Ephelyon

If I were going to be employing a Year 11 leaver, I wouldn't be bothered about their gender.

Perhaps, reading GD's questions, they thought it was aimed more at women who already have somewhat of an established career in IT? They don't give that implication to me but maybe others thought they'd have little to add at this stage.

Quite a few of the women posting in this thread have mentioned the common view from when they were younger that women "shouldn't" go into IT, be it through statements from teachers / lecturers / career advisors or just from society in general. This wouldn't have been the case for the men, so is it possible that these women have only come into IT later on because that view is far less common now? In a sense, they were less constricted by the Zeitgeist around "left-brain/right-brain jobs" in later life, so the career option seemed to "open up" for them. Traditionally Western society always promoted certain types of jobs for men and certain types for women, which in earlier times we would have interpreted psychologically as the left-brain and right-brain respectively. Because the left-brain logical analysis stereotype is commonly associated with large parts of an IT role, and the myth around men and women is that they will always suit jobs typically associated with brain hemisphere "specialisms", we took the kind of views we used to take (albeit for the wrong reasons). Christian Jarrett talks a little about this here: http://www.psychologytoday.com/blog/brain-myths/201206/why-the-left-brain-right-brain-myth-will-probably-never-die From a psychological standpoint though, the "myth" does ring true a little. We introduce a lot of these predominantly left-brain young men, who enjoy the technology for what it is rather than what it does (not a sin at that stage as I've said before), to the IT industry by means of a support role. Unfortunately this often involves a lot more empathy for other people in different situations (typically right-brain stuff) than they're prepared for. The educational technologist should be someone who may well be predominantly left-brain in terms of the level of logical deduction you need to understand the technology and troubleshoot it, but also has a well-developed right-brain otherwise we can see the situations we sometimes encounter with IT staff who just can't empathise with users who can't grasp computing fundamentals as finger-snappily as they can (again, just different kinds of people).

Sorry, I've just noticed that you asked for the computer description as well. The Registry entry for this is here: HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters\srvcomment So you could adapt my code above to account for this as well. Personally I use the computer description to identify the image version, so I set this before I SysPrep the golden image. The command to change the computer description would be: reg add HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters /v srvcomment /d "WhateverYouWantItToBe" /f The /f switch is to force the change to an existing Registry entry without prompting for confirmation. That really is supposed to read "LanmanServer". When I save the post it does something funky with the formatting for some reason.

I have put a solution in place for this here but it forms part of a broader system of scripts and utilities linked in with WDS to centrally automate computer naming, including other desired activities like on-the-fly encryption during auto-build. I'm going to make a very long post now that details all the components of this, some of which can probably help you. I use Windows batch scripting rather than VBScript. "DOMAINNAME"/"domainname.local", "DomainUser", "DomainPassword" and "ServerName" should be altered to suit your environment. I've turned OFF the WDS option to have workstations automatically joining the domain otherwise it would conflict with this. Firstly, we need to get the desired computer name when WDS loads, before image selection. To that end, we include a section in the WdsClientUnattend.xml file on the imaging server: domainname.local DomainPassword DomainUser Get computer name and store it 1 \\ServerName\ComputerNames\GNWrapper.bat DomainUser is a member of solely the Domain Guests group, but is delegated access to manage our workstations OU tree from the top down. We must create a folder called ComputerNames on the WDS server and share it with the same name, granting DomainUser certain privileges to it (share with "Authenticated Users">"Full Control" only and grant NTFS permissions). DomainUser is denied interactive logon or Remote Desktop logon rights through domain-level Group Policies, and cannot change its own password. This section in the config file calls a "wrapper" batch file (this is needed to stop users from clicking away the password prompt). The file is found in the root of the ComputerNames share and is as follows: @echo off start /b /w \\ServerName\computernames\getname.exe if not exist x:\getname.run exit 1 This ties in with some code from the main program, GetName.exe, which was a batch file compiled into an encrypted executable that asks for a password when run (this is to prevent users from randomly re-imaging workstations at will). The tool to compile the batch file in this way is here: F2KO Software | Bat To Exe Converter GetName.bat's source code is as follows: @echo off echo. > x:\getname.run for /f "tokens=3 delims== " %%i in ('nbtstat -a %computername% ^| find "MAC"') do set mac=%%i if exist \\ServerName\computernames\names\%mac%.txt goto :cipher :name set /p compname=Please enter the workstation name: if not %compname%. == . echo %compname%> \\ServerName\computernames\names\%mac%.txt & goto :cipher echo You must enter a workstation name. & goto :name :cipher if exist \\ServerName\computernames\names\%mac%_cipher.txt goto :eof set /p cipher=Please enter a boot password (or press Enter to skip): if not %cipher%. == . echo %cipher%> \\ServerName\computernames\names\%mac%_cipher.txt So the wrapper checks for the .run file that indicates the password was successfully entered and the batch code has begun execution (so users can't click the password prompt away). X:\ is the RAM disk mapped by the WDS deployment image. On the back of that, you need to edit the .wim file for your WDS deployment image and add an empty file called DisableCMDRequest.tag to \Windows\Setup\Scripts (if that folder structure doesn't exist, create it). If you don't do that, a malicious user could press Shift+F10 to access a command prompt during this stage of deployment. We then identify the workstation's MAC address and check whether it has already been "registered". If it hasn't, we prompt for a name and write that back to the server by creating a .txt file named after the computer's MAC address. This file contains a single line, which is the name we prompted for earlier. These files all live in the Names folder, which is inside the ComputerNames share, to which DomainUser has normal read-and-execute permissions plus "Create files/write data", "Create folders/append data", "Write attributes" and "Write extended attributes". Administrators and SYSTEM have Full Control. No other access is granted. We know from WdsClientUnattend.xml that we are running this command as DomainUser, so the check for existing files and the subsequent write-back will be successful. So, our structure under ComputerNames is: Names (folder with special permissions for DomainUser) GetName.exe (control program) GNWrapper.bat (wrapper for security) We also check whether this workstation should auto-encrypt (we only do this for staff laptops but naturally it's the same imaging system). We apply the same principles and check whether a file containing the encryption password exists (which will be MACAddress_cipher.txt). If it doesn't, we prompt again and add this file, unless the input is null in which case we skip that step. Note that only the DomainUser account can access the storage folder so this is reasonably secure although they're stored in plain text. If we ever want to change a pre-registered computer name or encryption password, we search the storage folder with the "file contents" option on, find the right file(s) and either edit or delete them (which only happens very occasionally). We then proceed with image selection normally and the workstation receives the image and reboots. When it does so, we need to include a script to fetch our information again and apply it, so in the ImageUnattend.xml file for the image, we include this section: psexec -accepteula -is cmd /c c:\windows\system32\renamecomputer.bat Set computer name and join domain 1 true So this will run a script called RenameComputer.bat that we include on the image before we SysPrep it. We must also have installed the drivers and executables for DiskCryptor, which can be found here: Main Page/en - DiskCryptor wiki We need PSExec from SysInternals too, which I always include on my images due to its immense usefulness for running programs in the SYSTEM context. Frankly, I can't remember why there's a need to run this script as SYSTEM, but I'm sure there was a reason. On the first startup after imaging, RenameComputer.bat will then run. It looks like this: @echo off del c:\windows\panther\unattend.xml for /f "tokens=3 delims== " %%i in ('nbtstat -a %computername% ^| find "MAC"') do set mac=%%i net use \\ServerName\computernames /u:DOMAINNAME\DomainUser DomainPassword for /f %%i in (\\ServerName\computernames\names\%mac%.txt) do set newname=%%i if not exist \\ServerName\computernames\names\%mac%_cipher.txt goto :rename for /f %%i in (\\ServerName\computernames\names\%mac%_cipher.txt) do set cipher=%%i cls :rename echo Renaming computer... net use \\ServerName\computernames /d reg add HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce /v DeleteRename /d "cmd /c del c:\windows\system32\renamecomputer.bat" > nul reg add HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce /v JoinDomain /d "netdom join %newname% /domain:domainname.local /userd:DomainUser /passwordd:DomainPassword /reboot:0" > nul if defined cipher dccon -boot -setmbr hd0 > nul if defined cipher dccon -encrypt pt1 -p %cipher% > nul netdom renamecomputer %computername% /newname:%newname% /force /reboot:0 > nul First we delete the locally-cached copy of the Unattend.xml file to make sure no serial numbers, usernames/passwords etc are exposed. We then find our MAC address, connect to the imaging server and look for the .txt file with a matching name, and read that file to determine what our name should be. We carry out the same process with the cipher .txt file, if it exists, to determine whether or not we should encrypt and what the startup password should be if so. We then set the new name, which will not apply until we restart, and carry out full-disk encryption if we need to (this will take considerable time on systems with larger disks so factor that in, while also remembering that we will now need the startup password for each subsequent boot throughout the imaging process, so only use this auto-encryption when you need to). Our final action is to set RunOnce Registry commands for the next reboot to firstly delete the RenameComputer.bat script (as it includes domain credentials), then join the domain with the new name. These Registry entries are removed automatically by Windows once they have been executed, so our DomainUser credentials are not present on the finished build. That's pretty much it. Naturally you can remove all encryption-related components of this entirely and it will still work. I've incorporated scripted encryption because it means I don't have to manually install and go through TrueCrypt full-disk encryption on all staff laptops (and I only ever have one or two of those at a time in my office so I can step in with startup passwords as necessary). We never encrypt our desktops around the school, so these are truly automated. New machine: boot, enter password, provide name, walk away.

Cheers. 'Tis true, the BTEC ND in IT group that some of my friends were in years ago was, shall we say, very diverse. A few people who really wanted to get into IT as a career, but the rest were just dossing or couldn't decide what to do yet. Having said that, I did recommend a course like the BTEC to a young lad in Year 9 asking about career routes for IT the other week. I said to take Maths, Business Studies and IT for Options, then do a BTEC ND at college and progress to a BSc Applied Computing or an FdSc Enterprise Computing at uni. That's assuming he'd have to go all the way down to academic route without getting a job to kick off the experience chain in the middle.

Key to life! =]

Meh, I only mention it because there was this one woman whom I managed to somehow offend by saying something like the above... maybe I just phrased it wrong (or was drunk, or both). Besides, you've got nearly 10 times my post thanks so I doubt you're not getting anywhere =]

I know this thread is for the ladies but I'm bored so thought I'd throw in a musing. I also wanted to ask the ladies if what I'm about to say sounds sexist. Advance tip: it's really, really not meant to. I tend to find that the women in IT are damn good. My musing is that, sexism aside and just looking at the statistics, it's pretty much a male-dominated field. I'm inferring from that that if you want to make it in IT as a woman, you have to be really good, so the ones who do make it, are. I've seen a fair few guys who make me wonder why they're in IT... but I've never actually had cause to think that about a woman. Am I about to get roasted?

Our remote access provision is based on Win2K8 R2 RemoteApp. For home access they have a local admin account with its own Start Menu for local apps; if they need school apps/work, they log onto RemoteApp from there and run them seamlessly or use a full desktop session (trying to get people to run more seamless apps ATM). The local admin account is generated on auto-build through scripting. Staff usernames are their three-letter initials, e.g. ABC, and laptop names are LAPTOP-ABC. During the initial build, the laptop parses its own name and creates a local admin account based on the string after the dash (pulling in the AD details for the user's full name). The C:\Users\ABC folder is then shared, and when they're on the network that share is mapped to K: and called Local Work, so they don't have to switch back and forth while at school to access work done at home that they haven't uploaded to a fileshare yet (or aren't going to). Interestingly, you can't share \\localhost\Local_Work for some reason, but you can share \\127.0.0.1\Local_Work and then use a label when mapping the drive in GP Preferences so it doesn't look ugly.

We have a single redirected Start Menu and I then set permissions on various shortcuts / folders of shortcuts. Because we have Access-Based Enumeration enabled on our file server, users can only see what they have access to, so the pupils won't see e.g. the Staff Tools folder, or Office Tools. Another example is the Subjects --> Pastoral folder, in which we have a link to the PASS Survey that all can see, plus another link to the PASS Management tool that only staff can see. The pupils see one, the staff see both. ABE is great for things like that, but be aware it does carry some overhead. If you use DFS, you can enable it on a namespace like this: dfsutil property abe enable \\ As for the Start Menu being unavailable when users are off the network, I suppose that will vary per school but once you have site-wide wireless and remote access in place, everyone should be on the network anyway.

New thread based on the above started here. Updated debate link here.

As long as you don't need a gateway or RemoteApp...

I use iTap on the iDevices and "Remote Desktop Client" on Android; both because they support TS Gateways and RemoteApp.

Right, thanks.

Okay then, thanks anyway. How does the sidebar thing work out of interest?

*Sigh* You absolutely will not get the full implications of this until/unless you read the whole thing. The reason I like this debate is because it includes perspectives from a very wide range of people with differing attitudes and approaches. This key to the issue is this: Do we: a) Teach our children at school while protecting them from as much as we can within that context; Or b) Protect our children at school while teaching them as much as we can within that context? The point of the discussion, when distilled down, is that while ideally we might wish to do a), in fact the current legal climate (Law of Contract, Law of Negligence and H&S Law) mandates that we do b). This is not going to change until we can alter the applicable laws to be far more edu-friendly. That, in turn, will not happen until a big enough group of people get behind the issue and force it through to Central Government (Local Authorities can do very little here). You're right, Steve - we don't forbid the use of rulers because one child could misuse it to the detriment of another. But, if you read through the whole debate, you'll that that's actually quite a different case. The ruler can only be misused within the sight of the teacher - which is not to say they'll always be looking - but at the end of the day it's possible for that abuse to be intercepted. Now consider cyberbullying by text as I refer to it in the debate (in case there's any confusion, I started it). Cyberbullying in a busy BYOD classroom is completely invisible, with abusive and threatening messages of the nature that have caused children to self-harm and kill themselves in the past (please see the Virtual Violence 1 and 2 reports) being sent instantly and untraceably in a flurry of teenage thumbs that would confound a teacher watching from afar to distinguish it from "sanctioned" use of the device. We see then that, in this case, it's entirely IMpossible for the abuse to be intercepted - legally, this is a very different kettle of fish and a massive new problem under current legislation. Essentially, what the law actually says is that, no, this idea of "limiting the risk" that most educators seem to have got into their heads is in fact nowhere near acceptable in some scenarios. This is where the legal problem comes in: the only comparable scenario that we can determine is inappropriate notes being passed in class, but even that must be done physically and can be detected and intercepted by the teacher (at least in theory) - so that won't wash. So what about when that's not possible? When we knowingly (we would be deemed in law to have known) introduce a technology that, intrinsically and by its very nature, precludes the ability for adequate human or electronic monitoring to take place? In H&S Law this would be referred to as a hazard, and if we knowingly introduce one while KNOWING we can't supervise it effectively we fall foul of the Law of Negligence. This is all outlined in the debate. The point is that I can see the educational benefits and I think we will end up using them as a matter of course, but we should only do so ONCE the legal climate is ripe - not before. The debate highlights the areas in which changes would need to be made to support these new high-technology initiatives, which we should do now rather than waiting for the first teacher's career to be destroyed in the process (see in the debate the references to the Art teacher whose career ended after she failed to perceive the danger of thin paintbrushes being used to paint on the floor, with the result that a child was brain-damaged after a brush ended up going through their palate). Action is needed now, before a child is damaged and/or a teacher's career is destroyed. For that to happen, we need to start by accepting the situation as it is before we can change it. The debate I have linked to should be read within that context.

For anyone working in a school looking to introduce mobile phones into the classroom, please see this: http://www.middlewichhigh.cheshire.sch.uk/user/59/161489.pdf I know it's a lot to read but it does highlight some legal issues in this regard. Please PM me for the context of this if you are unsure. Any comments are welcome too.

Hi all, HAP+ looks as if it should be able to consolidate a number of services into a single portal for us, which I'd welcome. However, I'd rather avoid publishing individual RDP files when I've already got RemoteApp to generate them on demand (for example). By default, "Remote Apps" and "My Emails" link to our RDWeb and OWA pages respectively. Could there be a way to pass through the login credentials of the HAP+ user to both of these services such that when one clicks on "Remote Apps", one is not prompted to log in again through the RDWeb form (same for OWA)? Most of our settings are at default, save for configuring the available mapped drives according to our environment. I'm also wondering how to achieve this: Where is this "sidebar" menu and is it passing things through as above? Thanks, Ephelyon

Similar here.

I'd want to know. Accountability is paramount and the Network Manager's ability to secure that for the school is key.

How can you track it on the guest network without auth?

True, but there's the legal side too: it's good to be able to show you tried, or more specifically that you "took all reasonable technical measures". It doesn't always work, but showing willing in that regard closes off one avenue for Negligence: that of not even thinking of the hazard. You could still be Negligent in other ways, but at least if something did happen and it was traced to some kid "hacking" (obviously a slight exaggeration) then that would factor into the equation. But if you were shown not to have even tried because you thought it would be pointless, you wouldn't be able to use the defence of having at least attempted to reduce the risk to As Low As Reasonably Possible.

What about during? If it's a day the kids are in and somebody gets on the wireless and starts accessing Facebook/Twitter because the external people can... and then there's an incident of cyberbullying... it's on your head. In light of the above, if you're going with the auth by location option I'd definitely make sure your SLT link knows about it too.

I'd keep it the same but create an internal SmoothWall account rather than AD and give everyone that - then you know it's them and not some random kid who's worked out they can get on the WiFi now (and therefore to Facebook if it's not filtered!). Username: teachmeet Password: awesomenetwork Or similar...