ADMaster

This sounds like a job for Powershell and a scheduled task.

Experiment with the direction of your slashes. In my java path I had to use forward slashes (/) which is opposite of your normal windows path. Also if you point the file to the netlogon what happens to the java settings if it is a laptop off site. I would set the file to a local path and copy the updated file with GPP or script. I cannot give a good example of an exceptions list because it will be different for everyone. I just added a couple sites to mine today. It is a text file with a web address on each line. In my case the first one in the list is our gradebook. Hope this helps

Do you plan to buy new hardware to virtualize on? I cannot recommend virtualization enough. I migrated my virtualization environment from VMware to Hyper-v this last summer. I have a cluster setup with shared storage so any role server can fail over to the other host. Snapshots are nice for a quick backup if you are testing software. If you plan on buying new hardware give your self room to grow and handle the load of everything you have now. If you’re not ready to jump in with both feet convert one of your underutilized servers to start virtualizing a few things I think there are environments now that are fully virtualized, but they used to recommend keeping at least one DC physical, and I still follow that advice. My advice, yes start going virtual, it is more efficient, cost effective and very easy to spin up a new machine for testing.

My guess would be your computer doesn’t trust the signing cert. However I didn’t create a deployment rule set, I avoided all that by creating exception.sites list. Add the path to your exception list in the deployment properties, copy it out with the same method. In my case I use SCCM, but GPP or startup script works too. See my post in the other java thread for examples of my config file. http://www.edugeek.net/forums/downloads/130138-java-runtime-environment-7-update-51-released-36-vulnerabilities-fixed.html#post1112785

I’ve also seen them ask for password resets when they get one of the other error messages. A cannot contact / connect to the domain B trust relationship C your password must be changed. A and B are issues that need addressed however it doesn’t mean your password is not working. C is the one that gets me the most, they just don’t read what the message is telling them.

Hi all, I’m trying to add a custom power plan to not require a password after the computer wakes up. This is Windows 8.1 for young students. All of the settings of my custom plan get applied to the computer except the password setting. I came across one technet post that said it only worked if it was a computer policy and not user. I have the policy in in the computer settings. Any suggestions? Thank you,

I second @plexer I don't think setting a password policy anywhere but the default domain policy has any effect. You'll need to setup a fine grained password policy. Once it is setup, it's not difficult to manage. I don't assign it to an OU but a security group. Add all the younger years to a group and assign a weak password policy, all the staff probably have a group already, assign a stronger password to them. Thanks,

Also from the distribution page you can get the 11.06 update msp. About 20MB vs 200+MB I've not checked add / remove programs but opening adobe > Help > about shows 11.06

I will look into the RDP vlan idea. I’m trying to figure out how much risk there is and how much isolation I really need. My first thought was to remove the network adapter from the VM completely and that is one reason for looking at hyper-v console, If I go with the console route I’ll offer the student to install the OS and everything, that cannot be done over RDP or VNC. On second thought he may need internet access from the VM to download code samples. If there are any other idea’s I’m all ears. Thank you,

Hello all, I currently have .exe blocked by gpo for students, however a student is interested in programing and will need to run .exes. Instead of making exceptions to the rule I’d like to give him a VM off the domain where policies don’t apply. The machine he will be working from only has 1.5GB of ram, so I don’t think it is beefy enough to have a local VM like virtual box. I have a Hyper-v 2012 environment in place with enough resources available to create a VM for him. I’d like to grant him console access to one VM from the windows 7 workstation without him being able to access my server infrastructure, and his VM be isolated from the rest of the network. I have VVM 2012 R2 installed and have read a bit about creating a private self-service cloud but that seems a bit overkill. Am I asking too much or is there a simple way to delegate access to a single VM? Thank you,

There is a system properties file and a user properties file. That is the default location for the user level properties. To use the system level properties you need to create a deployment.config file and place it in c:\windows\sun\java\deployment It should look like this deployment.system.config=file\:C\:/WINDOWS/Sun/Java/Deployment/deployment.properties deployment.system.config.mandatory=true Then create your deployment.Properties file in the same directory Here is a snip from my deployment.properties the first one specifies that the exception.sites should be in this same directory. deployment.user.security.exception.sites=C\:/WINDOWS/Sun/Java/Deployment/exception.sites deployment.browser.vm.iexplorer.locked deployment.browser.vm.iexplorer=true deployment.browser.vm.mozilla.locked deployment.browser.vm.mozilla=true deployment.expiration.check.enabled=false deployment.security.level=HIGH I don’t know what deployment method you use but here is the batch I use to create the directory and copy the files. mkdir %SystemRoot%\Sun\Java\Deployment copy deployment.config %SystemRoot%\Sun\Java\Deployment\ /Y copy deployment.properties %SystemRoot%\Sun\Java\Deployment\ /Y copy exception.sites %SystemRoot%\Sun\Java\Deployment\ /Y Hope this helps

Hi Kenny, I considered using GPP for this to copy the file at log on, or a log on script. However you can modify the deployment properties file to tell java where your exception.sites are. See my post #6 above for the line I used. This will allow you to set the file once for the machine which works nicer with SCCM, you can also use GPP or script at the machine level. Cheers

OK Folks, I think I have it figured out. I had to drop the file from my path, and add it to the deployment properties not deployment config deployment.user.security.exception.sites=C\:/WINDOWS/Sun/Java/Deployment/exception.sites Now create a plain text file named exception.sites and add one url per line according to oracle blog linked above. A plain text file has to be better to manage than resigning a jar every time I need to add a site to the list. This solution requires a bit more testing. It was successful on a windows 7 x86 machine. I hope this helps someone else with their java update.

I'm looking at setting up the exceptions list to white list the unsigned applets. https://blogs.oracle.com/java-platform-group/entry/upcoming_exception_site_list_in However this appears to be a user setting only. I've tried adding a line to my deployment config to specify a system path here is my deployment config deployment.system.config=file\:C\:/WINDOWS/Sun/Java/Deployment/deployment.properties deployment.user.security.exception.sites=file\:C\:/WINDOWS/Sun/Java/Deployment/exception.sites deployment.system.config.mandatory=true If the best way to white listing these apps at the system level is a deployment rule set, please point me to a good example. Also it wouldn't be too difficult to copy the exceptions.sites file to each user at logon if that would be the best way to manage it. Thanks for your input.

Sure, computer policy > admin temps > windows components > windows update.

Glad you got it sorted.

Thanks, not what I wanted to hear. I had the impression you were deploying them without the password. I have Meraki and I have a vpp account. I have been deploying paid apps via Apple configurator. However some classrooms do not have a syncing cart, and it would be much nicer to deploy apps over the air. I thought that is what IOS 7 was introducing. I have read a bit on the IOS 7 managed distribution, but the way I read it you assign a paid app to an iTunes account that has enrolled in your MDM. That doesn’t allow me to push an app install with no user intervention. Knowing what I know now I’m not sure if I should setup class itunes accounts to assign them apps with the new model, or stick with apple configurator. Thanks for your clarification, lets home we can push apps over the air one day.

@ButterflyMoon You mentioned in another thread how you manage ipad apps with Meraki. Does this require an Itunes password? I’ve tried to push free apps to the device, but it asks the user to sign in with an apple ID. I hoped IOS 7 changed this. I just linked my vpp account to Meraki today, but that didn’t work either. Can you please explain the process? Thank you,

You will need to create or update your central store with the new GPO settings. See this MS article. How to create the Central Store for Group Policy Administrative Template files in Windows Vista

Rogue wireless? When it happens again get the IP info from the machine and also try to ping the server by IP and name. Look at DNS is your shortcut setup to a server name or IP?

There are two methods to define quotas that I know of. First is to set the quota on the drive level. You can manually adjust quota entries for individual users. The advantage to this method is it shows the user how much space they have left if the drive is mapped. The quota was also based on file ownership, so having a shared area on the same drive would count against their home folder quota. The second method uses file server resource manager(2008 + ) You can set quotas on a per folder level, and get alerts on or block certain file types. If you have your home folders sorted out by year group you can set a different quota for each one. The disadvantage to this method is it shows the user the full drive capacity when it is mapped and not their quota limit. This was my experience on server 2008 and have since moved file shares to 2012 with deduplication. I don’t currently have quotas set and just monitor the overall drive usage. Things may have improved since then.

I upgraded to 8.1 for server manager and to get used to it. I have some 2012 servers and just upgraded a few of them to 2012 R2. I think I’ll wait until it is hardware refresh time to move anyone else to 8.1, I have not tested any 8.1 gpos yet, or figured out how to handle store apps.

Do you have it set to remove when the group policy no longer applies? If so this may be the problem. Try linking the GPO to the new OU and keep it linked to the old one. Move the PC to the new OU. After it picks up the policy from the new OU then remove the link from the old OU. This way the PC doesn’t think the policy doesn’t apply anymore. Also try changing the setting that instructs it to remove when the policy no longer applies.

Another vote for thinstation. I pxe boot no need for hdd all conf files are pulled from the server so you don’t have to rebuild the image if you need to change a server connection. I wouldn’t mind trying thin pc but I think it takes 512MB my old machines have less than that.

The browser does direct you to youtube education. The app always bypassed it and gave full access. I don’t think IOS has the youtube app anymore.