PiqueABoo

Haven't tried it but I thought you were supposed to get Preferences by just deploying the XP CSE and running the 2k8 RSAT from a Vista box - essentially you need GPME, not ye olde GPEdit, to edit Preferences. I found deploying printers, including setting the default, wiping out any virtual ones you don't want etc. to be very easy with Preferences... and you can do some interesting magic with the targeting.

BTEWin did work. Need to go study the syntax now, but did a quick hack and easily got it to: a) Mount an ISO b) Change the drive letter to X: c) Run X:\somepath\someapp.exe d) Wait for someapp.exe to finish e) Unmount the ISO And you can compile it's *.BTE scripts to standalone EXEs i.e. don't have to deploy that as well as DT. Sooo.. everyone uses the older DT 3.47 for this kind of thing or is the 4.x one safe now?

Oops, didn't think of DT being able to tell you about the drive it's using. Meanwhile I just found BTEWin script stuff which claims to be able to change a DT device drive letter: "Daemonletter device, drive letter : Changes the letter for the given virtual device if possible. Example : Daemonletter 0, X" Haven't tried it yet, but I'd definitely like a fixed drive letter.

ADUC is still there.

Just started looking at the (older) 3.47 DT. Mount is easy, but I can't figure out how you get Daemon Script to run an app from the virtual CD?

..again, probably. It's the obvious scenario ISO image on some share, shortcut/something simple They[tm] can click on client, which mounts the image, preferably to a specified drive letter (command line option?) , runs an app from somewhere on the virtual CD, unmounts CD when app closes. I've forgotten which one it was but I'm absolutely sure I saw one with a bunch of CLI options that would mount an ISO image to a given drive letter a couple of months ago.. but I've forgotten what is was and just can't find it now

Perhaps I'm wrong, but I've never understood the widespread CC3 "block inheritance" meme, because if you make a new OU off the AD root then computers in there will only be inheriting Default Domain policy - RM haven't done anything scary in there. Anyway, to stop CC3 user policy applying when CC3 users log on to vanilla machines: Set the computer GPO policy for the vanilla machines to use loopback-replace and then link any user GPOs you want to your vanilla computer OU. If you need different GPOs for different user groups logging on the vanillas, you'll have to security filter them. Naah.. if a complete vanilla from scratch configuration (GPOs and everything else) takes significantly less than 2 months, it's not finished to a reasonable standard or you've imported lots of configuration from elsewhere. Edit: Or there's more than one of you.

Oh I didn't realise that. I guess it's just another object attribute.. I'll go look later.. have just made some plans to set protection via script/whatever on some set-in-stone AD objects. If nothing else, it will mean no one can claim it was an accident..

Definitely not in a hurry to play with the 2K8 R2 beta, but I've skimmed the rev. guide and amongst other things it shows the new Active Directory Administrative Center (another standard 3-pane layout thingummy). Not sure I can cope without ADUC, but maybe it's still there... anyone want to play and find out? AD Recycle Bin might be handy, but OTOH I don't delete things accidently (and deleting OUs purposefully can be hard enough already coz of the standard 2K8 accidental deletion thing).

But what is that required functionality and who is demanding it? That's a sincere question because I genuinely don't know. From where I'm sitting all this window-updating-buffer-not screen thing does right now is give the OS an opportunity to make some eye-candy. But the raison d'etre for any OS is to run applications - the bits where you get some real work done - how are they going to benefit? Will anyone get that real work done any quicker?

You reckon? Looks like it depends on the application and what you're doing with it. Scouting around the tech I found this MS docx: Remote Desktop Protocol Performance The bit I wasn't aware of is RDP 6.x's significant "bulk compression" improvements. Possibly not that important on a nice fast LAN with a serious server etc., but a good reason for 2K8 rather than 2K3 in slower scenarios. In other places: Remote Apps only look marginally faster across the network than Remote Desktops; And if you want remote glass et al then composition remoting uses more bandwidth unless it's IE when it's significantly less for some unfathomable reason. Pragmatically that's definitely not my number one concern running XP, nor is the age of the code (old usually means fixed, not full of new bugs).

I think you've already been pointed: If it happens to the set of files that you're backing up and there are little black clocks again then it seems very likely that your xxcopy program is trashing the source file and folder attributes. You'd have to ask the vendors why. Attrib definitely won't fix that, nor I believe will Windows script (FSO won't touch the most significant bits of the attribute field) so to test this and/or sort it out you'll need a real app that can read/write the 'offline' attribute. What's wrong with Robocopy anyway?

Absolutely, but "locally" is a core requirement for me - this needs to work when at any given time a significant proportion of the domain's machines are stubbornly offline (laptops at home, machines that are not going to WOL in a month of Sundays or whatever). Computer start-up when connected to the domain is when SI status can change, so that's a good time to capture what has changed... assuming I can make that happen after any installs have finished. Manually triggered remote queries of machines can be useful and there's nothing much to stop me using say psexec or WMI to remotely kick off that local app to refresh the data for a machine, but if that's the only way to do it them I'd have to keep kicking scans off and would probably never get a full set of current SI data for the domain. Cor.. that is verbose. I made something like that just for h/w once and also in JS, but settled for a lot less info. Kind of relieved to see it has the same network adapter issues as mine - it reckons I've got 39! I just reported the first two which works on clean boxes, but not here.. side-effect of cloning old laptop which had VPN, VMWare, MS vnet adapters etc. That script doesn't report the EXE installers (that show via add/remove). It did hotfixes much better than me, but that prompted me to figure out where WMI gets them from - underneath another regkey. Could be what I've used it for in the past, but for me WMI is synonymous with "slow" whereas dumping info from the registry has been fast. Agreed, although it will probably be dotNet and system.directoryservices which is essentially a wrapper for ADSI. Scripts can do pretty much anything in AD including get and set ACEs, but in practice they're not so fast and you can't multi-thread your way around time. Even with MT a second spent on 500 clients is much better than work at the server so the more I can get the client to tell me the better. Currently digging around in the appmgmt folder in %windir%\system32 and wondering if I'll ever find decent documentation on values such as "AppState" that appear under a packages GUID here: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt Don't know if all applicable package GUIDs turn up there and whether say that AppState would indicate a failure (or perhaps there's useful info about that in the corresponding Installer regkey). Will have to make some MSI destined to fail and observe. This is in the registry neighbourhood where you can get the computer's applied GPOs and version numbers etc. Looking around I *might* be get almost everything I want from there and only need to scratch AD at the server-side of this.

Difference is I'm just looking at getting some reporting for native GPO deployment for free. SpecOps is a complete deployment system with background BITS xfers etc., costs money and there appears to be a show-stopping 2K8 GPME support hole. WMI with Win32_Product? I did look at that but unless I'm missing something I can quickly get all that plus more potentially useful info to play with from the registry e.g. hotfixes, EXE installs (most of which do make an uninstall sub-key) etc.

It's another ticked box in the flexible OS features list that costs MS nothing (or very little), and having gifted Core to the command-line warriors they needed something to keep the GUI-bound desktop icon arrangers happy? I used to run NT3.5x & 2K server, but I wanted one for server relevant s/w dev etc. VMs were wonderful, but not as convenient then as they are now. Aside: SysInternals pretty much made their name exploring how NT workstation could be persuaded to morph into NT server, and what MS did to prevent you fiddling

Eh? I have RDP'd to a 2k8 server from the XP laptop I'm using now. That might require the RDP client update (think that's in XP SP3, but I'd already installed it to play with 2K8 RC Remote Apps etc.).

Some thinking out loud following on from this thread. Any comments, especially thoughts on why anything will or won't work, is ridiculous or whatever are welcome.I spent a couple of hours earlier on a Quick Win[tm] which is a small, relatively quick app you run via a computer startup script: a) If there have been any changes since last time it trawls through the registry s/w uninstall keys and creates/overwrites a local file containing info for each app. b) If there have been any new MsiInstaller events since last time these are appended to another file. I still need to think about filtering these events. c) Creates a H/W inventory and then creates/overwrites a file if that inventory is different from last time. Any new/changed files are then copied to a network share obtained from a policy setting. Server-side I've made a simple GridView app to display info from the relevant s/w uninstall file that is launched from the ADUC computer context menu. Haven't done viewers for the others yet (I'm not that fond of GUI dev). --- So far so good, but I want to add in GPO s/w assignments for a given computer e.g. to easily see that package X was assigned but has installed or failed to install. OK, with enough effort I can trawl through a computer's AD path, find any enabled linked GPOs, figure out if they apply to the computer, find which of those have SI policy and figure out whether the computer has appropriate security permissions for any given package within an applicable GPO. GetEffectiveRightsFromAcl() will likely get used on any AD GPO/ Package object with non-inherited ACEs unless anyone knows it doesn't work or of an alternative in .net? Undecided, but I'm also contemplating just grabbing the list of applied GPOs (and critically their version numbers) from the registry as part of the client-side s/w uninstall key dumping - would save me working out which ones are relevant to a given computer and could be handy as a "GPO application or maybe Sysvol replication is stuffed" detector. --- One way or another the latter should be doable, but what I really want is to be able to R-click an OU to launch an app that displays S/W status for all the computers under that OU. The bit that's bothering me here is scalability - I'll be happy if it works well enough for hundreds (folk with thousands can go shop) and reading/processing hundreds of simple little files server-side isn't that big a deal. But efficiently sorting out the package assignments, that is checking lots of computers against AD GPO and individual package security permissions, could be a bit tough. Guess I'll have to round up (cache) info about all GPOs in AD that have SI policy, their permissions, packages and any packages specific permissions the start of time - haven't thought any further. One thing I don't want to do is throw any services/agents at this - I definitely don't want anything running all the time client-side and yeah it would probably help somewhere, but I really don't want (yet another pesky) database running server-side.

Not what you asked, but you could just slipstream SP3 into your O2K3 to make that problem go away.

Troll? Missed what, if anything, transpired in the last week, but that's not such an ace diagnosis and the (cliched, sorry) advice doesn't really work e.g. they did a fine enough jobs shot-gunning those posts without any interaction and for the most part are oblivious to any effects or responses. I think a better word is zealot. A bit sad in one way, because the subject is one of those I think people, especially techs in this profession, ought to know a bit about. But hey, what's understanding the viewpoints (including the crusader's), legalities and politics and so on compared knowing what biscuits everyone likes...

Organise them by year of *entry* to the school - that doesn't change.

It was - SP6 accidently broke TCP/IP (for non-admins).

..there would be some brilliant, free, solution that just does what you want with a bit of finesse! I haven't needed to pay much attention to this area for a long while, but a lot of you lot must have so where is it then? SMS's or enterprise products for ££££s with lots of pretty colours and nasty pie-charts appear to be all over the place. Apparent favourites like SpecOps Deploy aren't especially cheap either, it doesn't appear to like 2K8 and the one that allegedly will appears to be a teensy bit delayed. Freebies seem to be limited to MPKG that I like in principle but it's not integrated with AD computer groups, OUs or whatever - you have to keep typing things in XML in files. There are a few fans on Purgos on here, but I can't figure out what may or may not be happening with the v3.0 beta release I can't download and the latest v2.0 won't see the domain to pick any computers (perhaps it's a 2K8 thing). Then there's good old GPO deployment which pretty much does what you want, especially if you security filter individual packages (rather than entire GPOs) and know how to wrap a *.exe EXCEPT you haven't got a clue whether a package did or didn't install. So what do you do about package installation status? Throw other inventory tools at the problem? Wait until someone knocks on your door and complains X isn't installed? Ignore it completely? Make custom scripts to talk to WMI or the registry? Thinking about the latter, very briefly so don't shout too much if it's stupid, it struck me that MsiInstaller does of course write events with timestamps, informative IDs, messages and the all-important GUIDs in the app event log, so you could routinely trawl through the new-since-last-time events at computer startup and throw the fresh MsiInstaller event info wherever you want it. Downside is that event logs can and do die via abrupt shutdowns, but you can detect that and could probably fix it at the same time.. assuming localsystem can clear an event log. [What's a "holiday"?]

..you would be silly not to use Preferences because that can target default or non-default printer deployment based on (boolean) combinations of everything but the kitchen sink: It's Wednesday and you're on a laptop which in OU X and it has an IP from a specific range, but your logon account is not in the Idiots group and there isn't a locally attached printer... For me, based on serious/significant production use, Preference targeting is lovely. If I had a vanilla 2003 domain then throwing a Vista RSAT management workstation on it and deploying the XP CSE would be a bit of a priority. ..ditto with a very simple 2K8 Preference to delete the printer called "Microsoft Office...

In the non-routine scenarios I want it for I'm perfectly happy having two concurrent sessions with the same Admin logon. Don't care about audit trails, it won't break anything that couldn't be broken the same way with two separate accounts, plus there's the architecture changes noted above re. session 0 (applies to Vista and 2008). If this was a local support team, routinely accessing server to do [whatever] then yes - each would have their own special admin account for that.

Which one did you use (that presumably worked nicely)? v1 or the v2 beta?