Ephelyon

My favourite bit is right at the top: They're not, are they? Surely they're not making a profit out of education? Whoever saw that coming?! And that's irrespective of whether an academy chain is good or bad, or whether it makes the news or it doesn't. The new system has profit-making baked into it, and it will happen even if the chain is doing well in terms of pupil achievement.

I posted this up a while back and it seems to have been well-received.

Many thanks! Scripted this into prompting for the dates so we can run it over SSH now.

Hi @webman, our Deputy Head would like us to report on how many times (i.e. periods) individual staff have booked a computer room (any room) per half-term. Just noticed you mentioned earlier you might have some SQL queries - can we come with a begging bowl please? Ideally the query would generate two columns (teacher name, total bookings) and accept two dates as input (start and end of half-term). Don't want to ask too much of your time so if there's anything you could point us to that we could generate it from ourselves, we'd really appreciate it!

@garethedmondson, this part is surely relevant... they would need to have an earlier version of Windows already, if it works the same way as standard Volume Licensing arrangements at least?

Meh, it's all been done...

That was me - though I can't see any immediate differences from the original (haven't really looked though)...

Ah, brilliant - many thanks for that! Now to see if I can crowbar our Head of ICT away from Python 2.7...

In a courtroom, the legal test for "toxic content" within the context of an office or classroom is likely to be passed by a hardcore pornographic image, but failed by "stickman porn" or individual instances of written or spoken profanity. Context and all that - I can provide more details if you want them but we'd be getting off-topic. PM me if you like, I have a very long debate you could read... I'm not sure about how exactly the wallpaper is set using that method - possibly the whole TranscodedWallpaper thing at a guess? As for Python 3, personally I think we should be using that exclusively though we currently have both 2.7 and 3.2 deployed. Our Head of ICT has asked that if we have to make a choice (such as if I deploy a VM with a single application if our workstations would magically work with it), we should stick with 2.7 as most of the resources he's prepared for exam revision etc are based on that. Don't ask me why... but it's his job, I'll obviously accept his choice!

That's a persistent myth about some areas of the law I'm afraid - it applies to H&S Law but not Law of Negligence, for example. Either way, in this case we can't take any steps beyond removing software - and thereby the subject - from the curriculum...

The problem is that this particular banned action is of the type that can have consequences beyond school discipline. Just as it's possible to sue your employer if another employee has pornography on their screen and you can see it from across the office (and are "offended" by it, of course), so it is in school classrooms. It's an incredibly unlikely outcome, but as I said, now that they can change the desktop background it's only a matter of time before the naked ladies begin to appear...

That would be an HKCU key so users have permission by default (and taking it away within a User hive can get problematic) - either way, that method uses a function call rather than direct Registry modification. Unfortunately VMs on workstations don't seem to be an option for us. Since my last post I've created and deployed a VM with VirtualBox, but running it inevitably causes the workstation to either hang up and reboot or give a STOP 0x00000101 error within a few minutes. Most of our suites where coding would be taught have old Dell OptiPlex 740s which, even with RAM, SSD and BIOS upgrades (no CPU config options), don't seem to be able to handle it... and we've no money for replacements en masse, of course. So put bluntly, then, are we saying there's no way to programmatically disable functionality within Python?

Just reaching out to more experienced coders as programming has never been my strong point... We've known for a little while that students with access to Python are able to change their desktop background by means of code similar to the below: import ctypes SPI_SETDESKWALLPAPER = 20 ctypes.windll.user32.SystemParametersInfoA(SPI_SETDESKWALLPAPER, 0, "blahblah.jpg", 0) Most of it is fairly innocuous - Star Wars backgrounds etc. - but unfortunately this morning we've had the (inevitable) naked ladies. I'd imagine the image itself was brought in via USB stick or someone's personal online storage. SLT aren't happy that this is possible and my "reminders" that this is (just the start of) what NMs were kicking off about when programming became part of the mainstream curriculum seem to be falling on deaf ears. Nevertheless, does anyone know whether it's possible to disable certain Python modules or functions without any major side effects - ideally a deployable method? I've tried removing the Ctypes folder from Lib through GPP Folders, but unfortunately this causes an MSI re-install whenever Python is launched as it detects missing components, which it seems is an unacceptable delay. If it's possible to do it properly, I wouldn't mind getting rid of anything that reads to or writes from the Registry too (proxy settings etc)...

Can you not remove the recovery partition from the WIM file? Then, when you build your next image, you remove the recovery partition in advance from the golden master beforehand.

@localzuk - how do you check? Are there any "standard" ways of doing that? (Genuinely interested.)

Not natively, but since it writes to the Event Log you can configure alerts based on that: Configure Email Notification for Windows Server Backup - BlueCompute

Depending on what you're using, can it not e-mail you if a job fails? Veeam is set to alert me that way here.

What's the pricing like for Ericom Blaze and AccessNow?

Completely correct! ... except for the tokens bit. It extracts the session ID from the output of qwinsta. Tokens are separated by space/tab by default, so if you run qwinsta on a workstation you'll see where it's getting it from. It's looking for the part of the line returned by find that includes "console" (one session is always at the console). And yes, even an admin is not supposed to be able to switch to a user and thereby impersonate them without knowing their password. But if you ask Microsoft, they'll eventually admit that "this behaviour is by design" because LocalSystem is indeed supposed to be able to do anything - that's its point. I imagine it's fixable if they reworked certain token/permission frameworks a bit, but they don't seem to be very interested in fixing it. Tested on XP up through 10 so far.

Open it with Notepad and find out! But the top and bottom of it is that LocalSystem can switch anyone's session to the console...

Then again... there is another way that preserves the best of both worlds. I've attached my UnlockWorkstation script. This script can remotely - and without any third-party tools - unlock a Windows workstation. Again, it assumes you are logged on as a domain admin and the workstation is domain-joined. UnlockWorkstation computername UnlockWorkstation.zip

It basically just uses "tsdiscon" to disconnect the locked session from the console - Windows will then return to the WinLogon session (logon screen) by default. Horses for courses - sometimes they do come back, or it could be a member of staff who will be back after lunch in half an hour (having set up all their lesson content ready) but it would be nice for someone else to just get on and do something quickly in the meantime. Either way, it's probably better if it's not IT's decision - the new user can decide whether any performance drop is reason enough to do a clean restart (i.e. not through the power button), then it's their fault if anything's lost... That probably sounds more cynical than I meant it to, but oh well!

Rebooting may not be desirable as it could result in lost work - hence the script above.

@abillybob, for individual cases, you can use this script from your desk (assuming you're logged on as a domain admin) at the command line to switch a locked workstation back to the logon screen without disturbing the inactive session. SwitchToLogon computername SwitchToLogon.zip

... but getting to work is required in order to do the job. Working from home is also required to do the job. Are they that different?