PiqueABoo

Tried it anyway on my virtual lab bench and it worked fine - just had it adding a few drive and printer mappings via preferences which all have targeting rules (user groups, sites, OU etc.) You don't need that xmllite patch on XP SP3, just the CSE (KB943729).

Yes but MS documentation is MS documentation and it has a magic word: "offered" Windows Updates "offers" patches and updates. That line almost certainly refers to the CSE not being in the list when an XP SP3 goes to Windows Updates. That is not the same as "doesn't work on SP3" - just install the pre-reqs and the CSE on one and see what happens.. [Would have tried that myself by now were it not for SP3 and SIMS]

Uh huh... but what's that load like for 2K8 preferences in RL? I can make any conditional depend on a bunch of variables it's already injected into the environment i.e. rounding up all that information at the "start of time" is a routine hit regardless. Don't know, but given that there's a good chance it also rounded up values for all the built-in targeting options e.g. if some setting of mine depends on the computer's OU, it likely already has the value of that stashed away for what should be a very fast compare. I can't see how **per setting** filtering could possibly work otherwise. [That said, if pre-defined options don't cut it you can use custom WMI filters in targeting rules - something I'm planning to avoid]

Options for XP. 1) Ye olde scripts.. 2) GPO "Deployed Printers" and running that app at startup to get them. 3) Preferences - good because it can set the default printer. Not brilliant because can only deploy shared printers to Users and I want users to get printers near to current computer. [Loopback merge or preference targeting based on current computers OU would fix this] Any more? Any opinions?

I could: a) Scatter lots of GPOs around an OU hierachy each with specific sets of Preferences relevant to a given OU branch. b) Just have one or two near the top of the hierarchy, with settings for everything way down below but using conditional targeting e.g. set A if user/computer belongs to OU X, set B if user/computer belongs to OU Y. [..or "belongs to group X"] Anyone deeply enough into this yet to have strong opinions about the best way to go?

Oh look: "Teacher access to learning platform/ portals" = "Mandatory two-factor user ID, password and token" (my emph.) -- Just randomly dipped in some of that documentation so far.. and sorry folks (whoever) but picking up large tracts of CSEG/Spook practice and substituting "school" in the occasional sentence is insane.

Windows DHCP doesn't hand out addresses by default.

Yes, you can use "netsh" to fully configure DHCP, export leases to a file and import from a file. Not that I'd bother unless I inexplicably had a lot of reservations - Windows DHCP is easy to install again somewhere else and can be set to do conflict detection.

It's not corrupt images and there's just the one virtual NIC. This is simply 2008 WDS TFTP component listening but not responding (no return network packets) to the initial request for the initial boot file - don't recall the file name in the request, but it was a *.com and it was there in what I **think** is the right place on the server. Apparently (I'm no expert) WDS TFTP used to be a bit more standalone amd complete, but it's more integrated with the WDS service in 2008 and only implements the subset of TFTP you need for WDS. Maybe it doesn't like the request for some reason so just ignores it. If I could maybe a) find or enable a relevant log, b) persuade it to spit out a bit of detail I might get further... but so far I can't find any info on whether that's possible or not.

Gosh documentation that exists! It's nicely presented and readable.. the only thing I'd add is a DNS caution (names need to point to the right addresses etc.) Re. the potential future features emerging above, haven't done shutdowns but I nailed down most of that territory way back (recent example is whoison CL util in the Downloads forum). Best advice I can offer: Network scanners always need to be multi-threaded to get around latency (RPC timeouts being the worst offender in this specific case). It's worth going the extra mile when writing such code so you can easily reuse it for anything you want done to multiple boxes via the network.

Just playing virtually and will probably give up soon and use Plan-B, but I've got MDT and WDS on a DC alongside DHCP. MDT is only relevant in that I've imported it's PE boot wim into WDS. So with a little help from Network Monitor... PXE client boots PXE client gets an IP address etc. PXE client gets path+name of PXE boot file it needs to TFTP PXE client requests the boot file from (WDS) TFTP, but it doesn't respond - no network packets are returned to the client. Netstat -anb shows WDS listening on the TFTP port, WDS is set to talk to any old client, the firewall is off. Is there some big TFTP Responses ON/OFF button I'm missing? -- Plan-B which worked, was to turn WDS off, set DHCP options 66 (server's address) & 67 (pxeboot.n12), kill option 60, install the freebie Solarwinds TFTP and put this lot all in TFTP-Root because subfolders don't work: BCD boot.sdi bootmgr.exe pxeboot.n12 winpe.wim winpe.wim is a renamed Lite Touch PE wim.

Yes - I'm asking whether adding one Vista box to an existing 2K3 & XP domain will enable the use of preferences. Key point here is that there's a client side extension for XP to process the preferences, so it's just a case of whether that Vista box can configure them in GPOs in your 2K3 AD.

In principle.. I think.. maybe.. you can install RSAT on a Vista box, point it at a 2K3 AD, start configuring GPO preferences and (assuming you've installed the CSE KB on any XP boxes) it works. Anyone tried this or know different?

This is what I ended up doing. The vmware nat service doesn't appear to understand subnets etc., so I put one that does between it and and my two pretend school sites. It wouldn't be as portable, but an alternative would be to bridge 'router nat' to the hosts real network rather than connecting it to vmnet8. realLAN ----------------------- | vmware host(nat gw) | vmnet8 ---------------------- | router nat | vmnet4 ---------------------- | | router1 router2 | | vmnet2------- vmnet3-------

It's been a while, but I recall that had eventually taken out some of the "wrong" records once. It's probably a good idea to turn DNS advanced view on and check any important static DNS records won't get removed (take the tick out of the zap when stale box).

I would. Make sure you've set the scavenging interval via the dns server properties tabs. Also turn on dns advanced view and check those surplus PTR records can be scavenged and have credible timestamps. If they don't you may have to force that via dnscmd.

Further adventures: Went back to the FBSD kernel building box and played with tinyBSD which rebuilds and rounds up the files for a little version and throws it in a disk image. That has a couple of loose ends, but you can tweak those away before throwing the image at a 'real' disk.Turns out the smallest disk you can make in VMware is 102MB, but the one I made doesn't grow beyond 27MB. The two DummyNet routers (adding 'slowness') are happy so far with 32MB RAM, ditto for the NAT router I had to put upstream of those as a workaround for vmware's NAT being a bit dumb. Just need to remember what I was doing this for in the first place now..

Soo.. I messed around a bit more with the Dummynet vm.. turned off sendmail, syslogd, usbd, cut down the ttys and reduced the vmware memory to 64MB... and it still does the job. Then looked at vmware's NAT, discovered it's just a bit lacking so tried turning NAT on in a clone of the above vm, but naturally the required option wasn't compiled in the kernel (Global conspiracy: "That NT bloke will probably wander by and want that one day, so let's turn it off!") Then went hunting for little Linux firewalls, found several but so far none will cope with internal router/subnets. Couldn't face wading through other folk's interesting custom scripts to figure out how/where I could safely put what I wanted, so went back to FreeBSD for consistency and installed two v7.0's, one to rebuild the kernel, the other just to be much smaller, copied kernel from A to B and that works - only downside is the virtual disk after a minimal FBSD 7.0 install is about 280MB.

RM has a Scripts GPO you can use for scripts the same way you would do it with some vanilla GPO.

[..that you may or may not want to run in VMWare] Having skimmed the wikipedia entry on network emulation someone pointed me to in a thread that's wandered off somewhere, they're either expensive which I don't want or care about (very rough approximations of slow links is fine) or suprisingly big e.g. want 1/2 GB RAM. Apparently Linux kernel 2.6 has NetEm. So has anyone seen any little router/firewall distros that might have the right bits in it, but not the kitchen sink?

Oh good coz the whole point of it being in *nix is because I'm asking about making routers with nix.

Was unsure where to post this because it covers a few forum topics. Settled for here coz it's where I'm most ignorant, so this is your chance to prove yourself (And then I moved it - Ric_ ) The mission, using vmware, is to simulate a link between two schools connected to some RBC/big intranet, like this: realLAN ----------------------- | vmware host(nat gw) | vmnet8 ------------------------ | | router1 router2 | | vmnet2--------- vmnet3------- After a lot of hunting for virtual routers I found DummyNet in VMWare, fiddled about & so far it does exactly what I want - two credibly slow links for vmnet links 2-8 and 3-8. I'm just a bit nervous about RAM because each router runs with 92MB and I've got servers to throw in yet etc. So: 1) If there's a feasible way to cut that RAM down I'll probably find it.. eventually. Anyone currently really wizzy at FreeBSD care to take a peek at that VM for any obviously useless (if just being a router) memory overheads? 2) Has anyone done anything similar e.g. do you know of something else that I could use? I've still got a perfectly good LRP floppy somewhere that would do for basic routing, but a key point here is simulating a slow, lossy link. [VMWare specific aside: I haven't tried it yet because it's not essential, but routes from the NAT gateway back to vmnets 2 & 3 would be good. Haven't got a clue how you tell it to do that - possibly just add routes to the host - don't know. Anyone?]

You mean fib? Not a strong interest of mine so someone probably knows better, but I thought DPA stuff usually ended up with errant organisation writing a couple of hundred lines on how good they'll be in future. I'd be suprised if there's been any serious criminal proceedings unless unless it was something like someone caught selling police records etc. Anyone?

Last real-world compomise I had some glancing involvement with was done over https - 11 yr-old student had guessed/shoulder-surfed the head's password - head had insisted on being an admin.. fill in the dots. What between Teacher's home and the school? How are they going to do that? By all means use https because it is helpful, doesn't cost too much and if nothing else will let some folk tick a box that makes them feel all warm/fuzzy, but pragmatically if Student can pull off that MITM in the first place then Teacher is probably already stuffed in 101 other ways.

https helps, but doesn't make it especially secure. It's the authentication you really need to fret about i.e. if you must use them, those passwords.