PiqueABoo

Haven't ever done s/w deployment GPOs, but otherwise the things I couldn't make it migrate: 1) IE trusted zone policy ("zonemaps" - I had some local UNC paths in the trusted zone) 2) Any Server 2008 Group Policy Preferences.

You need that? I thought one of the religious HV vs. ESX points was that ESX overcomitted RAM i.e. allocates what a VM is actually using, not say the 4GB it thinks it has.

Said this before, but: An Exchange box should do nothing besides Exchange, so the underlying OS should be largely irrelevant. And with E2K7 it helps if you've got the 32 bit management tools installed on a 32-bit OS somewhere, which gives you even less cause to go use whatever 2K8 R2 might have given you on the actual exchange box.

I think that's a pain but it probably has something to do a) shaving costs, b) people moving their laptop without unplugging the cable.

I would try: GPMC export your old GPO, then GPMC import it using a *migration table* to map old to new UNCs and anything else you need migrating (e.g security principals).

Because the C-A-D preceded Windows keys and the meme has stuck. Plus you don't necessarily have them on all keyboards so you need to know how e.g. this Dell laptop doesn't.

Ho hum.. the perils of sticking your eggs in other folks' very big baskets (see also: "Cloud Computing"). PS: My GMail (for testing stuff) account works right now.

Presumably by turning IP directed broadcasts on (which is typically off by default because of it's old use for DOS amplification )? The switch feature set may or may not include serious L3 ACLs, but if switches that support VLANs don't support BOOTP/DHCP relay then they are a heap of doodoo. I'm not particularly thrilled by VLANs unless there's a decent case for them. Yes, you can carve up your network into lots of little subnets, blue boxes here, pink boxes over there, but it adds all that planning and a whole heap of subsequent management & documentation issues. I would say, justify, justify and justify more... and remember that using something like IPSEC on sensitive machines/resources can give you a lot more assurance than sticking them on a separate VLAN (unless you add all the port access control stuff). Plus, it's OK, but in this day and age I'm not a huge fan of using switch ACLs instead of proper firewalls with management/auditing/reporting. [Essential if you're going to do anything more than make worthless random guesses when it comes to that "risk management" thing]

MAC broadcasts won't flow to another VLAN (subnet).

Anyone have a a reason to believe this issue has gone away (and if so how?): Why disk space is incorrectly reported on folders where File Server Resource Manager quotas are enabled At a glance my numbers aren't working as described in the link (I'm in Case 2 land with XP clients).

Can't be quite the same because there's a KB971029 update for Vista and 2K8.

Umm.. for this IIRC you should make sure: 0) Scanners e.g. McAfees say all machines active on the network are clear. 1) None of your admin passwords are in the Conficker list. 2) Machines you are about to connect to the network have: a) KB958644 installed b) Working up-to-date AV 3) Don't log on to an infected machine as Admin when it's connected to the network. (Points 1 & 2 should stop any other machine being "got" but it's prudent). Also obtain and get CC4 SR1 installed so you have an XM WIM build image with KB958644 integrated into it.

After testing, I'll likely be pushing this out to a lot of servers next week (earlier this year someone managed to infect a few on several sites with some penstick malware that the current AV didn't have the sigs for). I suspect this (rather than *all* autoplay disabled via GPOs that everyone really ought to have set at least a couple of years ago) might be good for those Primary schools where teachers have single licences for a motley pile of run-from-CDs kicking around.

Just found this potentially useful KB: KB971029 "This update disables AutoRun entries in AutoPlay, and displays only entries that are populated from CD and DVD drives. Effectively, this prevents AutoPlay from working with USB media. "

Standalone is free and has a Failover option in the config UI.

The OP didn't say which virus it was (I mentioned Conficker as an example only). CC4: The XP image is a standard one created/shipped with the system by RM or updated via SRs, not created locally. We'd have certainly heard some noise by now if any of them contained a known virus.

Good question. I've updated my above response re. SR1 XPs so that's one obvious scenario out of the way.

Downloadable here

Will SP3 be enough e.g. stopping Conficker needs a post-SP3 KB. There's no quick/easy answer to this... RM really need to sort out a fresher CC4 XP WIM image. EDIT: Conficker turned out to be a bad example because the XP image in CC4 SR1 was created towards the end of Nov 2008 and *does* have KB959644 installed.

I've always liked the irony in this: If you get a Pro edition it writes more code for you, but unlike an amateur, why wouldn't a professional be able to write that code themselves (and save it as a template if likely to be reused)?

Was just skimming the EduMove PPT, that promises a "fix permissions" feature and as advertised that wouldn't work for me because I more or less use the method summarised on the MS DS Team blog. Take a server path to a user folder: X:\User\Staff\ In this world all the permissions are inherited from the folder *above* the user's e.g. the permissions that count are set on the "Staff" folder. Here fixing the permissions means all we want is the correct Creator/Owner on folders/files in the user folder (which incidentally fixes the user's quota usage), something you only need to do if some Admin has dropped files into a user's folders. Bottom line: I just create user accounts, their folders take care of themselves.

Would need precise versions and I would let s/w qualify if it has other irksome attributes e.g. - incapable of saving data anywhere but in the local All Users profile. - doesn't work if (roaming) appdata is folder redirected. - has it's own file open/save dialog that doesn't honour Explorer policy on drive visibility etc. - depends on and includes an ancient version of [X] which trashes any current version. X can be lots of things, for instance Shockwave.

You're doing this on a 32bit box with the E2K7 admin tools? I believe you need send-as rights on the mailboxes and receive-as to import. You can set that on a DB like this with your own bits where I capitalised the words: Get-MailboxDatabase -Identity “SERVER\STORAGEGROUP\MAILBOXDATABASE” | Add-ADPermission -User “DOMAIN\Administrator” -AccessRights ExtendedRight -ExtendedRights Send-As

Absolutely. Strictly it's a quota per *folder*, which may or may not be shared. For instance I've done it for this kind of path: D:\FolderRedirect\Staff\Teachers\\Documents There is one share at D:\FolderRedirect. The FolderRedirect, Staff and Teachers folders have some interesting NTFS permissions to a) keep them from getting into each others folders, b) let Windows create the sub-folder for them on first logon. The auto-apply quota is at D:\FolderRedirect\Staff\Teachers and is automatically applied to the sub-folders.

Ah.. that is a good reason and I believe it, but in that case the root cause of my confusion is that dotNet 3.0 *definitely* contains and installs a full 2.0 (if required) so you shouldn't need that. Can you tell that I think installing the full+patched dotNet "suite" takes forever? I suppose removing the separate 2.0 wouldn't help much, that is in principle the 3.0 should notice and not try to install it again.