ADMaster

The desktop redirects, but when I try to access a folder it doesn't open, no error it just doesn't open. The documents appear to redirect, but the documents library only has public documents. Trying to add my documents gives an error. Hopefully it is just something off in my policy that I can correct once I get 2012 DC. The store apps is an issue. On one hand I want to just disable the store, and on the other I would want to push apps. I know the minute I disable the store some teacher will say they need store app xyz. As said before it's just not corporate / education friendly. I have w8 on my home PC and it works nice.

I've spun up a few VM's to test settings. My two issues with it are the store apps, and folder redirection. I will have a 2012 DC later this summer so that may fix the folder redirection. I will also be looking at SCCM this summer. Those of you that are rolling it out, how are the store apps installed and updated, does every student need a Microsoft ID. We have GAFE not O365. Thanks,

WINS? What do you needs WINS for these days?

@wickedweasal How does that work, I thought the vpp codes were stored in the apple configurator. I currently use a combination of Meraki and configurator, moving app deployment to Meraki would be great. Also does it still ask for the iTunes password when you push out with Meraki? Thanks,

I did some research on this very topic a month ago. Our domain was setup by a predecessor a while ago as well and is very long. Internal domain Schoolname.schoolname.k12.st.us Public / website schoolname.k12.st.us I considered shortening our internal to schoolname.lan but didn’t based on other posts. To sum it up, just because .lan, .local, and .internal are not real TLD’s now doesn’t mean they won’t be in the future. I had a minor issue of accessing our website from within, but a couple DNS changes fixed that. Unless you have a lot of problems with your current domain I would look into domain renaming. Otherwise you’ll have to recreate all you users, rejoin your computers, and reset all your permissions. You can demote, then rebuild one server at a time, or bring up a third. Look into registering a sch.uk or use your schools .org fqdn. Other suggestions I came across were Internal.schoolmae.tld Lan.schoolname.tld Regards

Thanks Ian, The ipads in each building will be on the same subnet, so the multicast etc should work fine. I’m just wondering for each building do I combine the devices into a single /22 or /23 OR have 3 /24s? Is it just a matter of personal preference, or are there any technical / security / ease of use reasons to go one scenario over the other. Are broadcast domains an issue? Will the bonjour traffic be a hindrance to the rest of the network? If I recall the old apple talk protocol was very talkative. A reason to separate them would be reporting, I could tell by the IP weather it was IPad and what building it should be in. I understand it is ultimately my decision, but I’m looking for advice in which direction to go and why. Thank you,

Hello folks, I will have some chromebooks and ipads on the network this year and need to add / expand my dhcp scopes and vlans to accommodate them. I have dynamic vlans setup with the radius server, so depending on your username / group membership you get a different vlan. Currently that is staff, student, ipad for school owned devices. The ipads currently connect with one generic username. I am considering splitting this into three user accounts, and doing the same for the chrome books. This would potentially allow each device group to get its own subnet, allowing me to apply content filtering at the building level. I am considering 9 smaller vlans , or 3 larger ones. ES chrome, ES Ipad, ES Students (Domain laptops / netbooks); none at this time. MS chrome, MS Ipad, MS Students (Domain laptops / netbooks) HS chrome, HS Ipad, HS Students (Domain laptops / netbooks) OR ES students, MS Students, HS Students What are the pros and cons for either of these scenarios? Thanks,

I have deduplication enabled on the data drive for my win8 box at home. I see between 55 – 60 % savings. I will be getting Server 2012 later this summer and plan to move all my shares to it. The eval tool says I’ll get 58% on my WDS / Software share and 27% on my user data share. @zbjsy From an elevated PowerShell session these commands will get you the info you’re looking for. Get-DedupStatus Get-DedupVolume Deduplication Cmdlets in Windows PowerShell

Sadams, I also use thinstation so the WDS server boots a linux pxe menu. Here is a guide to setup WDS to book pxe linux, it also shows gparted. WDSLINUX - Syslinux Wiki I added gparted to the menu because I had similar problems with MDT 2010, I have upgraded to 2012 but haven’t imaged enough to see if the problem still exists. In my case it was one model of machine that gave me the most trouble. I have not tried the F8 diskpart method, but certainly something to look into Monday. Good luck with which ever option you choose.

As Michael said not remotely. However I added gparted to my pxe boot menu. So if a machine doesn't image properly I can just reboot into gparted to clean out the partition table.

I have Temperature @lert it is a USB device that will send emails for high and low temps. Not to highjack the thread, but what is a good temp for the server room? I have one room that gets into the high 80's low 90's (30 - 35) if I do not keep the door open in the summer. Thanks,

+1 for skeep, although I have slightly customized mine to offer remote assistance and remote desktop.

I tried disabling java in the browser but found out study island uses it to communicate with the clickers. @sonofsanta I do not use anything that requires java myself so do not see all these warnings and update notifications. I do disable the auto update check, which may help you with some of the nag screens. We have also had issues with JNLP file associations in the past. I have attached my group policy settings to disable java auto update and fix the JNLP file associations. I’ve also attached my MST that will disable java update during install. I have these settings in GPP registry for users, and computers. I hope they help you. JavaNoUpdate.mst Java.zip

MDT, WDS, and WSUS will handle the imaging and microsoft updates, you can also push some software updates with group policy. +1 for PDQ with the pro version you can schedule deployments, and have multi step installers. PDQ is also not limited to MSI, if you can do it silently from the command line, PDQ will do it.

Your isp only allowing you 1024 addresses doesn’t leave you much room to segment the network. In my case we are told what private IP’s to use as well, but that is from our ITC and we have networking between other schools in the consortium, they also do firewall and filtering for us. However I have a full class B to work with. I could easily put the ip rage they assign me on the router and use anything I wanted internally, I just wouldn’t get all the benefits such as filtering by IP range etc. You should be able to tell the ISP what you want to use internally, however if it is a LEA/ITC that might be a different story. If there is no advanced filtering by IP or different filters for staff and students, I’d NAT what they give me and use my own IP ranges. For the DHCP issue on the router under the vlan interface you set the IP helper address to the IP of your DHCP server. Then you setup the different scopes on your DHCP server. It took me a while to wrap my head around that one too.

You can do that as long as you do not configure the IP on the switch, a switch is a layer 2 device and doesn’t care about IP’s (layer 3). The ip you configure on a switch is used for management purposes, not what IP range the connected machines have. You can configure the red and blue machines with the same address and they will not be able to communicate with each other, but in this case they will each need their own router. A single router would not be able to have overlapping IP addresses. In theory you may be able to set the IP address with a /32 so the router thinks they are different networks, and each vlan would have to use a different gateway. I think it would still cause routing problems though. If this a just what if scenarios for your knowledge by all means play around and try the /32 and perhaps something with sub interfaces. If this is production use separate addresses and use an ACL on the router if you don’t want them to communicate. In my school I use vlans to segment and identify the network, not to use the same address. I have separate vlans for wireless, voip, data, security etc. I have multiple data vlans for a couple reasons, 1 to breakup broadcast domains, and 2 for troubleshooting and identification. Each data closet is on its own data vlan. This allows me to know at a glance what part of the building that IP is coming from.

Setting the SRP to white list and allow things like %program files% and %windir% only, blocking everything else will do what you want. This will block anything in their profiles, flash drives, and temp folders. This way your not chasing a hash or wondering if the user renamed it. We are a Google apps school so chrome is recommended. I push out the MSI and use the adm files to set the homepage and block automatic updates. All these settings have worked well for me.

I know this is a bit old, but did you get this to work. I have a primary lab where the users have removed some library locations. I want to copy the library files on logon so every time they log on they will have the correct locations. I tried copying manually first, but the library comes up blank asking me to include locations. I have removed the owner sid and serialized tags from the file. any advice? Thanks,

I am currently trying netvibes Netvibes It looks like it could become my homepage. I created a security updates tab to keep up on Adobe and Java etc and another tab that has my email and edugeek.

@squeeky, I published the script today here it is. Tech Blog: wbadmin Backup Script While double checking a few things before I published I came across an article about creating a vhd and mounting it over the network. This will supposedly act like a local hard disk and allow incremental / differential backups to a network location. I will explore this option and if it works like I hope, I'll publish the results.

Yes, vikpaw that is my script. I have made less improvements than I thought. I didn't think I had the moving of users and their home directory's implemented in the one I published. I looked through the code and the only things I have added since I published is address verification and I changed my OU structure slightly. The address verification simply checked the state, sometimes a comma would be entered in the database after the city putting the csv out of line. The OU change was to put buildings before the years. So my new structure is Students HS 2013 vs Students 2013 This made in more manageable to apply settings to each building, specifically Google apps. After I obfuscate the courses script I will post it too. Here is the user script link Tech Blog: Add Users Script

I published a powershell script I use for user creation on here a while back. I have made some improvements to it since then. I'm sure it could easily be adapted for sims and your environment. My script will create users add them to a yeargroup add them in their yeargroup OU handle withdrawn students handle name changes create home folders assign permissions to the home folders. send me an email of changes. My user account (for students) creation is fully automated. I have another script that puts students in AD groups based on their timetable. However it requires SQL access so may not adapt as well as the user creation script.

Or use Google's own free tool for the job. Google Apps Password Sync - Google Apps Help

I have used a few different solutions. I started out using BackupPC it did a pretty good job, but I don’t think I could do an image backup with it. Currently my only physical servers are 2008 and 2008 r2, so or my virtual servers I use vmware data recovery. For the physical servers I use windows built in wbadmin. I get around one backup network limitation by using a powershell script. It creates a folder with the current date and uses that as the backup target. My backup location is on the same domain, so I don’t have the password issue. However you could try putting the password in the script. Net use * \\backupserver\backupshare adminpassword /user:backupadminaccount If you’re interested in the script I’ll get it Monday.

I setup SRP earlier in the year and set the default to disallow. Then set allow rules for key software locations such as; Windows windows system32 Program files Program files x86 I think HKLM software … run was in there too, I’d have to look at the policy to be sure. I had to add a few other exceptions for programs that didn’t install in the default location. Students should not be able to write to any of these locations so the only software that can run must be installed properly. This prevents them from running anything from removable drives, their desktops, portable apps, etc. Good luck.