PiqueABoo

Lot's of XML but I'm not a DTD person either, however I think(!) that says "root" is an element within "root" which it isn't. If I couldn't find a way to avoid it altogether I'd try this instead: ]>

I'm idly and uselessly wondering if that constraint (which is immediately apparent when play with csccmd i.e. you see the root share has been pinned) is related to my folder quota stats problem.With the latter when you ask about available disk space for a folder-with-a-quota below a share, you always get the value for the folder back at the root of the share. MS blamed the limits of the SMB 1.0 protocol and reckon it's sorted in SMB 2.0 (which you can't get for XP and I'd rather not have anyway right now if that BSOD SMB 20 negotiate exploit works as advertised).

IME that wouldn't work at the best of times i.e. a SWF file must be embedded in HTML which fires up the ActiveX control targeted at e.g. http:\\blah.blah\fred.swf". I'd have thought you might get the "how do I open this" dialogue though. Perhaps not.

I recall a ready-to-go ISO booting VM which you could get from VMWares appliance download area. A ready to build XP VM is pretty much the same, but with a tiny (because it's blank) virtual disk. Could be mistaken, but I also vaguely recall VMWare saying they couldn't care less about people throwing those around (would be a few K zipped up). I don't know what Player can do with snapshots though. A local VPC image with differencing is certainly one way to do this (so you can revert to a clean image every time). It does work.

This link to CSCCMD might help, however that version is not downloadable so you will have to hunt around to find a copy. I would run "csccmd /enum" and if that does spew out lots of references to the old share I would then use the /moveshare option. PS: Since CSC is a computer (not per user) thing, if it works on one you might well get away with running on the others via a computer startup script. This isn't something I've ever tried though.

Aww.. you miss it. You can get extremely close with the Microsoft Deployment Toolkit (MDT) e.g. PXE/USB/CD boot a machine, couple of minutes later fill in the computer name, pick the OU, supply a password... The problem is that MDT has a very steep learning curve (IIRC the only other person I've seen mention using it on here said the same) and there's not that much relevant information floating about on the net. I think it's lovely in a geeky sense but it's not necessarily economic i.e. you'd be lucky to save the time you spent on it.

Because it's rather difficult not to when you're responding to a comment on using ACLs to control traffic. ;b I didn't see any hint of that requirement from the OP, but having used VLANs for that precise purpose it was already in my justified category. If ACLs cater for your needs that's fine. ACLs used to cater for my needs a long time ago. But by-and-by people started making and selling firewalls that weren't just a couple of Ciscos with a DMZ in the middle, and to do that they had to add value - for me some of that management/auditing/non-overload-reporting stuff actually has been valuable and I'd much rather keep it. --- Meanwhile BECTA appear to be interested in getting schools to do some serious security. Serious network security has long meant policies (some implemented with ACLs) and auditing/reporting of those policies. Personally I think some of those desires might be a bit unrealistic, but I'm not in charge of the universe.

Ok I've attached a BDD/MDT script that might be a [useful|confusing|both] reference. It's in a WSF wrapper, but the code is VBS. This moves a computer that has already been joined to the domain from wherever it is now to a given OU. In this case all the info required for the move is already present in a bunch of environment variables. Z-MoveComputer_HostOS.7z

There's no "/i" option mentioned in the help for the version I've got (latest) so I don't use that either. There is a "/log" option though which is probably worth using to help see what's happening with that VBS call. Still 5 seconds running it manually logged on as an admin. Don't know, perhaps it depends on the info (I've got IP adresses and computer name in this case).

Drop the FQDN from it: Set objOU = GetObject("ldap://OU=ManagedWorkstations,OU=Local,OU=YGGwyr,OU=Secondary Schools,OU=Workstations,OU=Curriculum-v1,DC=school,DC=education,DC=swansea,DC=sch,DC=uk") Note I've changed the variable to "objOU" because it will return an OU object. Plus what I can't see in there is any subsequent domain joining code - did you skip posting that bit?

I've had BGInfo working at Computer Startup, but that's via a CMD and I RoboCopy mirror all the files beforehand (the only thing that bothers me about it is the curious amount of time BGInfo takes to run, typically 10-15 seconds). I wonder what happens if you get your VBS to call a batch file which just has the BGInfo command line in it. Or better still surround that line with some times: echo %date% %time:~0,8%: ***** START ***** > c:\bgtest.txt c:\windows\bgibmp\bginfo.exe ... etc. echo %date% %time:~0,8%: ***** END ***** >> c:\bgtest.txt That way you'll at least see whether it's running at all i.e. tiny time = no.

I'm not a VBS person, but at a very quick glance this bit looks wrong: "academic\pupils\2001 Pupils" & userName You need the \ to end up there e.g. "CONTOSO\jbloggs". If your domain was called CONTOSO then that line should be: CMDLine1 = "cscript xcacls.vbs " & """" & Subfolder & """" & " /T /G staff:r ""Domain admins:f"" " & "CONTOSO\" & userName & ":m" PS: Uncomment the WScript.echo "Command = " & CMDline1 line so you can see whether it looks right.

No, it unquestionably requires more care and feeding than CC3. If I'm generous and discount the various CC4 "teething troubles", we're still left with the new (post-build) s/w deployment which is more painful in lots of ways. I think it's an over-developed solution to a set of requirements that certainly aren't mine - perhaps it fits better with their BSF stuff? And ironically, RM using WSUS for sec-fix deployment (albeit behind an RMMC veneer), tends to be more troublesome than CC3s HFXs and "system package" allocation.

Perhaps I'll be corrected, but have they? Last time I looked there was lots and lots of boiler-plate security verbiage, but not very much relating that to eduction i.e. I found just one table mapping school data to (protection) category.

The first obstacle is getting a sufficiently lean/mean team in what I feel would be unusual agreement over technical strategy, with the considerable time/resources required to make it competitive. And sadly, to make it competitive, I think you'd be forced to make some shiny central management app, event though ADUC with a tweak or two is perfectly adequate. Then of course people also buy those commercial systems for the support from the vendor (you get lots of documentation, you can pick up a phone and call them during office hours, they do logmeins to fix things, they decide what KBs you ought to install so you don't have to, and so on ) and their nature makes it less likely that "people who know best" will fiddle and make it unsupportable. I've made an automated off-the-shelf-in-1/2-day vanilla that I'm very pleased with. Some random observations as a result: -To make it achievable you have to draw a lot of very firm lines for the requirements/implementation (AD, file system structure, policies, security etc.). AFAICT vendors like RM doing essentially the same thing is precisely why some people don't like them. -I haven't borrowed any edugeek tools. No offence intended folks, but they either don't do what I want, or are just to umm.. peripheral. -GPO scripting is mostly dead now, because of GPPs. -Native s/w deployment just isn't good enough (no reporting/status, no easy way to deploy EXE installers). All a bit cynical I'm afraid, but these are the kind of things you'd need to knock down or address first.

At a glance it looks the same, so here's a better link for that method with screenshots etc.: MS DS Team blog I think it works nicely too.

For all we know he might have had all his really good ideas already (not uncommmon). And Turing Machine, Turing Test, "father of modern computing". the WWII cryptoanalysis are all firmly embedded in history/science, so it's not like this rescues his name from obscurity. I think peoples energies would be better spent stopping some "persecuction" that's happening to someone right now - it's not like you'd wouldn't be be spoilt for choice.

Does this PXE boot fail with a message? What does it say?

Yes, that should reinitialise the Exchange VSS writer i.e. is a quicker way to get it in a stable state again than restarting the server. Are you saying the Exchange VSS writer is broken immediately after a reboot i.e. before you have attempted a backup? It shouldn't be i.e. VSS writers normally only break when a backup program tries to use them during a backup. Make sure the writer is OK before trying ntbackup or you will be wasting your time. You need to put ntbackup in expert/whatever mode to make the wizard go away. Then just use the tree-browse and tick boxes, same way you do in BackupExec. You can create a scheduled job in ntbackup.

Look into HV R2's Clustered Shared Volumes.

Absolutely. E2K7 doesn't do it the AD way anymore. Adding mailboxes is in the GUI management. This may sound cruel, but this is very basic Exchange 2007 management and you really need to RTFM.

Okay... there are some [fuzzy] VSS errors that just go away with a server restart, but we can discount those. Did it ever work? If so then have you renamed the storage group since creating the BE job? That will break BE Exchange backups and the soln. is to remake the selection list (use the text view to make sure it's got the new names). Again you can see how ntbackup gets on (I'd just test selecting the Exchange bits). My instincts say it's the Exchange side of things, so how patched is Exchange? [Has anyone spotted folk having issues with installing SP2 yet?] Also I'm not sure what it fixes, but MS have an OS VSS rollup somewhere that gets updated every now and then. Not the first thing I'd try but it's an option.

Indeed - targeted user GPP printer deployment works fine for me (I haven't needed loopback, just put some carefully targeted preferences in one user GPO that hits all the users)

NTBackup to a file on a disk somewhere (which is backed up by BE later). If that works with Exchange stores selected for backup you've learnt something i.e. the Exchange VSS writer does work and it's possibly BE's interaction with it that's the problem Is the Exchange VSS writer OK before the BE backup ("vssadmin list writers")?

I've did something like that a while back and it worked fine. In the GPO setting are you sure you've ticked the apply this to XP clients box on the second tab? Forget the details but you do need to tick a box for redirection to hit XP. (Vista+ presumably get their FR orders in a different manner from XP). PS: I'm redirecting start and desktop to local, for them NTFS-read-only folders i.e. they definitely are not the owners.