Jump to content
EduGeek EdSec 2026 is Go! 27th Oct in Derby! Join us for a day of EdTech security focused talks, networking, and an evening social ×

FragglePete

Members
 View Profile  See their activity

  • Posts

    1,996

  • Joined

 Content Type 

Blog Entries posted by FragglePete

  1. FragglePete
    I've been looking for a cloud backup provider for a bit, but to be honest, I've been busy, other things on my plate, etc, etc (always an excuse!). I've also been looking at implementing Chromebooks because of their simplicity and the cost - but of course you need G-Suite for that. So, even though we're fully signed up and committed to Office365 I pushed through an application and this got agree a couple of months back by the nice people at Google - why can't we somehow use both?. And, the 'Unlimited Storage' on Google Drive just kept shouting at me from the back of my mind over recent weeks along the lines of.... "come on, you can do something useful with that!"
     
    My backup system uses Veeam (which, is great, albeit a tad expensive in support which usually results in "That's a Microsoft problem - raise a call with them" - but, that's another story) - and this backups locally to the server itself, which gets copied onto LTO-8 tape (call me old fashioned, but I like tape and the importance of an 'Air Gapped' backup helps me sleep at night) and then these backups get copied to a Synology NAS unit in another building - D2D2T2D if you will. But, how about pushing up to a cloud backup as well....?
     
    So, today I finally got around to it. Having already setup SSO with Azure and to self provision G-Suite accounts a while back (need to do more, but it works for now), I setup a non user account in AD which replicated nicely through to G-Suite.
     
    I created another shared directory on the NAS unit and had Veeam set this as another backup repository. Next was to installed the 'Cloud Sync' package on the Synology unit which enables you to sync a folder on the NAS with a whole array of Cloud Drive providers - Google Drive being one of them; set this up with the credentials of my non-user backup account I created earlier.
     
    Final step was to add additional Backup Copy jobs in Veeam that copied the backups to the new repository on the Synology Unit - remembering to enable encryption on the files that are created. For now, I'm just including the really really important stuff... SIMS, Domain Controllers to recover AD, Cashless Catering, etc - just the really necessary stuff we would need in the case of absolute loss. And off it ran..... uploading the files as they are created in the new repository to the Google Drive of my backup user account.
     
    Of course, I'll be adding details of this process in our GDPR matrix showing clearly the flow of data and logging all the necessary privacy statements that Google have in place with G-Suite for Education.
     
    So, thank you Google for giving us schools this extra capacity and I promise I won't turn it into a digital dumping ground of stuff no one really needs but keep this for that all important stuff we just can't do without!
     
    Pete
  2. FragglePete
    I'm currently playing about with Windows 10 and various GPOs and GPPs to try and lock things down a bit.
     
    One thing that was puzzling me was that I could not turn off the option within the new fangled file explorer to show hidden files. I don't want our students being able to do this as we have some folders that are hidden for various reasons. Up to Windows 7, this was nice and easy with the GPO under User Config > Policies > Administrative Templates > Windows Components/File Explorer and set the 'Do not allow Folder Options to be opened from the Options buttons on the View tab of the ribbon'. Windows 10, this does nothing!
     
    Stumbled across this website: Server 2012/Windows 8 – Ribbon UI: Disable Icons, Buttons, Shortcuts, Tasks, and Commands | Paper Street Online - which indicates that the new Ribbon UI in the explorer is not as customisable as we would like. Registry hacking required to get it working.
     
    I've setup GPOs to set the registry depending on the user type logging in, but these particular keys need permissions to be set, which from the looks of it, need to be the local SYSTEM account, which you can't set using a GPO. This brings us on to the same site, but with a script: Batch Script – Ribbon UI Customization: Take Ownership and Change Permissions of the CommandStore Subkeys in the Registry | Paper Street Online, which run as an administrator will set the permissions correctly.
     
    In my endeavour to automate this as much as possible, I've added an extra step in my MDT Task Sequence that runs this command as during this process it will be running as Administrator during the setup. Copied the .bat file and a copy of SetACL.exe into the Scripts folder of my deployment share. The task sequence has a 'Run Command Line' step with the command line being cmd.exe /c "%SCRIPTROOT%\regperms.bat" This tweaks the particular registry area and subkeys allowing a few more registry tweaks using GPO.
     
    With these tweaks done, the 'Hidden Items' check box essentially is neutered. They can still check and uncheck it, but it does nothing (so I can't call it disabled).
     
    Messy - but it works. If I've got this wrong, please correct me if there is a more appropriate way for us Admins to lock these things down. But if this is the only way, come on Microsoft, it's not on.
     
    Pete
  3. FragglePete
    I've just dealt with for the fifth time on various machines an issue with Outlook 2013 running on Windows 10. One of these times was on my own home machine but after dealing with my neighbours last night, I guess its worth putting up something about here so others can see if it's searched upon.
     
    These machines have been running Windows 10 and Outlook 2013 for sometime, all configured to send e-mail using IMAP connecting to a service like Gmail and everything works as expected then suddenly for no reason e-mails are received ok but when trying to send, messages get stuck in the Outbox and an error is generated. What is bizarre; is that on the Account Setup screen you can send and receive the Outlook test message but your messages stay stuck in the outbox.
     
    A bit of googling, came up with several suggestions, but the one that has fixed it on all occasions for me is the following:
     
    1. Open up an Administrative Command Prompt
    2. Type sfc /scannow and hit return. It may take a while for this process to complete
     
    Hopefully, all will be well after this. To quote Microsoft:
     

     
    My brother in law who had this issue noticed it after doing a round of Windows 10 updates - so something could be breaking essential systems files? The SFC command appears to put everything back in order.
     
    On another note, I've had an interesting issue with Gmail when I went to setup my daughters laptop some time ago. Again, trying to connect to Gmail via IMAP just refused to work, and the problem in this case was that an option within the Gmail preferences was switched OFF which is to allow unsecured applications access to email. Once switched to ON, Outlook 2013 could quite happily connect to the mailbox again happily. Would seem that Google don't trust Outlook 2013 as a secure enough client!
     
    Hope it helps someone!
     
    Pete
  4. FragglePete
    We moved over to Office365 and Office 2013 this summer and all has been good so far.
     
    One of our governors complained to me recently that important documents sent from the Head and the Bursar were not coming through but just an attachment entitled 'winmail.dat'. Further investigation lead to the fact that she uses an iPad for reading e-mails.
     
    Further investigation has led to this website: How to stop Office 365 sending those pesky winmail.dat attachments - Dear Geek - it would appear that Outlook and Office365 are using a format called TNEF (Transport Neutral Encapsulation Format) for attachments which is largely unsupported by various mail clients, Thunderbird and Mac Mail being one of them.
     
    Easy to sit and blame someone, but as the blog in the website says, better to try and sort it out and be the better person! There is a way of switching off TNEF in PowerShell on the Office365 tenant. Details are in the website.
     
    Pete
  5. FragglePete
    This Summer we're rolling out Office 2013 ready for September. We've been using a KMS server like most schools to activate Windows and Office 2010 - these generally have been without issues. With Office 2013 you have to first install the Microsoft Office 2013 Volume License Pack, and this has a nice GUI which has you entering your KMS key for Office 2013 and activating it for you. I did this sometime ago during the various months of testing I've done.
     
     
    Like Windows activations, KMS requires a unique CMID of Office. When you sysprep a PC, this CMID gets reset and a new one created during the installation phase and the same happens for Office 2010. This unique CMID will increase the KMS activation count until it hits the magical number that starts activating Office/Windows/etc. During my testing phase, Office 2013 was reporting it as not activated which I took as I hadn't hit that magical number where my KMS would start activating.
     
     
    During our deployment, it become obvious that after re-imaging of an entire suite of 26 PCs, the office installation was not activating. Much scratching of my head ensured, with myself scrutanising my KMS server closely but it keep telling my that Office 15 was Licensed with the activation count stuck at 2.
     
     
    After a lot of google searches and reading up, it would appear that Microsoft have once again changed the way things work without yelling about it too loudly. Office 2013 does not reset it's CMID automatically if you opened an office application before Sysprep. So, your nice clean image for the year now contains a CMID that won't change and will be the same for all machines that you've re-imaged.
     
     
    The solution I found here, Either ensure you rearm the office installation before you sysprep, or if you've already deployed it then you need to rearm each PC and force an activation. This solution started to increase my activation count and now happily my new for 2014 image is fully activating Office 2013. That is, if you include a copy of Office 2013 as part of you base image, installing it individually as an extra step after installation won't have this issue.
     
     
    I used the script to create a login script that I assigned to us technicians via GPO. It works quite well as it puts a tag in the registry so it ensures it only runs the once, thus ensuring your not over activating copies of Office.
     
     
    One problem solved, but still a few to resolve for the rest of the Summer work this year!
     
     
    Pete
  6. FragglePete
    There are plenty of discussions within this forum with regard to how machines are setup to allow scripting, coding ,etc. With the GCSE Computing and this drivel from the government regarding getting kids coding they obviously needs the tools to do this.
     
    In an ideal world, we give them the tools on the desktop for this, things like Python, Small Basic, Eclipse, etc, but we work in schools where for obvious reason, we keep things pretty much locked down. I'm sure many Network Managers have shuddered at the thought of giving Year 9's access to scripting tools. An example of this has happened here recently; we've given access to Python and some enterprising Year 11 wrote a script that causes the machine to shutdown. This was copied to a public folder, called it 'Minecraft' and a whole bunch of pupils saw this file and in typical honeypot fashion thinking this would help releave the bordom during class double clicked it and, well, you can guess what happens. I now hear you shouting; "Software Restriction GPO, stop them running it" - and yes, its something I've put into place.
  7. FragglePete
    Haven't blogged for a while, but like too when I get one of those 'I didn't realise that' moments.....
     
    We've got a number of Visually Impaired kids here at the school, who make use of the Magnifer built into Windows 7. I've got them in a seperate security group which switches on an extra folder in the Start Menu giving access to the Ease of Access tools. Always thought it worked well, select magnifier and a docked version of the application runs. However, I was informed today that it should be full screen magnification but this is greyed out as an option. It would appear that this option is only available when your using the Aero theme. Well, I didn't realise that!
     
    I, by default have all the student accounts set to to Windows 7 Basic theme within the main student lockdown GPO as I can't guarantee the graphic performance of all our machines. So, created an additional GPO with a higher link order and set the security to run for the Visually Impaired Group only which sets the Theme to Aero along with allowing them to change sizes of the Mouse Pointers, etc. Job done.
     
    Pete
  8. FragglePete

    VOIP'd up!

    By FragglePete,

    Monday was the big day for us this week; we've switched over on Friday afternoon to our new fully IP based system consisting of a Splicecom Maximiser 5100 Call Server supporting 118 phones. So far, so good with it all appearing to be working well and recieved well by all staff.
     
    It has however been a long time in planning; with support from the community on here as a whole I felt it only right to detail my experience over the last few months.
     
    I've been fortunate that a couple of years ago we had a refurb in the School which involved ripping out all the asbestos that has caused as problems with getting cabling installed. Seeing as the server room sat right under an area that needed to be cleared, and with the need to ensure that the network was fully functional during the phased closures in the School, I managed to get a new Server room organised along with a new fibre backbone as part of the enabling works. At the core of this sat a new HP ProCurve 5406zl switch with a variety of other HP ProCurve Edge switches (2626, 2510 & 2610) sitting in the 17 cabinets dotted around the site. We enjoyed a much quicker network, especially with WDS over the Summer.
     
    The phone system in the School was an ageing Toshiba Strata DK280 which was starting to get unreliable and didn't reach in to parts of the school were it was badly needed. As a temporary solution I played around with Elastix and got a basic six phone VOIP system in place after buying some cheap Grandstream SIP phones off ebay. This worked well, but SMT were soon asking if such a solution could be made site wide with the goal of 'a phone in every classroom'.
     
    I've had to take the time to finally get my head around VLANs, and again, Edugeek has been invaluable in helping understand this. Playing around with a spare ProCurve 2626 Edge and the Core the mist finally cleared regarding how to setup a VLAN. The next technical challenge was understanding QoS which is needed to ensure that any VOIP device has priority on the network over data ensuring no 'jitter' was present in any VOIP calls. I really took the easy route on this, and decided just to prioritise the VLAN used for voice and use port based VLAN allocation on the switches.
     
    In total, I spoke to seven companies about a possible solution and all in all was impressed with all that was seen. Only six actually bothered to give us a quote, and after running all the solutions presented to the Governors we selected Intech Telecom to provide a Splicecom based solution.
     
    With a date in mind for installation, the real hard work began in identifying all the ports in all the rooms around the School where we intended to place a phone. Just when you think you've tamed the beast that is your network that you've inherited, it becomes apparent how many broken ports you have, or not being able to identify where some ports run back too becomes an issue. Also, the grand scheme of keeping it simple by having a port for the PC and a port for the Phone soon goes out the window when you only have one port in some rooms which is already in use. No bother, as the phones have network ports on the back which a PC can plug into.... but this is when my mind started racing about how then do I setup the port on the switch for this? Is it untagged for phones, or untagged for data?? Further digging points to the fact that the port should be set to untagged for data and tagged for voice, with the phone itself setup to ensure Voice and Data go on the appropriate VLANs.
     
    Then the other realisation hits with regard to powering the phones. It would seem that most VOIP phones don't come with power supplies, and it's expected that you'll power your devices using Power Over Ethernet. At this point you need to start seeing how many phones will be going back to each location and working out when it would be more beneficial to get a new PoE switch instead of using Power Bricks. As a result, I've ended up ordering 10 new HP ProCurve Switches, 5 x 8 Ports and 5 x 24 ports (HP ProCurve 2520) - why they don't sell a 12 Port PoE in that range I just dont know!? You then need to think how these are connected. Thankfully, with the new backbone, we had plenty of spare fibre pairs going to most locations so where I could I can connect these new VOIP switches directly back to the Core using Fibre..... but of course, you need GBics to connect your fibres up which are of course more money. Costs of these Gbics are somewhat expensive, so I've taken a punt at some compatibles from a gbics.com. I can hear the collective sucking in of breath from here , but with HP units being £190 a piece and compatibles being £30, I thought at that price it was worth a try. I contacting gbics.com for various guarantees, and with them being quite local (Cirencester) and sounding very helpful, I brought 6 to use on three of the links on 3 of the new 24 Port PoE switches. And, they work. No bother. I see how they go over the coming months, but I'll be more than happy to get more in in the future to help centralise the VOIP traffic back to the Core quicker.
     
    So, switches in place, configuration done on each switch and ports identified, with the install date is looming and more discussions with the engineer from Intech informs me that to be able to use the Softphone feature on some of the more feature rich phones we're buying we need to be able to Multicast over the two VLANs. A feature, which is not available on the HP ProCurve switches unless you buy the very expensive piece of card with a very long activation number to switch this on at the Core Switch. That'll be another £1540 please ! Ordered, installed and configured.
     
    Intech I think at this point were picking up on my nerves at this point; have I got everything setup correctly, is this going to work, etc. So, they got in contact with a specialist network consultant who looked over all the details and what we've done so far and generally gave his thumbs up to what we put in place. Intech then sent the engineer in a day early with the Call Server and a few phones for us to try out the configuration and to ensure all was well, with the view of getting this consultant in on site if need be if we couldn't get it working. I'm pleased to say, all seemed well and the job of getting each phone configured and put out into desks began.
     
    The only hicup we came across really was the issue that was wondering about was how to configure the ports on sockets that had to have a phone with the PC piggy backed onto it. And this is where it got confusing..... We purchaed two types of phones primarily, the Splicecom IP530 which is essentially a basic IP phone with display and the PCS560 which has a much larger coloured display with programmable soft buttons. The setup for the IP530 required that the port be Untagged for Data, Tagged for Voice with the phone set to WAN on VLAN #50 (our voice vlan) and PC on VLAN #1 (for the data). However, the PCS560 required that the port on the switch be tagged for voice and for data, and again you needed to set the VLAN tags on the phone by telnetting to it beforehand. Somewhat confusing, and added another layer of complexity. Something which will be documented very clearly. It is my intention over the coming months (if not years), to get additional network ports put in areas where we don't have enough and keep the basic seperation of Voice Ports and Data Ports.
     
    The install also involved running additional Cat5e cables from the ISDN30e Termination Point down to the Server Room, along with a 20 core phone cable. This is so we could faciliate having a door entry system running over one of the analogue ports on the call server, along with having the two reception phones being wired directly into the Call Server also. This way, we could ensure that those two phones would still operate in the event of a power failure along with retaining some other analogue phones in certain areas where they may need to call 999 in an emergency if the switches near them lost power (eg. First Aid, Science Prep, etc).
     
    Benefits so far have been at last having an Auto Attendant, so a good proportion of phone calls can get directly to the correct department relieving some of the pressure off the receptionists. Staff are enjoying have Voice Mail, along with notification via e-mail of Voicemail. More phones around the School has the obvious safeguarding issues finally resolved, especially in our modular builds. Not missing important visitors during School Holidays as the new door entry will call a Holiday Group of phones and enable us to talk to the visitor and remotely open the door for them.
     
    Intech have been pretty good, the engineer on site has been very accomodating and certainly seems to know what he was doing. Keeping a constant supply of Coffee for him kept him on side when I started making awkward request,.... "It would be really cool if it did this....." ,etc ! ;-)
     
    The Vision reporting software is excellent, we now have a clear view of calls being made. We're also recording all external calls (inbound and outbound), and already this has proved useful when an irrate parent phone the School. The quality of the recordings was excellent. (We have of course put the appropriate disclaimer on our webiste!) My only gripe is that this software runs as a service on an Apple Mac only. A Linux version is currently being developed. I've borrowed the only Mac in the School from the ICT Dept, as they weren't really using it!!! ;-)
     
    All in all, so far so good. Still not totally done. I've just ordered some additional UPS' for various switch locations to ensure we have the phones running in the event of a power failure for a period, and I'm looking to utilise more of the fibre to get back to having all my switches directly connected to the Core.
     
    Lessons learned are; planning and documentation. I'll be spending a lot of time getting all the configs layed out and down on paper. Different coloured cables in your cabinets for everything; I'm currently using Red for Services (printers, servers), Blue for Voice, Green for WiFi, Grey for Data and Yellow for Voice/Data Mix. I still need some more cables, and I ordered too many blue! Have a contigency fund! Thankfully the savings from the Microsoft EES system this year have helped fund the extra bits I needed.
     
    It's time consuming; I'm knackered. A few long days getting everything ready but I think its been worth it. Hopefully I won't be posting on here in the near future that something is a miss on the network.
     
    Longest blog post ever!
     
    Pete
     
    Couple of photos below:

     

  9. FragglePete
    So, I've got all the VLAN in place ready for VOIP, just a few tweaks to be done to servers and stuff but nothing major. I'm still trying to nail down the exact QoS configuration but I've put that ball in the court of the supplier for now . I've got a 10 more Switches with PoE on order in places where we don't have the capacity.
     
    Further discussions with the supplier states that the system needs to be able to Multicast, and with the Softphone feature on the desktops PCs it looks like we need to be able to multicast across the VLANs! Something which you require a Premium Edge license on the Core Switch (a E5406zl) ! Doh! More money! Can't quite believe the cost of it though; cheapest quote I have is a approx £1500 for a license! Sheesh!
     
    Pete
  10. FragglePete

    VLAN a go, go !

    By FragglePete,

    I had one of those moments today; the mist cleared (only slightly) in sorting our network out with a VLAN ready for a VOIP implementation.
     
    The various posts here on Edugeek once again proved valuable, and I'm chuffed to bits that I've got it sorted to a certain point (have yet to tweak various Server gateway addresses).
     
    Next step later on down the line is to start segmenting the next work into logical parts but need a NAT box of somesort to do that correctly.
     
    Pete
  11. FragglePete
    One of my Summer tasks has been to get SIMS migrated from our ageing server onto a new Server. I've gone down the route of hosting it on a virtual machine based on a XenServer Host. First impressions are all good so far.
     
    In all the planning of this and arranging for Capita to do the migration, you suddenly realise how many other systems feed off your SIMS database and these too need either migration or re-configuring. These include simple things like the Frog SIMS Extractor right up to our Cashless Catering System. I guess its just amazes me just how many systems we have in place now that we need to ensure keep running. Documentation as always is going to be be the key.
     
    And on another note, I know it's been discussed and argued about SIMS relicense cost if converting to an Academy. But, we have just fallen foul of this and have just had to give £13k to Capita! For what? Doing nothing! Relicense a bit of software we already use. No other software company has made these demands of us. Shame on you Capita.
     
    We paid almost the same amount again in Solicitor fees doing the conversion who have worked tirelessly for us to ensure a smooth process and earnt every penny.
     
    Pete
  12. FragglePete

    Upset UPS

    By FragglePete,

    Had one of those days today that we all dread as technicians/network managers. Walk into the office this morning and pounced upon by various members of staff shouting "No one can log on!"
     
    Into the Server room and all the servers apart from one is switched on and running. The main DC which also houses the CSE Database is dead as a dodo.
     
    Initial indication would be a power failure, but no, all others UPS' are running and not reporting an issue. Power up the UPS and powered back up the server to start checking logs, etc to see what the hell has happened. Looking at the logs, the UPS PowerChute log is not showing a power outage, but showing a "Maximum Internal Temperature Exceeded" followed by initiating a shutdown. Thing is, the shutdown procedure runs a script that proceeds to power down the nine virtual servers running on two seperate XenServer hosts and then shuts down the Hosts themselves. Thing is, these two hosts were still running, but all hosts except one on each was shutdown. User Home drives, Print Server and other vital services are running on these Xens.
     
    Ok, need to get the show back on the road, so I reboot the Xen Servers and get the main DC up and running, but still no home drives. Would appear that our main Xen Server has had a right hissy fit and just refused to boot, just a blank screen on the console after all the initial loading and not responding to anything except a ping. After 10-15mins, I take the brave step of forcing a power down of this Xen and reboot and thankfully all appears to boot and everything is running again.
     
    I'm investigating the issue with the UPS at the mo, have a call open with APC to find out what went on but I've moved the main server onto another UPS for now as I don't trust it.
     
    As for the XenServer, bit concerned, but I might be partly to blame, as the script wasn't quite right. The script uses XenCentre command line to gracefully shutdown each VM one by one, then disable the XenServer and then power down the XenServer itself. A few months ago, I rebuilt one of the VM's and renamed it, but the script still had the old VM name! So it would appear that it suceeded in shutting down all but one of the VM's and then refused to shut the host down itself as it had a VM still running. Power went off as the UPS said enough was enough and this would appear upset the XenServer enough to cause it to hang on reboot. Thankfully it manage to sort itself out, but I was at this point reaching for the XenServer Configuration Backups I burnt to DVD a while back.
     
    The other XenServer also refused to switch off as it had a VM still running because this was an additional server I added to it but forgot to include in the shutdown script! Double
     
    Lesson learnt, scripts amended but it could have been a lot worse. Just hope I can sort out the UPS now. Everything back up and running by about 9:15am, so didn't disrupt the day too much.
     
    Pete
  13. FragglePete

    IT Coincidences

    By FragglePete,

    There I was, thought I'd have a go at implementing a VLAN on the Core switch yesterday. Just to prove the concept and make sure I've got it clear in my head what to do. I telnet into the Switch and start tweaking some settings, next thing I know connectivity to the Internet Stops.. What have I done? I look at the steps I took, and all seems well. I then revert all the settings back to their initial settings and still no Internet.
     
    Quick phone call to SWGfL and it would appear an outage has just happened! Why did this have to happen when I'm tweaking something major. Two hours later we were back on line.
     
    VLAN didn't work right anyway, obviously missing something so I need to look at things again but I've just lost all the will to live at the moment!
     
    Pete
  14. FragglePete
    I've been in my post now for just over three years; I'm loving the job but there is one thing I've noticed since I started here.....
     
    I seem to be suffering from higher than usual amount of colds, sniffles and other such horrible things. Normally, I wouldn't take more than a day off per year due to some sort of sickness, but since being here I feel like I'm taking more.
     
    I guess its working around all these little darlings that does it. But, I just seem to feel like crap at the moment and takes so long to get over things. Maybe I'm just getting old!
     
    Pete
  15. FragglePete
    We've come back this term with a whole load of machines complaining that Windows 7 is not genuine. How nice; after all the money we spend with Microsoft and the various backflips we have to do to get our KMS server working correctly we're being accused of running illegal software!
     
    It would turn out that during the Xmas break I created a new Prism Package which was the new SIMS Update installation. Rather than let SIMS update itself this time round (because it doesn't always work), I thought I'll let our software deployment system do it instead and all appeared well with that. It would appear that sucked up in this package was the Windows 7 Security Identification of the host machine I created the package on which obviously wrecked havoc with all the machines it was sent to. All the affected machines lost the Product ID key so we couldn't just force a new activation against our KMS server, instead we're having to install the generic volume licensing key using slmgr /ipk switch which then forces the activation on the KMS.
     
    Licensing - I love it really, more back flips and hoops to jump through and time wasted getting software running we legally own!
     
    Pete
  16. FragglePete
    We've had a XenServer running since last year, and have been impressed so much that we introduced another one this year and both hosts have some eight Windows based servers sitting on them.
     
    I've got a small Linux server running on an old workstation that hosts the Xibo Signage System and also looks after LimeSurveys as well running on Ubuntu. My plan was to move this to another VM on the newer host as it has more than enough capacity.
     
    It would seem that only certain distros of Linux are supported on XenServer, primarily those being paid for enterprise flavours. CentOS is as well, but I've struggled with CentOS a bit recently setting up Asterisk and always like tinkering with Ubuntu. Needless to say I've had a bit of a mare getting something working on this host, but today I finally cracked it. I've got an optimized Ubuntu 10.04LTS 64Bit Virtual Machine up and running at last.
     
    Found this article which helped me get Ubuntu installed over the internet on the Host. However, not much help if your behind a proxy as the Host can't get through to download the files, but after some digging found this which details how to add your proxy details to the host machine so it'll access the internet!
     
    Hope it helps somebody else.
     
    Pete
  17. FragglePete
    Teacher preparing for OCR Level 1 ICT Functional Skills, and this particular guidance note took my interest:
     

     
    So, blocking Internet - no problem, Impero will do that for us. But how are they expected to access my Exchange 2007 Box with Outlook but not recieve/send e-mails??
     
    Pete
  18. FragglePete

    Graham Alexander Who?

    By FragglePete,

    Been tasked with looking into implementing an internal VOIP phone system to link up some buildings that don't have phone lines installed.
     
    Have been looking at things like 3CX and AsteriskNow (with Freepbx).
     
    Have to say that I really do like the look of 3CX; windows based, really easy to setup and configure but its going to cost if we want to have more than 4 people talking at one. Also been told there is no money.
     
    So, looking at AsteriskNOW, and its stretching my Linux knowledge abit but I'm getting there and quite pleased that I've got a basic system up and running.
     
    Today I took delivery of two Grandstream GXP-1200 IP Phones that I got cheap of eBay and got them configured to work. Again, it's all very basic at the moment but I'm taking great joy in wandering around the school, plugging in the phone and calling my tech back in the office; People are looking at me as if I'm bonkers because at the end of the day to them its just a 'phone', but only use techs can get excited about how it works rather than it just 'working'.
     
    Pete
  19. FragglePete
    We're in our third year of Electronic Registration, and we looked into Registration during assemblies using EEE-PCs. The excellent Asus EEE-PCs 701 4G were the netbook of choice back then. Using the wonders of nLite we created the well documented slim installation of XP so teachers could use SIMS and register their classes during assemblies (and in other locations).
     
    All has been well until recently, I never like XP running on these devices; it never seem to have any slick-ness which is not surprising when you consider they only have 512Mb of RAM and an aging Celeron Processor. They've been slowing up and issues with the WiFi not connecting correctly so it was time for a re-think. I know for the money that we paid for these back then you can get some really decent Atom based netbooks that would be more than capable but no funds available to replace at this time.
     
    Last term we got up and running RemoteApps on Server 2008R2 for staff to be able to do their report writing at home, and has been useful for the Cover Supervisor to be able to access SIMS remotely at home to arrange Cover while eating her cornflakes as staff are phoning in ill for whatever reason. This got me thinking; why not use RemoteApps on these devices to access SIMS for electronic registration?
     
    I'm pleased to report that with the most recent version of rdesktop (rdesktop: A Remote Desktop Protocol client) now does support connecting to RemoteApps on a server running Remote Desktop Services (as its now called). I've now got these devices running SIMS via RemoteApps using their supplied Xandros OS. These are the steps taken:
     
    Re-Imaged the EEE-PC with supplied Support DVDs back to factory defaults.
     
    Accessed the Terminal and used the tips in the most excellent edugeek wiki (EeePC - Linux OS - Wiki) to allow apt to update through our proxy and allow all the updates to be installed.
     
    Used
    sudo kwrite /opt/xandros/share/AsusLauncher/simpleui.rc
     
     
    and added the following code the just before the end:
     

    <parcel simplecat="Work" extraargs="/usr/bin/rdesktop -4 -f SERVER -s 'c:\Program Files (x86)\SIMS\sims .net\pulsar.exe' -u USER@DOMAIN -p PASSWORD -a 16 -k en-gb" icon="iptv_norm.png" selected_icon="iptv_hi.png" > <name lang="en">SIMS</name> </parcel>
     
    Obviously you need to change the SERVER, USER@DOMAIN and PASSWORD elements that suit your setup. SIMS is sitting on a 64Bit Server hence the 'Program Files (x86)' bit. The above puts an extra icon in the Work tab of the EEE-PC Simple Menu system.
     
    The -4 switch is setting the RDP version to v4, -a switch is setting the display to 16bit, -s is setting the Shell, which in this case is to run pulsar.exe which is SIMS, the -u, -p, -s are self explanatory and the -k switch is just ensuring the keyboard map is set to English UK on the session.
     
    The user that is used to login is restricted on access and is set so it can't be used outside via the TS Gateway.
     
    My only real gripe is that it takes the Wireless about 15 - 20 seconds to latch onto the Wireless Signal, which could lead to some impatient teachers stabbing away at the icon repeatly but I think its an acceptable wait time. I'll start releasing these for tomorrows assemblies and see what happens.
     
    Pete
  20. FragglePete
    We've had fun with the SIMS Server over the past couple of weeks. It's been perfectly happy until a Hard Drive failure occured a couple of weeks ago. Not a problem, RAID5 in play so got in touch with HP and a new Hard Drive was dispatched next day, installed and all was well.
     
    Unfortunately not, somehow a couple of directories had become corrupted which we can only assumed happened when this hard drive failed. Still, managed to recover them with no issues but couldn't delete these folders with the system complaining that chkdsk was required but of course this has to be done offline. So, arrange a day where we stay a bit late to take the server down and do the chkdsk operation.
     
    A couple of days later before our planned downtime, we notice that the new hard drive in the RAID was now flashing orange indicating a immenient failure! So, a newly supplied hard drive is about to fail! Well, it happens, new equipment does sometimes fail or DOA. Phone up HP again and this time provide various diagnostic reports from the Server which results in another hard drive being dispatched. The HP Agent though does request that we update the firmware on the raid controller, other hard drivers, etc to ensure that this 2nd failure has not been caused by out of date firmware/drivers, etc. Points us to a downloadable DVD ISO which contains all the driver and firmware updates for our server, a HP ML350 G5. Nice; I like it.
     
    So, our planned day arrives, we stay late and staff go home. Our 2nd New hard drive has already been installed and confirmed that it has finished rebuilding. We run chkdsk and this clears the errors on the drive so we can finally clear things up. We run the HP Update DVD and this goes off and updates all the firmware during a reboot (we hold our breath), and all seems well. We go home happy.
     
    Monday morning on my way into work, I recieve an e-mail from the Insight Management Service on the SIMS Server that a ASR Reboot Completed at 07:20am - WTF? Get in, look at the Event Logs - no errors, just the event showing an expected reboot had occurred. No DUMP file present either, so no indication of a Blue Screen. Head scratching now occurs. Give it the benefit of the doubt, other work gets in the way - problem occurs again at 01:10 the next morning. Again, no errors in event log leading up to the time it rebooted.
     
    Some digging around I find this:
    HP ProLiant ML350 G5 Storage Server*-* Advisory: (Revision) Integrated Lights-Out 2 (iLO 2) And iLO 2 Management Controller Driver - FIRMWARE/ DRIVER UPGRADE REQUIRED: ProLiant Server May Unexpectedly Reboot And Display Event ID 57 Error Messages - c
     
    It would appear that certain combination of Drivers and Firmware are causing the iLO Management Module to randomly reboot the server for no reason! Using the HP Update DVD that I used installed a later version of the iLO firmware but I didn't update the drivers thus causing this issue.
     
    Updated both Firmware to 2.01 and the latest Drivers and so far so good; fingers crossed no reboots yet but will wait until at least a week without a reboot before I'm happy this has fixed the solution.
     
    Keeps us on our toes I suppose!
     
    Pete
  21. FragglePete
    Today was something different; our recent refurbishment and asbestos removal program thats been running for nearly 18 months is finally coming to an end. The last phase being the main hall. Being a Performing Arts College we've had a new acoustic ceiling installed with a new lighting rig put in place, new sound system along with a new projector which has multiple input points around the hall.
     
    This new rig is some 7 metres up, which obviously will require the stage technician to climb a free standing tower on occasions to adjust and maintain the lights along with our us getting access to the projector at least once a year to clean out, etc.
     
    To do this legally, you need a pasma certification which enables you to climb an Alluminium Freestanding Tower. Your breaking all sorts of H&S laws if you even attempt to climb such a tower without this certification! Today the building project manager organised with the School such a course which involved a short theory test along with a practical assessment of building/dismantling a tower which is at least 4.2m tall. We all passed, so another certification to add and now the school has 4 pasma trained and certified staff. (You legally need two people to build such a tower).
     
    Very useful, interesting, informative and quite enjoyable day in all.
     
    Staff back tomorrow though, so back to the normal routine.
     
    Pete
  22. FragglePete
    Today we did a real world test on our Windows 7 system.
     
    We've built a ICT Suite that is due to come on-line this September and invited 5 students to come in and try it out. I moved their accounts temporarily into the OUs we have setup for Windows 7 and moved them to the appropriate Security Groups and got them to log in. Sophos was installed and running, along with Impero V3.0.38 and we're still using CSE but not using their Workspace, purely using the CSE System to build and administer the start menus, application and printer deployment.
     
    I asked them to do a number of tasks, like trying out some of the new features of windows 7 accessories (Sniping Tool, etc), have a go at the new Office 2010 System. Create files, save, re-open, etc, etc with the Head of ICT watching over as well. Now I'm pleased to say that it went very well and got generally positive feedback from the Students, only a couple of minor issues to resolve with a program install, but generally all good. One complained that Aero wasn't running, but I explained we've disabled that by default anyway due to the age of certain machines and also to help Impero run correctly.
     
    What is worth noting, that these machines we did this test on weren't nice shiney new ones, but quite old Dell Optiplex 210L Desktops with 2Gb of RAM, P4 2.8Ghz Processors. No fancy graphics card and they ran extremely well.
     
    I've even installed Win7 on a number of 'Admin' machines that run in seperate OUs with Loop Back as these don't have the CSE system installed. Again, feedback from the Staff has been really positive.
     
    So, we've now got a green light to deploy.
     
    Is been a tough few months; we started this journey back in February fine tuning the end users experience, working out the deployment system and then ensuring that all the software we have is still use and what is can then be installed or upgraded to ensure it works under Win7. My team have done an excellent job in getting this working, and external companies like Impero and CSE have been quite responsive in assisting with the issues that we've encountered.
     
    I can only hope and pray that it all goes well over the Summer and won't go all belly up in September.
     
    Fingers crossed!
     
    Pete
  23. FragglePete
    Following on from a blog way back: http://www.edugeek.net/blogs/fragglepete/129-licensing-why-do-i-have-jump-through-hoops.html
     
    I've finally got round to getting the KMS Server setup ready for when we start our Windows Deployment in a few weeks. It's a bit odd that you can setup a KMS on a Windows 2003 Server and a Windows 2008R2 server but not a Windows 2008 Server! Not if you want to activate Windows 7 Clients!!! My domain consists of a number of 2008 Servers and a 2003 SP2 Domain Controller. So for me, for now, it had to be the 2003 Server.
     
    Not just a simple case of installing it and away you go, but you have to update it to version 1.2 so you can use 2008 R2 KMS Keys which you need for Windows 7. What you also have to do is make sure you restart your server after doing the update to 1.2! Can't restart a server during School Hours, let alone the DC! And yes, you really do! I thought "Nah, don't be silly, shouldn't need to restart a server surely???!" Oh yes you do.....!
     
    Pass the bucket of fish while I do yet another triple back sumersault with half pike through a Microsoft hoop!
     
    Pete
  24. FragglePete
    Had a hard drive failure on what is known as our Recovery Manager Server yesterday. This is a box which sits seperately from our main server room. The main file server has an agent installed which monitors various shares; every time a user hits save, a copy is written to the Recovery Manager Server. Users are then able to recover up to 10 previous versions of any file and folder held in their home area. Its a sort of an extension of Volume Shadow Copying and saves a lot of time and effort as we very rarely have to recover anything from tape and provides instant backups of files.
     
    The software comes part of our CSE System, but is actually written by a company called Flux2Fusion (http://www.flux2fusion.com/) and proves itself over and over again. Teachers love it as even if a little darling has deleted their file, they can usually get back the last saved version almost instantly.
     
    Now, the recovery manager server itself had a hard drive failure yesterday which resulted in the Software not working which I thought was odd as it has two hard drives installed and should be at least running RAID1. However, whoever set it up set the System Partition as RAID 1 but the Data partition as a spanned volume (ie. RAID0). So, all our previous versions have gone! I should have noticed it before hand, but because of the age of this machine I had ear marked it to be replaced this year anyway but because of budget squeezes the powers that be are not letting me.
     
    Quick dash off to PC World to get a couple of new 1TB hard drives, broke the mirror installed new hard drive, created new mirror, broke mirror again and installed 2nd new hard drive the system is now up and running and
    currently generating a mirror of the data partition.
     
    Could have been a heat related failure, as this server does sit in a small room which has no air con and both drives did seem very hot although the room itself did not feel that hot at the time.
     
    Pete
  25. FragglePete
    Our Windows 7 Testing is continuing. Testing is going well and so far so good. A few little issues to be resolved by third party software suppliers which I'm hoping will be fixed soon.
     
    Had an issue with a new Dell Optiplex 380 that wasn't playing nice with WDS, but Fatmas seems to have fixed that now.
     
    Office 2010 has been released to Volume customers, so I'd thought I'll take a look and see wether or not including Office 2010 in our Windows 7 deployment would be an upgrade too far. Head of ICT seems keen to include it, but I need to make sure.
     
    So downloaded, had a quick play with the Office Customisation Toolkit and created a .MSP file and all files are at a network share to install from. Then took a freshly installed Windows 7 machine to install Office 2010 to.
     
    First impressions...... "oh.... how dull !" One teacher mentioned it looks like Windows 3.11! And, I agree with them.
     
    Gone back into the OCT and removed the Outlook Add-Ins straight away!
     
    Just downloaded the .ADMX files and copied to the central store and time to have a play. With a hope of 'sprucing' things up a bit.
     
    Will report back.
     
    Pete
×
×
  • Create New...