Are your DCs 2008 [R2]? If so use GPP to handle all your IE settings, including proxy exceptions.

Yeah.. agreed in principle (we don't have lots of these in people's hands and known to be working yet). My point is more Exec Tech Toy (a category they obviously both match), versus Useful Educational Tool for kids. I want more than techs saying gadget X is cool and trendy, I want to hear about real benefits for educating kids.

Could it be a credentials problem, as in the account it tries the OU moving with doesn't have the rights? Are there any associated failure events in the relevant DC security logs?

What are the educational benefits? [

Lot of experience but I've only had the "can you get my mail back from months ago" scenario once. In principle L@E "purges" deleted items after 30 days and users have another 14 to recover deleted-deleted (purged) items. What's not clear to me is whether that 30 days is based on: a) Date message received, b) Date message deleted and ends up in deleted items folder. But I think 90-days or something thereabouts would be better.

Never thought I'd say this, but given their increasing popularity owing to itsy-bitsy budgets et al perhaps it would be good to have yet another sub-forum(!) for Google, Live@Edu etc.?

I haven't found it and doubt vendors would be selling products for bulk migration if a free way (besides writing lots of EWS code) existed.

Don't know about Sharepoint & SSO. AIUI you don't get Import-Mailbox which is how I get multiple PSTs into Exchange 2007+. You can configure Live@edu to do POP or IMAP aggregation (& IMAP in bulk) but that wouldn't get them Calenders, Contacts etc. There is a commercial bulk migration util called MailPortal Migrator (free for single mailbox use) and might be some others, I don't know. Otherwise I suppose yup, if your users are up to it, you could get their Outlook connected to Live@Edu, also open their PST from the old system and have them drag and drop things they want to keep to their Live@Edu mailbox. The Live@edu email is apparently in Dublin and fails over to the Netherlands. Ditto.

Yes with 2008 and now 2010, but I'm probably not doing the same kind of builds as you so YMMV (LiteTouch XP and I'm just building straight from I386 source, not bothering to subsequently image and deploying that afterwards). I'm using bootstrap.ini with entries in the [Default] section like: DomainOUs1=OU=A, OU=Workstations, DC=someschool, DC=local DomainOUs2=OU=B, OU=Workstations, DC=someschool, DC=local DomainOUs3=... They show up in the wizard "Join the computer to a domain or workgroup" Organizational Unit (optional) drop-down list and work.

So does the telnet test work or not on the moodle box? Net e-mail and I have a 20 year history - I routinely don't and wouldn't recommend spend time fiddling with config for *any* application attempting e-mail until I'd done that quick test. The test works fine for me on Virgin Media , but I guess it must be your ISP at home (spambot prevention etc.), or sometimes it's AV blocking it for the same reasons.

Having tried a quick telnet you simply can't get out to podwotsit from schools here right now and that's because there is no outbound hole in the LA firewall for it. Thus I would have to use the official SMTP mail relay for schools here, either directly or via a local mail server. That might not be your problem, but the very first place to start is with telnet e.g. on Windows I do: telnet pod51007.outlook.com 587 If the path is clear you get a "Microsoft ESMTP.." banner back.

Contemplating here, besides the obvious ones mentioned previously there are a lot of "subtle" services you get inside the LA/RBC "Intranet" fold that would translate into costs on the outside. For instance all that sensitive-must-be-secured data that gets transferred back and forth between schools and LAs, access to some LA systems etc. Answers like "You could get a VPN sorted out" are a bit simplistic - the security issues in VPN access are complex and it obviously won't be free, or perhaps as functional. Wrong question - I would be extremely surprised to find many schools that haven't managed to saturate their link for a sustained period at some point in the last few months.