ADMaster

I noticed a few weeks ago as administrator I had access denied to the entire E: and F: drives of my file server, but I could access the shares. I looked at the security tab and the servername\administrators had full control. Today I'm working on a new file server and using the copyall flag in robocopy as the majority of the files are home directories. From the file server I cannot access any of the files including my admin install share. However if I access it from another computer via the share path I have full access. Again the acl shows \\newservername\administrators with full control and the share permissions are everyone full. I have verified domain admins is in the local administrators group. Did something with permission behavior change I'm not aware of? The old server is 2016 the new is 2019.

I have tried adding static IPs to the dial in tab of the AD profile, this appears to work for a user, but not a computer. The majority of my VPN clients use the machine certificate to authenticate. If I can get the static IP per machine to work I think I can write a PS script to assign IPs. Ideas?

Hello all, I've searched but the info isn't out there or I don't know what terms to search for. I setup a RAS server for always on VPN, it is working. I use PDQ and have followed their guides on flushing DNS, but that doesn't seam to be enough. I only have it deployed to a handful of users so far, so DHCP is still on the first block of 10. However RAS doesn't seam to have any reason for how it assigns IPs and if I disconnect and reconnect I'll get a new IP. I discovered an issue in my profile XML today so needed to redeploy it. You cannot update an active VPN connection so I disconnected the VPN made the changes and connected again. However PDQ never reported success as it got stuck at reconnecting because of the new IP. In this case the laptop was at home with me so I know it was successful, but I need to update these already deployed clients. Ideally I'd like to set some sort of lease time on the VPN clients so they keep the same IP for several days across multiple connects / disconnects. Is this possible? Thanks,

I’m not having any luck with this office 2019 stuff. I created a config file with SCCM, but it failed to download the app. I created a config with the online OCT and I think it downloads, I’ve not found a way to verify. The folder is 1.91 GB. I watched the PDQ video on deploying 2019 as well. Deploying with PDQ it returns code 17003, the logs show this; 06/11/2020 09:26:14.283 SETUP (0x19e8) 0x1700 Nexus Transport 92tyn Monitorable MsoGetRemoteHostNetworkStatusWithUrlType failed {"RemoteHost": "https://nexus.officeapps.live.com"} And this "Failed to get AuthHandler from IRequestSettings" I’m not seeing anything blocked in the filter and I can access that url from a browser. I changed the xml display mode to full and am running it again. However it appears to have hung. Its been running for 30 minutes and the tool tip shows 3%. However the log shows the last entry was within a minute ago. I tried leaving the path blank in the xml and running the download and configure steps locally. I’ve also put in share and log paths. My cachebox shows I’ve pulled 2.16 GB from officecdn.microsoft.com:80 today and 11.5 GB for the week. Also another 3.5 GB from officecdn.microsoft.com.edgesuite.net:80 Any ideas.

Thanks the resolution was a bit off over rdp and I had to scroll to find it. However device based license is still grayed, the only option I have is to use user licensing. Is there something different I need to select in the wizard for those to become available?

I am moving us to Office 2019 this summer as the local college we partner with is updating their curriculum to 2019. I recall when it was first released several threads on what a PITA it is to deploy and a complete changes of how it has worked in the past. I’m looking to avoid most of those by learning from you that have gone before me. I think the two questions I have after reading documentation and threads are; Use the CDN or some other update method? How do I license / Activate? I have an o365 subscription but don’t think I have many licenses assigned. It was forced on us with the license renew so I just use a few Azure / Intune features. Our email and most productivity is done in GSuite. I have SCCM updated to the latest version 2002 and I also use PDQ. My normal update / image process is to install the base image and tweaks with SCCM, then call PDQ for the application set. I looked through the online config tool, however when I got to the license setting it had shared and device license grayed out. I’ve seen threads on here that said set device license to 1 in the xml,I’ll want to use AD Activation. The MS article deploy office 2019 for IT Pros says I can use a configuration wizard in the office 365 section to deploy 2019. The articles says 1710 is the minimum and 1806 is required. Am I overlooking the obvious, I have a 365 management section, but not install and I’m not finding anything in the management that will allow me to install it. How do I handle updates or keep the install source updated. Back on office 2013/2016 I had a script that pulled the updates into a folder then when the installer was run, it installed all those updates at the same time. Can I just run the setup /download configxml to update the local install folder before a reimage project? If I deploy from a folder, can SCCM handle the updates or should I go back to the CDN for updates? I have a cachebox, so bandwidth shouldn’t be an issue, but I’m sure local would be faster when imaging a lab Thank you

Did you ever solve this. I'm reading old threads before I post my own. I'll be deploying 2019 this summer and want to avoid these issues.

We are still waiting on official advice from the gov and dfe as to what next fall will look like. I’m making plans to get better remote support in place and the three scenarios we have are Back to normal, unlikely Fully remote / online Some sort of rotational blended model where some students come on onsite M W and online T TH and the reverse for other groups. I just glad I’m not in charge of scheduling.

My apologies I forgot this was in general. I like to look at things from all sides of an issue. I’ve avoided the pond for 8 years I guess it was my turn.

I use DPM for regular backups, but I've also had success with powershell. If you need a quick one off backup look into the export-vm cmdlet. I basically loop though the VMs I want to backup, export them and zip them with a date. Which reminds me it has been a while since I've pulled these out of band backups.

I just ordered some Dell storage spaces direct ready nodes. They are supposed to come all setup out of the box for hyper converged. What I understood from my rep is a SAN would add a single point of failure and the storage spaces would spread the san across all the nodes as others explained here. I still don't fully grasp and worry what happens if I need to rebuild a node, but I'll have a better idea in the next few weeks. I'm assuming I can bring down a node for maintenance / rebuild / upgrade and everything will fail over to the other nodes. My plan is to join the new nodes to the existing cluster, then migrate the vms over. Should be no downtime that way.

I was able to get in with the 6GB setting. There is a lot of weird stuff in this pack. One thing that is really throwing me off though is the time. The clock above the map is so wrong, its dark by 11AM. I've not played long enough to figure out the pattern / full day night cycle. I just know days seam really short and nights long.

I forgot to mention I've read the entire privacy policy and separate K-12 privacy policy. I have some sort of licensed / education version through clever. Its free for a few months. As I understand it my account lifts the time limit and participant count on basic accounts associated to me. I also get one licence for more pro features. Clever / Zoom setup

I’m a bit late to the party here, but I’ve been debunking all the negativity about zoom for two weeks now. Several LEAs have evaluated it and recommend it. Clever is offering / recommending it as a video conference solution. These are the ways I learned about it and trust in the recommendations of the two entities. The zoom bombing is all preventable with a few settings that zoom as now rolled out by default. The webcam hack was fixed in July, but brought up as a new issue in March The UNC path issue was fixed very quickly and what teacher would click on links from students anyway. I’ve issued advice on staying as compliant as possible such as no recording the meetings, and students should join with first name only and students should not have their own accounts. We are a Google school, although I do have some Azure setup. Teams isn’t an option, we didn’t want to introduce too many new platforms in this situation. The teachers and students should use the platforms we have been using all school year. I evaluated both zoom and Google Meet. I have the clever integrated version of zoom which gives me a school account to change settings, see usage reports, diagnostics etc, akin to the meet quality tool. Zoom allows the teacher to manage participants mute them, kick them out, not allow them to share their screen and not allow students to join the meeting without the teacher. Simply put zoom has a lot more controls for the teachers. Google Meet allows students to join at any time, get into the meeting to hang out before or after the teacher, anyone to share their screen and doesn’t allow the teacher to mute students. Also I’d have to turn on hangouts to make it work, which opens up more chat options that we don’t want younger students having. Google has announced some changes with nicknamed meetings and Google classroom integration is coming. However we are all using zoom now. I have a few admin staff using meet for their meetings, but you don’t need the control to mute a lot of kid’s vs a few adults. The whiteboard is great in zoom too. We have teachers recording lessons and uploading them. I made the suggestion they could create a zoom meeting with just them to record if they found that easier than other screen recording tools. Just don’t record with students present. My remaining complaint with zoom is students able to create accounts even though their policy says no under 16s. However you’ll have that with any service. Overall configured properly zoom is a great tool.

I bought my PC with 16GB years ago, but a stick died and I've been running on 8GB total since. I've also been running low on disk space, so I ordered a mew SSD and fresh 16GB so they are paired. It should be here Tuesday.

I think I'll have to buy more RAM.

I don't have a VPN setup myself for most staff. The only VPN we have is via the LEA with only select admin staff such as myself having access. I'd be setting up RAS for all staff. They are azure hybrid joined, but not in intune. So it looks like there will be a lot of manual effort if I want to manage them now. What would be the best way forward for future remote management?

Hello all, I’m researching the best way forward with managing remote clients. I was able to push the free logmein central to most users before we got sent home, but there is no way I could afford it normally. I also find their application updates / management clunky. I think the biggest hurtle right now is any changes I make to support ICBM, the clients won’t pick up until they are back on site. A lot of my computers are hybrid azure joined, can I manage them with Intune without bringing them onsite? I’m a bit worried about setting up an always on VPN, doesn’t that greatly increase the attack surface of my network? Thanks

Cool thing of the week. I got remote support software deployed just before staff got sent home earlier in the week. Then I setup a phone number for parents and students to call their teachers at home during school hours without teachers giving out their personal details. If the teacher doesn’t want calls, they can still call in and check their school voice mail. We have been providing online lessons most of the week. I worked from home today and was able to remote into staff PCs for support who were also at home. Very cool.

I just learned about loom today. They are offering Loom Pro free to teachers and students. https://www.loom.com/pricing https://support.loom.com/hc/en-us/articles/360006579637-Loom-Pro-Free-for-Students-and-Teachers I've not used it so can't compare. I emailed screencastify about the 5 minute limit and this is what they said Zoom is also an option though it is more of a comparison to hangout meet than screencastify. I prefer zoom over hangouts meet as there is more control and features also the room isn't left open. I've signed our school up and am promoting it. If you sign up through clever you can get the 40 minute time limit lifted. Its not quite like screencastify, but I suggested to a teacher to start a meeting alone, share the screen / slide show and narrate. It might work similar. I'll hopefully have feedback on that soon.

Several companies are offering free resources / extended free trials. This site has made the rounds at our school, I don't know how much is US / UK / specific or general. http://www.amazingeducationalresources.com/

Same here, governor closed schools here for 3 weeks as well. I think it is left up to each school if staff is coming in or not. I know a school a few counties away will have no staff. I heard rumors another is shut until next fall. We are asking staff to report and provide online lessons. I configured google meet / zoom and have been reading up on teams. However we are a google school so I don't think I'll introduce teams. For the same reason I don't think I'll setup the free webex for general classroom, but may want it for remote support. We want to unify on a few platforms as not to add to the stress of the situation. Any free remote support tools that allow sharing control? There has been a google doc shared around by teachers listing resources. Many companies are offering extended free trials or upgrades for existing customers to help everyone through this situation. Our SLT have discouraged this on grounds this isn't the time to introduce a new system, use what the students are familiar with. On one hand thanks for offering all of the support, but the cynical side says you plan on having new customers next school year. We are going to accept the upgrades to existing licenses though, such as Adobe at home for students and getting more teachers on board with our various online platforms.

Yes I have, and while doing some more checks I found KB4520004 is getting pushed via SCCM, while KB4520006 is being pushed by PDQ. I searched the SCCM console and cannot find KB4520006.

I’m using a combination of SCCM and PDQ to manage updates. I download and schedule the SCCM updates as normal, but if there is a need / day out / working late etc, I go ahead a push updates with PDQ to get them done. With all the issues for August and September updates I was behind. I was able to push the October CU to a few hundred machines with PDQ before SCCM had then all downloaded to the package. Anyway I’m only showing 25-30 computers as being compliant with the latest updates. PDQ shows the opposite, only 10 online computers do not have the October CU. The PDQ hotfixes tab shows KB4520006 as installed for one of my machines, 2019-10 CU for 1709. SCCM client center does not show it listed at all and shows I am in need of the 2019-02 CU SCCM client center does show the 2019-10 SSU though. I’ve forced a run of the updates evaluation cycle and it still does not report as compliant. The only two things jumping out at me in the logs are OnSearchComplete - Failed to end search job. Error = 0x8024402c. WUAHandler 11/12/2019 8:59:09 AM 4072 (0x0FE8) Scan failed with error = 0x8024402c. WUAHandler 11/12/2019 8:59:09 AM 4072 (0x0FE8) followed by a successful scan later in the log and these, it looks like it might be trying to do something. Waiting for third-party orchestrator to initiate installation. UpdatesDeploymentAgent 11/12/2019 10:34:43 AM 6336 (0x18C0) Operation (TriggerEnforce) already in progress. No need to activate. UpdatesDeploymentAgent 11/12/2019 11:06:52 AM 5708 (0x164C) This is just on one random machine not reporting, I'll have to check if all the others have the same log events. Ideas on getting the reporting correct?

I’ve finally been able to reproduce and fix the issue on a test machine. The short answer is the temp folder was missing from the user’s profile. Creating the folder solved the issue, deleting the folder brought the issue back. I moved a test user into the same OU and put it in all the same securely groups, I was able to reproduce the issue on the user’s machine and a VM. I then moved the test user to a new OU and started applying GPOS one at a time until failure. I have a scripts GPO where one is to clean up the temp files. The GPO hasn’t been modified since 2016 and this particular script since 2014. At the start of the school year, I had issues with student computers and their temp directories. One app would not open if it was missing. I wrote a script to act as an app launcher, check for temp folder, if not exist create it then launch the app. I wasn’t sure why their temp folders with missing, but just fixed it. My script was deleting the temp folder on logoff. Windows would create the temp folder at logon for 1709 and previous, 1809 does not. I’ve added a create temp dir line to the script so hopefully this is properly fixed now.