PiqueABoo

Wrong - it isn't rocket science in the real-world and that's not where we are. The above rings so many bells I could go deaf.

I don't think you overlooked anything. I'd have said DhcpEnumSubnetClients() etc. from DHCPSAPI if you'd asked when I'd been paying attention. Was that what you you used? If so, using that from C# isn't something I'd label "trivial" - not surprised you feel a bit victorious. I looked at doing that programmatically last year for an AD computer context menu extension and TBH it looked like a very serious pain. Luckily I only needed it to run from a 2008 DC so I did that extension with just a few lines of script which ultimately calls: msra.exe /offerra Not especially lovely because MRSA is clunky, but it was good enough for me. [Obviously also needs the right RA GPO settings applied to the workstations]

AD is a directory, thus user and computer accounts get to look up (read) most of the stuff we care about by default. In this case I was basically arguing for the 'contents' of rooms to be dynamically read from AD. Sure, that's not appropriate in this case ( ADUC context menus = No, above). Work creating entries in application specific text files and work filling in ADUC attributes are both work of a roughly similar magnitude. But the latter data is in a better place for any future scripts/apps that care about a room/location. I don't doubt the prospect of having to do anything in ADUC will be a show-stopper for some folk, but people like that are not why I pay my taxes and the sooner BSF or some equivalent lands on them the better. Seriously. In my experience, which is fairly broad, internet blocking is overwhelmingly Secondary territory and if people looking after 500+ desktop vanilla domains aren't comfortable with ADUC they definitely shouldn't be looking after them. Not for me. This may well depend on mandatory vs. roaming profiles etc. and there are always special cases, but my experience with the defaults for GPO processing says that once a set of GPOs has been applied to a user profile their policies will not be applied again until the version number of one or more of those GPOs changes. IOW if I'm right and you block via the proxy config I think you only need to worry about the effect of systems which push proxy config out through policy and have "Process even if the Group Policy objects have not changed..", or systems where policies are changed very frequently. Nothing then.. not that I or anyone else will care given that there is no permanent footprint on all the target boxes. Another question: What happens when a random handful of boxes in a defined room are unreachable when you attempt to do X to them all i.e. how are you working around RPC time-outs? Preliminary pings or something? Absorbing the time-outs with multi-threading?

General point for any project: The best time to ask for comments is when you've just made the list of requirements and proposed a technical architecture/solution to satisfy them. It's a lot harder to say things I'd have happily stated earlier when something is mostly finished - makes me feel mean/ungrateful, and no one who has just done a load of work ever wants to revisit square one do they? Apologies I missed that bit. Not persuaded. My starting position for any domain management app is that AD is where you do everything you possibly can because it is the native central, queryable, nicely replicated domain management database after all. Subject to the app (not for this) I'd also go for ADUC context menu extensions. Might be more short-term work on an app, but it's almost always less work afterwards. Some random comments: - If people's computer OU's do not reflect physical site topology then it's sad, but.. - There is a computer object attribute you can readily find and edit in ADUC specifically intended to hold a location and that can be entered in a user friendly format. - Filtering AD objects by OU or some attribute is a pretty basic AD concept (both in ADUC and any code talking to AD). You control the vertical so if Fred shouldn't see X then don't show it. See also: Security through obscurity. - Hands up everyone if you have credible evidence of your proxy settings being reapplied during a policy refresh in the absence of any changes to your GPOs. - Haven't thought this through, but is the real requirement to block the Internet (which might cause minor collateral damage when done via proxy fiddling e.g. maybe AV uses the IE proxy to get updates), or stop kids running apps they're not supposed to at any given point in time? Would it be more useful as something that stopped IE, Firefox and any other apps? Might write it off if I think about it some more, but I'd have considered a small appinitDLL to kill and sabotage subsequent startup of (temporarily) verboten apps. - ToolStrip.GripStyle=Hidden? All the above said, I don't think it really matters much for this app and I agree that less is usually more, but I feel better now Question: I'm not clear about where the app that actually disables the net and shuts down a PC runs. Remote APIs, WMI etc., code running permanently on each PC (if so what's the rough memory footprint) or both?

It's the text files full of IP addresses that always bothers me about things like this. Most domains use DHCP and IP addresses obviously can/do change = maintenance pain. Programatically pulling lists of comps+OU paths out of AD isn't hard, nor is subsequently getting IPs (although laptops can have the added complexity wired + wireless). Worst case you might need a file to map a user friendly display name to some typically static but not pretty/comprehensible LDAP path. So why the text files everyone? Are we betting on typical OU structures being such a mess that they're the only pragmatic option (and if so should continuing mess be encouraged)?

You mean they haven't done that already? Slackers.. They get to set and publicise the policy which leads to draconian disciplinary action if their underlings don't follow it. This is security and the biggest difficulty with security is that it cost money and like insurance, doesn't give you much noticeable benefit for your expenditure until something goes wrong. High up people with serious influence over budgets are definitely the ones to hit. Nothing to do with jobs where you are pretty much compelled to work at home for free on your own time then?

Yes, but I've seen other people make the same mistake as the OP and I forget which is which every other month. Some of the Abacus CD cases have the now defunct Becta **Curriculum Online** logo on them. Whatever, the Abacus stuff does have all the CC3 packages you need (if you can't find them call Heinemann support), but it's not a trivial installation until you've done it once.

::stop:: If this is I-Planner, with ITR etc. then you don't need to make any packages. You can get some necessary client-side CC3 packages CD from the vendor, but the majority of this is an SQL DB, content for that DB and a bunch of Word/PDF/etc. docs that live on the server. You will need an Easiteach package though e.g. for Easiteach Reader. Read the manuals and don't start on a server installation until you are 100% sure next week teacher's aren't going to say they want it on laptops they take home. The bad news: The server install takes an age as well. Can tell you haven't ever installed this ;b

Interesting, does it all work OK then? I ask because MS have repeatedly recommended a maximum 8GB for a "multi-role" E2K7 server and reckon you should be scaling-out (add another box) rather than doing that.

Key point: How new are the schools laptops/PCs and how much RAM do they have? Anyone who's been there will very likely agree that a realistic minimum h/w spec for running CC4 XP stations is similar to what you need to get a reasonable experience running standalone Vista.

Not really, provided you want the equivalent of computer startup scripts.

In even a half-heartedly managed Windows domain environment you won't typically let people install any software from the web or anywhere else. Deploying Silverlight the same way as you might deploy Flash, Shockwave in a school Windows domain is not difficult. Version 2 is currently on my standard browser plugins list as was version 1. It's probably not that common yet, but ultimately if people want to use your app there's nothing to stop their IT folk from deploying it. Adobe say they're working on the corporate deployment package we want for Air, so I'm ignoring it until that is released.

Not completely, but it's not far off. They weren't exactly forthcoming with the XP GINA either - no APIs and a lot of the info you use to do it was reverse engineered etc.

You might hate me for this (again) but I make the current Adobe Shockwave 11.5.0.596 which has an authenticode signature dated April 29th. Please don't ask me what that 0.0.0.1 adds/fixes! Aside: What I should have but didn't realise until playing with this specific release, is that these 11 series contain and install both the latest v10 and v11 shockwave players.

Just installed **Standard** R2 RC and it wouldn't accept the evaluation key that's on the download page (typed in, cut & paste from their page a couple of times etc.). Perhaps they got them the wrong way round because the Enterprise product key from the download page was accepted. [it's definitely, definitely the Standard install!] PS: After the 60 day re-arm stuff with 2K8 betas etc., not having to worry about it stopping until March next year now is a lot better.

BECTA: "These set out the measures central government departments and their agencies must adopt to protect sensitive and personal data. Becta’s guides are a practical interpretation of these measures that should be considered by schools,colleges and universities to help minimise the risk of data being lost or corrupted and any subsequent adverse consequences such as identity theft, news headlines or breaches of statutory/legal obligations." My emphasis. I don't think they're saying you "must" do X, it's more of a relatively strong recommendation to do X if you want that backside covered for DPA etc. And that's the kind of angle that I'd have thought would chime with most management when it comes to budgets.

Wins by a long shot. Pragmatically, and although this pains me, this is possibly more about liability than anything else. If an organisation provides crypto-sticks and makes their use for confidential data subject to an intelligible policy (that people sign) they've almost certainly covered their backsides. Yes, this is yet another area where you probably should consult a lawyer.

Yes and that has a cost too. [Although I now expect to be told that everyone's school management simply isn't good enough at that role to ever seriously consider factoring in the cost of your time into anything, and in particular whether that time might be more profitably used elsewhere.]

In what way?

Mmmm... looking at the 981MB example, when it comes to USB I *completely* fail to see any mileage in faffing about with TrueCrypt for pensticks now when you can readily get ones with on-board encryption for reasonable prices e.g. £15 for 4GB, £25 for an 8GB.

Some of those Primary SIMS boxes the local LEA are encrypting are perfectly real servers and the proportion of those can only get bigger (SIMS memory footprint almost doubled with the SQL 2K5 upgrade, if a school wants attendance etc. in classrooms you've got to run it on a server OS because of TCP/IP connection limits, they've got to add software for the same parental access to info as Secondaries albeit with a couple more years grace). The main difference is that they're likely to be smaller pedestal servers not bolted into racks, and the average physical security of that stationary cupboard or stuffed under a desk in a school office or whatever probably won't be as good as the typical Secondary equivalent. Relative budgets, space and so on.. Ultimately I think it would be unwise to exclude anything containing personal data from being a *potential* candidate for full encryption unless it has credible physical security. To be honest my starting position for server encryption was A Cold Day In Hell[tm], but I struggled to think of any really convincing objections besides this one: You can't restart it unless someone will be present to type in a password (or whatever).

Don't have the link handy, but the Hyper-V Server R2 *release candidate* is available now.

Yes. But. The real-world isn't binary, you need to engage brains and adjust to fit (and I'm sure the Becta authors would agree). For instance machines can end up outside the school without consent. This guidance applies to Primaries too and I can think of a couple of local cases where after breaking into the office and presumably not finding the petty cash box or anything else especially interesting they've settled for office computers, some of which have contained personal data.. and of course that's data on the little ones which typically generates about 100 times the public concern/panic compared to teenagers. Thus in my corner of the world, the LEA who tend to implement and look after most of the SIMS boxes for Primaries are starting to use full system encryption on them. That makes perfect sense to me. Yes or at least make that a starting point and see if you can find any credible reasons why you shouldn't do that for any particular staff laptops. Realistically this isn't that hard to do and it's not hard for the users either, so my view is that it's worth doing even when the risk in any given case is relatively small.

I can and there's nothing I want to do these days I can't do from Windows, but on reflection it's taken truckloads of effort over the years to get the 'toolbox' together and keep it maintained... and I can't think of much in there that you'll find with Google even assuming you have the patience to wade through all those crummy software sites stuffed full of mostly mediocre [share|trial]ware that show up when you look for anything. So yup, you're right.

Well you don't need Becta for that - full disk encryption whenever you can because it's a lot more reliable than some folk will be at a) deciding something needs to be encrypted, and b) actually encrypting it. That's a no-brainer for data on staff laptops, it's servers that are more interesting. Do you or don't you do/risk full disk encryption on those.. the overheads shouldn't matter on a typical server with oodles of MIPs to spare... but if they're seriously physically secure is it worth the trouble given the very low risk of someone running off with one. Same argument applies to server folder encryption. Lots of factors, no one-size answer.