birchanger

We move the machines into an OU for the purpose that imposes Applocker rules, then we place the candidates' accounts in security groups to pick up the correct Applocker permissions. This is for cases in which the ability to save work is needed and (sometimes) to have access to exam resources such as graphics. Takes a bit of setting up, but very flexible once it's there.

This thread's very interesting to me as profiles are a bane of my life. Everyone at the moment has roaming profiles. Perhaps half a dozen times a day I get students that either get almost logged in before before being thrown back out, or whose redirection policy is permanently failing to apply. These faults are both fixed by deleting the profile. In addition we sometimes get very slow logins. haven't got to the bottom of it but profiles may be part of the problem. We have a very comprehensive set of policies. I suspect too comprehensive, but there's no shortage of nailing down and redirecting going on. So, I reckon that we need either mandatory policies or none. Now I have to admit that I hadn't heard of the latter - how's that work? If we go for mandatory, given that we have everything in policy, what would you put in that profile? What would be better placed in the profile rather than set by GP? Setup here is all Win 7 / Server 2008R2.

No, neither. It's annoying as we're using an identical transform as previous versions.

Yes, I can start in safe mode, but we have an awful lot of machines! In fact some of the machine were OK after a few restarts. We'll rebuild the others - and then try to get Java 7u51 installed.

I recently rolled out the deployment of Java 7 update 51 having, naturally, tested it and found no problems other than the minor fact that it won't let most apps run any more. I then had reports of many systems being hung with 'installing managed software - Java 7 Update 51' on the screen. I hurriedly removed the policy - so now I have many machines stuck either trying to remove Java, or stuck slightly earlier on in the boot process at 'Applying computer settings'. So, first, how have others fared with this release when deployed by GPO? And any ideas on how to recover the borked machines, other than a rebuild?

It's that time of year again, and this year I'm thinking about what to do with our VM infrastructure, in particular to improve performance and resilience. It was installed about four years ago and hasn't really been seriously thought about since. Most things are virtualised under vSphere 5.1 with HA configured. We have a chassis containing 7 HP ProLiant BL460c G6 blades, each with 8 cores and 16GB RAM. On five of these we run: Two DCs (with DHCP, DNS, Radius, KMS, certificate services and so on). These also act as file servers (with FRSM); one hosts Impero server A host for Eclipse (Library); SpiceWorks; licence server (Autodesk, Sibelius) Symantec SEP and WSUS server Management server. On management VLAN, used for ProCurve Manager; Trapeze Ringmaster; access to switches, SANs and so on Software Deployment Server (GPO-installed software packages); SharePoint Exchange (except for Unified Messaging, which has its own blade) Finance server (PSF Financials) Print Server; including Equitrac print management MDT/WDS server LAMP server (email address mangling, Wiki) Above list is far from comprehensive in terms of services. All the above are on Server 2008R2, except the obvious one. We will need to get our CMIS setup off of Server 2003, so will probably virtualise that very soon. We also want to start playing with Server 2012R2 and System Center soon. The virtualised stuff is managed by vCenter which sits on its own blade. My first thoughts, without benefit of a proper capacity analysis, is that we're not short of processing grunt but the memory looks stingy, and it's rare to find a system that wasn't grateful for a few more GB. So I'll certainly add that to my shopping list. I wonder about having so many services on the DCs, and am sure that shifting Impero elsewhere would be beneficial. I also think that separating out the file servers may help, and I'm considering DFS namespaces as a route towards that goal. How have others gone when virtualising? More servers with one or a few services each? How has it worked? Finally (for now) it seems like a waste letting vCenter have its own blade. It can't possibly need 8 cores or 16GB. What do others run it on? A dedicated but relatively puny host?

The only problem is the OS X versions of Office are confused, to say the least.

We use Impero - it's one of the nice extras.

We're happy users of WDS/MDT and would like to make the move to SCCM. In parallel we are considering taking out an OVS agreement as we're currently stuck on W7 Pro perpetual licences and would like to move to Enterprise for Bitlocker and AppLocker. What will I need licence-wise to run a basic SCCM setup? We currently have 5 physical servers (2 processors each) running ESXi hosting 8 instances of Server 2008R2 including 2 DCs and an exchange server. The DCs are (from memory) Enterprise edition, the rest Standard. We also have a further 3 physical servers running Server 2008R2, one of which runs Exchange Unified Messaging. We'd obviously want to manage our 870 clients; not too sure that it's necessary for our servers.

LGfL has this on their support pages: Evidence indicates that Google have, without any announcement, recently introduced an additional URL in the background as part of the process by which YouTube streams its videos. As a result of this videos can now appear intermittent, or not appear at all. [snip] Using the tools provided we have been able to identify that YouTube now streams its videos from googlevideo.com. Thus in order to enable access to YouTube and its video service in Webscreen 2.0, the following three entries ONLY should be added to the list of allowed URLs and keywords in each relevant policy: youtube.com ytimg.com googlevideo.com Any other entries relating to either site should be removed. The three entries given above are wild-carded and hence will be applied to any variants.

Our salesman was in this morning and told us. We don't have any of their hardware as it was seen as expensive, though I always thought it pretty sound. They're going through now what the big iron vendors went through in the 90s. Will they be an IBM or an NCR?

I didn't mention any technology, but assumed that .exe creation would be considered likely. Thing is, the dual-partition method worked well, until someone went and installed MDT 2012. My latest solution - domain VirtualBox VMs being built by MDT - meets the required functionality but won't bloody well build from the network, and is too slow. Everything I try nearly works except for something biting me in the bum.

I foresee one problem - running VB under Linux!

This posting could go in one of many of the forums, but this one may have the best-informed readers. I hope. I've spent much of the last few weeks trying - and, on the whole, failing - to get an environment together allowing older students to program i.e. create and run arbitrary .exes without it being too easy for them to trash the computer or network. I've gone through a few iterations: 1) Use a separate partition. I used MDT 2010 to apply a custom image to a second partition on our Win7 clients. The custom image was off-domain and I'd blocked access to the 'main' partition and applied other restrictions using local policy. The end of the custom image deployment task sequence ran bcdedit to give the new partition a distinctive name. A startup script on the school domain made the currently-running OS the default. In other words after installing the custom image all I had to do to make that image non-default was to force a boot into the main partition then a GPO would make sure that that became the default image. This worked, and performed, well, but then MDT 2012 came along and I can no longer get it to install into a second partition without trashing the main one. I'm sure it can't be that hard to do, playing with the diskpart script, but I gave up. I tried investigation MDT-created VHds, but gave up on that one, too. so, plan 2) Use virtual machines I built an off-domain image into a VM and tried that. the first discovery was that MS Virtual PC needs virtualisation support, and the systems in the ICT rooms lacked it. OK, let's try VirtualBox. Next problem: not enough memory. OK, added a few gig to each device. This worked for a few weeks until Windows needed to reactivate itself against our KMS server. It failed. My assumption was that it was because the VMs were all cloned. I didn't want to push a newly-syspreped image out as the students would get lumbered with the OOBE, so that meant try something else. 3) Push out an empty VirtualBox machine and disk, then perform an MDT build into it. The image is on-domain but disposable, as a VM, and access to almost everything has been blocked by: blocking GPO inheritance; loopback processing and new GPOs where needed. The problems: PXE boot and network access is slow. PXE boot fails when there's even the slightest hint of a load. It took me from 4.30 to midnight to install the VMs in 9 machines. That leaves me 33 to do. Worse, it takes the students forever to log on twice (once into the physical; once into the virtual). In fact it's not usable. So now I need plan number 4, but don't yet know what it is. What do (would) you do?

Once you've done that then you need to rescan the disks from the Disk Management snapin - you should then see unallocated space at the end of the drive, and you'll be able to extend C: into it.

The log is produced by FreeFTPd, which seems to be running as a service so that it can accept backups from our Cisco Call Manager. I've no idea why it's tracing every packet, or how I stop it, but at least I now know who to blame and what service to stop when I want to free up space. I deleted the file an hour ago, and it's already up to over 100MB.

Is the C: drive on a virtual disk of its own? If so, why can't you just enlarge it in VMware?

Ah. I was assuming that Symantec were to blame, for no reason other than that's often the case here. I haven't run BootVis, but it's useful to know it's WMI using all the space.

I'd been having GP problems and it turned out that the C:/ drive on one of my DCs had zero bytes available. OK, I bunged it a few GB in ESXi just to keep the service running, but it ran out of space again a few days later. There's a file called wod.log taking up 36.5GB. Anyone know what it is? It isn't present on the other DC. The permissions give nothing away, and of course it's too large to open with any editors I might have on me.

Well, we're currently looking at OVS, which I think is the same sort of thing. I think my question was really 'what is SCHOOL 3'. I don't think we're on EES but don't know how I'd find out.

We have about 870 MS desktop licences, and I'd be a much happier bunny if I knew just what we can do with them. I'd been led to believe that we bought them from RM and that they're perpetual and for Win 7 Pro. Some time ago I asked my then NM about putting Win 7 Enterprise on staff laptops so that we can implement bitlocker. After some days of research he came to the view that the answer was Yes. Having my doubts (now that it's my responsibility) I obtained a consumption report from our usual vendor of almost-everything and MS say the licence type is SCHOOL 3. Anyone know what this means?

Has anyone ditched in-house filtering to rely entirely on Webscreen? It feels, intuitively, to be a bad idea, but it's presumably robust and can provide the required granularity. And I would be glad to see our Smartcache fold its tent.

We have noticed that replies to our Spiceworks help desk are bouncing, and discovered that it's because all mailboxes in our Exchange Server 2010 no longer have an email address of the form [email protected]. Users have in some cases just one address of the form [email protected] (as well as one for Unified Messaging), although some also have [email protected]. I'm sure that not too long ago all mailboxes had quite a few addresses including the internal name, username@etc and others such as X.509. Where have they gone? And I assume I'll now need to tinker with email address policies. That won't be easy, I sure.

We're currently recruiting for an IT technician. Details are at Vacancies « East Barnet School. Experience is not essential, but being good with people and being interested in technology both are.

Any reason you're using TSGuid instead of TaskSequenceId?