JonDaviesBourne

Hi, I'm currently working on integrating our Mac network with our new Windows domain. I'll be using Profile Manager for policy management on them, with AD providing authentication. My question is, is there a way to get a shell script to run at login to symbolic link all of that user's folders to a hidden network mount? My reasoning for this is, the Windows side has been designed without users having network homes, just using Folder Redirection. This means that I can't check the nice easy "make it use network homes" box in Profile Manager. I'm trying it out in Automator to start with, but I keep hitting permission errors when removing the existing local Documents/Downloads etc. Would the login script run as root rather than in that user's context? Kind regards, Jon

I wouldn't worry too much about the making documents available offline. You'll get more of a headache from staff not knowing if they saved to the C: drive or not. The sync only syncs differences, so you'll only get high load when they all first sync up. I would be insistent that standard users (staff/students etc) not be allowed to have any write or modify permissions to any part of C: as malicious scripts could still run with their credentials. Not to mention the fact that anything just saved locally won't be caught in your backups. If they absolutely MUST have local write, then set your image to partition the disk to C: and D: and just give them permissions on D:. I just can't stress enough how much of a bad idea letting staff have any write permissions on their system disk is We've been running our domain this way for this academic year and it's been working like a charm. One thing I'm working on at the moment is making sure that profile size is kept to a minimum (appdata and the like) in case of using a new machine as you'll find logon and logoff times going through the roof. (Found some profiles here that were >40GB)

I would never give anyone other than IT staff the ability to install anything other than maybe printers. Bear in mind that if they are local admins, they could download and install anything when away from the domain and bring back all kinds of nasties. Roaming profiles, folder redirection and make redir. folders available offline. There is a GP setting in User->Administrative Templates->System/Driver Installation for "Allow non-administrators to install drivers for these device setup classes". You can put the GUID for printers in there to allow them to install just printers, then set the scope to just their laptops.

That bodes well then! No real issues to speak of? Just we run Lexia and have had no end of issues with it (both from the same company as far as I'm aware).

Hi, We've just got a trial for Symphony Mathematics and was wondering if anyone here had any experience with it? Thanks in advance!

- Create a folder in %systemroot%\sysvol\domain\policies called PolicyDefinitions. - Copy the contents of %systemroot%\PolicyDefinitions into it. - Forget %systemroot%\PolicyDefinitions exists When you open the Group Policy Editor, you should see next to Administrative Templates "Retrieved from the central store". How to create the Central Store for Group Policy Administrative Template files in Windows Vista is the MS KB for it. If you don't place them in sysvol and have multiple DCs (you should have) then they won't replicate across.

Hi, We have an issue where computers occasionally lose connection to external sites and services (google, etc), but retain ability to access internal sites and services (exchange, intranet). We have a NPS server talking with a Meru wireless controller, and go out to the internet through a Fortigate 200B. If anyone has experienced issues like this, and/or have any ideas as to how to resolve it that'd be amazing! Thanks, Jon

It could be that the machine/you have not been properly authenticated on the network in that case. I would check the audit logs on your DC for failed computer authentications.

Double check all the permissions and delegation on your GPOs, and check event viewer for any authentication failures.

Doesn't matter about the proset rubbish unfortunately... Can you check the WLAN Auto-Config log in event viewer and see if there's any errors there?

If the computer password had changed, you'd be getting "The trust relationship between the workstation and the primary domain has failed". This is more likely to do with wireless cards not properly initialising on boot/taking a while to associate. I've been working on this issue for a while as well! Out of curiosity, are you using Intel Centrino based NICs?

Hi, I've sent you a PM, I also have a thread about something similar here in case you want to try some of the things I have. Still no solution for me yet though! http://www.edugeek.net/forums/wireless-networks/131010-wireless-failing-connect.html Jon

I think that Teamviewer supports Windows RT...not sure of anything else supported on it unfortunately

After many, many weeks of head scratching, I managed to finally resolve this issue. Our wireless controller was set up to do band steering to 5GHz which was upsetting our wireless cards that occasionally wanted to use 2.4GHz due to high traffic on 5GHz. This was causing the program to think there was an issue with the network and crashing out. If anyone requires any help with Lexia, please feel free to PM me on here as I have had to develop quite a comprehensive understanding of it in order to figure out what was causing it to break so spectacularly...

Yeah, we've had ones to admin@ and specific addresses. They seem to be getting creative though...

I have noticed quite a number of those recently, do we know if these are coming from a common source? Obviously attachments and links get stripped out, but it still doesn't look good if we have the actual emails getting through...

+1 on the SSD for OS and HDD for everything else. I run an i7 3770k @ 4.5Ghz, 8GB Corsair Vengeance @ ~2133MHz with a 60GB Corsair Force3 SSD, boots in about 5-7 seconds. Considering getting another SSD to use for caching & installing regularly used programs on for the faster load speeds.

It's not, is there anything specifically in there that might resolve this that you know of? As deploying to all machines will be a nightmare!

Hi, I have been doing a significant amount of digging around this subject and have come up with nothing. My problem is as follows: Every now and then, I get "No logon servers to process the logon request" when trying to log in to a domain account on our network. This seems to be totally random, and can occasionally be resolved by waiting a couple of minutes after the computer finishes booting. All other times, I have to log in as a local administrator and manually connect the to the network. The network profile is deployed through group policy, and RSOP shows that it has been picked up correctly. We use a Meru wireless network with a RADIUS server doing 802.1x authentication. The only errors, other than with Netlogon, Group Policy, DNS & NTP (symptoms of not seeing a DC), are under the WLAN Auto-Config log and state that network association failed for reason "The driver disconnected while associating". This was initially seen only on machines using Intel Centrino Advanced-N 6235 cards. I replaced a couple with Qualcomm Atheros cards for diagnosis purposes and these did not show this error at all, however with the latest batch of Windows updates, these have also started displaying the error on occasion. The Intel cards will also occasionally fail 802.1x authentication. None of the cards display an error when booted in safe mode with networking. We are also getting some strange DHCP behavior in that we get multiple DHCP ACKs to the wireless card's MAC address (only on the Intel cards). List of things I have tried so far: - Replacing wireless cards - Using different driver versions - Turning off band steering on our wireless controller - Re-imaging machines - Uninstalling Intel ProSet tools - Disabling bluetooth on the machine - Disabling NetBIOS over TCP/IP on the machine - Disallowing the OS turning off the wireless card - The hotfix from Microsoft found at KB2459530 I really, really need some help on this as I have exhausted all routes I can think of. Setting a static IP address on the client stops the errors, however this is just not feasible for us.

Hi, Type "ipconfig /flushdns" into an administrative command prompt and see if that resolves it. If not: Go to C:\Windows\System32\Drivers\etc\ and open up the "hosts" file to see if there are any static DNS entries in there on the affected machines. If not: Check on the servers that run DNS (usually 2 of your DCs) and see if they have any static entries in their hosts file. If there were static entries pointing at an external server that you did not put there, you will want to have a look at how and why they got there as it is indicative of cache poisoning.

Test-ComputerSecureChannel -Repair in Powershell 2.0 repairs trust failures.

xSplit is pretty good

We don't have different makes of access point (Meru network & controller) and I have put an older Atheros chipset card in one of the machines for testing. Just waiting to hear back about how it's doing!

"Test-ComputerSecureChannel -Repair" in Powershell when logged on as a local administrator sorts out most trust issues

Don't make them administrators on their own machines, and make sure that your Windows Lockdown GPO is properly configured. Any malware would require admin rights to install, and UAC should prompt the user for admin credentials when malware tries to install. If they bring the laptops into school each day, then having them back for Windows updates should be irrelevant as long as you have WSUS configured correctly. It could also be worthwhile pushing out a group policy that uninstalls Java as it's rarely needed and has myriad security holes.