Bruce123

We had this problem when the AV software on the server was configured to "Block Tracking Cookies". Disabling this feature resolved this issue. But I would also check the AV on the desktops. Thanks, Bruce.

If you are an FE/HE College (i.e. ac.uk domain) then ja.net provide them for free (as many as you want). I know that most people here are working at Schools, but I know there are a few FE techs on here...

We are planning to implement DPM 2010 to backup our mix of 2003/2008 2008R2 servers (some virtual on Hyper V) to 4 NASes. We have purchased QNAP 509 NASes for continuous backup and was planning to use iSCSI as the technology to allow the backup server to connect to the NASes. What other options are there, can it backup to UNC on the NAS? Does anyone know whether the backup of a physical server can be restored directly into a Hyper-V host as a VM, as I can imagine this being a very powerful DR feature? Does the support of bare-metal recovery automatically mean that this is possible in a given scenario? I learnt from a post in another thread that DPM2010 doesn't support bare-metal recovery for Win2003, which presumably implies that backups done using it cannot be imported into a Hyper-V host? I wouldn't trust online backups as the only backup type as it won't protect you against viruses and worms destroying all the backups on the NAS. So we would like to do a full backup once a week to removable storage, does DPM 2010 allow this? As I understand it it can but not to USB HDD, but using a third party software, you can get it to do this? The other option for this is the NASes allow you to backup the entire contents to a extenal USB HDD (by pressing a button on the front or on a schedule). Any advice or ideas is much appreciated Thanks, Bruce. Leeds, UK.

Just to update everyone, the problem was caused by a problem with AAT's Secure assess server (and affected tests across the country), rather what way we have our network configured. Thanks, Bruce.

Something I've not really seeen talked about on these forums, which is surprising... What policy do you use for applying MS updates to servers and desktops? Do you auto download and install all critical and security updates to servers? Sounds like a reasonable compromise. But what about the other updates, how do you decide which to apply and when? And how do you deal with updates that have an unwanted affect? What policy do you have for desktops? My main concerns are to make sure security and critical updates don't get missed, but I am unsure of what is best practice on this and the other updates. We use WSUS on Windows 2008 Standard to push out updates. Thanks, Bruce.

Hi ict_Support, I'd be very interested to hear how you set your WFS709TP for open access WiFi (authentication via a portal). Was it very complicated? Thanks, Bruce.

We do something like that: My Documents -> H:\system\my documents Desktop -> H:\system\desktop and on some users accounts we also redirect cookies and application data to H:\system\Cookies and H:\system\application data Where H: is is the user's home drive. I know that MS docs refer to the possibility of a home drive not mapping in time for the redirection to take place, but we've never had a problem (in WinXP and Windows 7). However, as you discovered, Folder Direction in Group Policy doesn't allow you to specify a network drive as the target (only UNCs with/without env variables), so in order to implement this we had to create a custom administrative template and import it into a Group Policy object (which affectively changes the same registry setting you referred to, for whoever it applies to). But this could probably also be achieved equally successfully using the Registry part of the group policy object. Personally, I think it is preferable both in principle and in practice to store all of a users user's data in one location (e.g. in their home folder), rather than storing their roaming profiles within one root share, homedrive another and redirected folders yet another, as I recall being advised in MS documentation I saw a few years back (e.g. \\server\users$, \\server\profiles$, \\server\redirected$). The reason why you have to restart explorer.exe for the shell folder changes to take affect is because the actual shell folders that are used during a session are stored in another registry key: HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr entVersion\Explorer\Shell Folders. What happens when explorer starts is that it looks in User Shell Folders (which may include env variables e.g. %profilepath%\...) and expands each shell target to an actual physical path (e.g. c:\documents and settings...) and writes these values to \Shell Folders, and these are what are used. So if you attempt to modify User Shell Folders mid-way through a session, then these won't actually take affect until explorer.exe is restarted, e.g. you logoff and back in again, but once that's done, it shouldn't need doing again for that user as the User Shell Folder settings will now be stored in the user's local/roaming profile. But... if you use mandatory profiles and attempt to change these values in the logon script then you may have a problem as explorer.exe will probably start before the logon script is complete, resulting in your values being completely ignored. If this is the case you may find that putting these changes in the Registry section of the of the Group Policy may resolve this particular issue, but we got around by using the custom admin template. It might sound like I know a lot about area, and that because I did a lot of research into how it all works around 3-4 years ago, before implementing system I referred to at the start of my reply.... If you'd like a copy of our custom admin template just let me know, but to be honest, they are pretty simple to create. Good luck with it Thanks, Bruce. Leeds, UK

ISA 2006 (and BT webfilter for web filtering). I would say flexibility is an advantage with ISA 2006 as you seem to be able to do anything and there are wizards for MS servers (like OWA), Disadvantages? Overally complex may. 2nd hand; consultants have mentioned glitches that they have not been able to resolve (solution re-install!). But I've not had the chance to try any others, so I can't speak with any authority.

Evening all, Do your users access the Internet via a NAT routed connection or application layer proxy? I ask because we have always provided Internet access to learners and staff using the HTTP proxy (on ISA 2006), rather than a NAT routed (layer 3) connection. We configure Internet Explorer with the address of the proxy server through group policy. I think it helps with security as it makes it that bit harder for malware to connect out. However, this evening I was providing support for an online assessment (AAT Accounting which uses something called secure assess). Secure Assess basically wraps up IE and removes all the buttons to make it secure from users tampering; the actual assessment uses Flash, and connects to AAT's server via our proxy. It all started off ok, but 45 minutes into the exam I got a call from the Invigilator to say that there was a problem and the problem was that the online assessments had ground to a halt, they all stopped at the end of section 3 and wouldn't progress to section 4. But the candidates did comment that it was gradually getting slower (e.g. typing into a box). In the end we had to abdandon it altogether. We had just installed the lastest Flash (10.1) via group policy last week, so it could be related to this. It could also be a problem with AAT's server (I will ring them tomorrow). I tested connecting various websites and it was fast (it would be being the evening) and Flash sites worked fine. Anyway, It did get me wondering if having having online exams run via a proxy might be adding an extra layer of complexity; although for web browsing it has been fine. One concern I have about routed access to the Internet is whether the webfiltering would work (this is a product called BitStream webfilter which integrates with ISA2006). Another one is in order for our routers to be aware of the NAT routing (route out to the Internet), would I would need to add a static route to a router, and would this automatically get propagated to the others? We use automatic routing discovery on our 4 routers, but I can't recall off the top of my head which protocol we use. And is ISA able to authentic users with ADS if they are using a NAT routed connection? An issue we've been having (which I probably should not just tag to this email) is students when accessing the Internet are sometimes prompted to enter their credentials from our proxy server, like it sometimes has issues with authenticating users via ADS. Thanks for any advice / suggestions. Bruce. PS Forwared from Networks, when I realised that this was a more appropriate forum!

Hi everyone, We have had an intermittent problem for a while where if a user changes their password when prompted at logon, their profile doesn't download and they end up with a default one. There is no error message (or event) to indicate a problem. Usually, if the user logs off and reboots the PC and logs back in it resolves the issue. But we have had some instances of staff losing their profile altogether (and all their IE favorites to boot). Does anyone have any experience of this problem? Logically it would seem to relate to a timing issue. When the user changes their password, it gets updated on the DC, but how quickly does this change get to the member server where the user's profile is stored? Does this change even need to get to this server? Our domain is still operating at Windows 2000 native mode functional level; but all our DCs are now on Windows 2008. So I am thinking that raising the functional level to either 2003 or 2008 might resolve this issue; due to more efficient ways changes to ADS get replicated/communciated. Any ideas? All our clients are Windows XP. Thanks, Bruce. Leeds, UK.

Hi, I was just wondering how other people map network printers on a PC room basis (rather than user basis)? We've been using vbscript logon/logoff scripts which look at the name of the PC to determine which room it in and then maps to the printer in the room, as sets it as the default. The printers are network printers and there is a shared printer setup for each printer on the server. But I noticed that MS describes another method for deploying printers on a compuer basis, whereby a printer deployment exe is placed into the startup script of a GPO and a printer management app is used on the server to setup groups of computers. The book I was looking at was for Windows 2008 R2, but I understand that this method was introduced in Windows 2003. What method are people using at their College/School? And how well does it work? Thanks, Bruce. Leeds, UK.

I was surprised when I read your post, as I'd already seen this on their website. System Center Data Protection Manager: 2010 Overview Continuous data protection of Windows application and file servers to seamlessly integrated disk, tape, and cloud — with support for a growing list of Microsoft technologies, such as: •Windows Server from 2003 through 2008 R2 If the product can provide system protection from 2008 and 2008 R2, but not 2003, then I think that should have made this clear on their website. I'd assumed that because 2003 was listed it could provide system protection for it. A real shame that, how many Schools/Colleges have upgraded all their servers to 2008 yet? Bruce.

Didn't spot that it had a 5pm deadline the ad, even so... Deadline now extended to the end of this week, please send me a private message if you are interested.

Hello Edugeekers, a new opportunity has arisen for: An IT Technician, working evenings Mon-Thurs, 20.5 hours per week. Employed at a multi-site College in Leeds. £16,110 per annum pro rata Please see job spec for details IT Technician A good opportunity for someone who doesn't mind working evenings (providing support to staff and students a like) Deadline today! (sorry) Bruce.

Thank it's reassuring that you use DPM 2010 to backup to a NAS over a network and it works satisfactorily. The throughput of each WAN link is around 40-50Mbit (measured by transfering a file), which doesn't compare too badly with FastEthernet where I guess you'd expect to get around 70Mbit. The central site is connected at 300Mbit, which allows the other 3 sites to connect in at 100Mbit at the same time, without a bottlekneck. As far as I know, the WAN links aren't resilient to the extent of having a failover link. The NAS I'm looking at has iSCSI and the salesman (at CCL) suggested that this geatire could be useful for backups and I believe that it also has USB connections to allow a simple backup from NAS to USB HDD. I am thinking that setting up RAID5 on the NAS will improve performance and fault tolerance, as I doubt we will need the full 6TB. But I don't know how far you'd be able to go back for restores. As regards to prioriting traffic (lowering it for backups), I could do that on the router using the IP addresses of the NASes and lowering the priority on packet with this source/destination addresses. But i'd still be concerned about DPM using precious bandwidth on our new WAN links, for backups during the day. Can DPM not be configured to do backups out of hours? How easy did you find DPM 2010 to setup? I just wonder if we need to pay for assistance to help us set it up, but I wouldn't want us to pay for consultancy unless it is absolutely necessary. I think I may also need to up the number of server backup / enterprise licenses from what I orginally estimated (more SQL server installs than I realised), Thanks, Bruce.

The main site has around 600GB (including the virtual HDDs on the Hyper V host). The other 3 have around 200GB at each. Total 1.2TB.

We are planning to replace our current backup system(s) with something more suitable. At the moment we use a combination of BExec 9 (dates back to 2003), Windows 2003 backup, Windows 2008 backup, robocopy and a script. For media we use 1TB and 320GB USB HDDs. Most of our backups are differentials (full at weekend) and we have 5 Friday drives. Backup USB HDDs are transferred each day to a fire proof safe located at a different site. But can sometimes cause problems, especially during holiday periods. We have 4 sites and the connections between these sites have recently been upgraded to 100Mbit (from 2Mbit). The opens the potential for backing up over these links to NAS. But I my knowledge of backing up to NAS is very limited. I have looked at a QNAP unit which has 6 SATA bays (up to 6TB). One option is to use two of these, where 3 sites backup to a NAS at the 4th site, and the 4th site (where most of the data is located) backup up to a second NAS at one of the other 3 sites. My main concerns are: Whether we have sufficient bandwidth to backup the data over the links. The whole concept of backing up to online storage. Potential for hacker to delete the backups (although we could do regular transfers to USB HDDs for archive). How is this viewed or addressed? What is accepted practice. The most appropriate backup software (looking at Microsoft DPM 2010), but feedback I have seen suggests it is far from perfect and can be difficult to setup. I would prefere BExec 12, but we have 34 servers (although around 7 are due to be decommisioned soon), but that still leaves 27, and at £300 agent lisence per year, it would be very costly. Any advice from anyone in the educational sector (or otherwise), would be much appreciated. Many Thanks, Bruce. Leeds, UK.

We are looking a providing an open access wireless network to enable our learners to bring in their own laptops / PDAs and connect to the Internet using our Internet connection. It is something that they have been asking for, and would also help balance the demand with the availability of our wireless laptops. I wondered whether anyone already has facility in your school/College and if so, how it was achieved? Did you allow the laptops direct access to the Internet (via NAT routing) or did you use the Web proxy auto discovery protocol? I would prefere the first option as it removes the complexities of having to get the "proxy server : port" into their browsers, and potential issues if this configuration remains when they try to access the Internet using their own connection at home. Or should either of these be serious concerns? The problem with the former is that on our network the clients have always accessed the Internet using IE with a proxy server (ISA 2006) and have not needed or been granted direct access to the Internet (i.e. via NAT). So we would have to set this up for these laptops and enable resolutuion of DNS external addresses, which also was not required previously (done on by the proxy server). How have you dealt with authentication? My thoughts are to leave the wireless network open and and have the students logon to a webpage to gain access to the Internet (802.1X and webpage)? How have you done this? We have Wireless Smart Switches - WFS709TP for central managment of our wireless network, so setting up an additional SSID assigned to a new VLAN should be easy enough, and we can point this to a 802.1X server for authentication. How have you done this? Have you permitted users connecting in this way access to other services on your network (such as printing and a full Terminal Service connection)? Have you restricted access for this clients at layer 2/3, and if so how have you done this? Any advice is much appreciated. Thanks, Bruce. Leeds, UK.

It may not be the cause of your problem; but I have noticed that Windows 2008 will remove any shares if when it boots up it find that a folder that a share point to no longer exists. I don't belive that Windows 2000/2003 behaved this way. It makes sense though in most situations, as on Windows NT/2000/2003 you could potentially end up with a server containing many shares that don't point to anything anymore (taking space in the registry but not actually doing anyway). I just wonder if in your case there is problem with Windows seeing these folder immediately after booting. Bruce. Leeds.

We added this to our annual MS Campus renewal as a quick decision in the Summer, after seeing a few posts that it was good and relitivley cheap (on here I think), but I haven't had a chance to set it up yet. At the moment we are running Veritas Backup Exec (I forget which version but bought in 2003) on older servers and a combination of msbackup, robocopy, and a script to backup Hyper-V VMs. We obviously need a unified solution, and before adding DPM to our agreement, I also looked at BackupExec (presumably needed new version and new agents but it looked very expensive at £300 per agent and their educuational pricing didn't seem very good/non-existant). Having read this I am a little concerned that DPM it won't meet our requirements. Bruce. .

I would start by looking for a "loop back" somewhere (where a network cable goes out of one port on the switch and back into another). One reason why you're seeing DHCP (presumably client request) floods might be that it will be one of the first broadcast protocols to initiate on a network (first thing when the device is turned on), so if there is a loopback somewhere this is the one which will get amplified by it and show up on wireshark. Having eliminated this, I would then look for a faulty device as a secondary option.

Ordinarily it would because folder redirection would normally be to UNCs, but this isn't the case when folder redirection is to a network drive. I think the logic is that a drive letter could be mapped to one location one day and another another day, so it wouldn't have a clear idea of where to locate the recycled files. If you do recycle a file from a UNC or directed folder to a UNC, where does it move the file to? I'd always assumed that it was to the recycle bin on the PC, but from the thread that you referred to it implies it moves it to the server somewhere?

One problem with this is that if a user deletes a file, it does actually delete it rather than sending it to the recycle bin, and I think that this because this is the standard bahviour when deleting from a network drive, rather than from a UNC. Summary: My Documents -> H:\system\my documents + ACTION Delete from My documents = File Deleted after confirmation. My Documents -> \\servers\user$\my documents + ACTION Delete from My documents = File sent to recycle bin! I would prefere the latter...

We redirect Desktop to a folder within each user's home drive, and it seems to work quite well (been doing this the last 3 years). You have to redirect it somewhere (telling users not to save on the desktop is a none starter), and I think that it's much better to store them within their home drive rather than a different structure entirely. Thereby keeping all of their files within the same top level %username% folder. The idea of having a seperate structure for redirected folders (as MS used to recommend, I don't know what they say now) seems a bit mad to me. All users have a folder within their H: drive called system (H:\system) And within there we have all of the redirected folders e.g. H:\system\my documents, H:\system\desktop, H:\system\cookies, H:\system\application data Within group policy you cannot include a network drive within the redirection path (e.g. H:\) and I had conflicting information on whether %homepath%\system would work, so in the end we created our own Group Policy admin template, which by-passed the folder redirection section and allowed us to change the appropriate registry values directly (Current User/Software/Microsoft/Windows/Currentversion/Explorer/Shellfolders or similar), and this allowed us to specify any string for the path. One potential issue was that H:\ obviously needed to map early on in the logon process as Windows needed to look there for the physical location of the shell folders, but as it transpired this was never a problem, it must map very early on. NB: We are in the process of "undirecting" Application Data and Cookies, just leaving My Documents and Desktop redirected. We had issues with redirecting both, which weren't immediately apparent. Regards, Bruce. Leeds, UK.

You're better off using a script, all it needs to be is one simple line in a text file saved with a .bat extension and added to the domain logon script. Simplez. You could setup the entire thing in 30 minutes. Type this into Notepad: @echo %username% logon %computername% %date% %time% >> \\server\hiddenshare$\%computername%.txt Save this as logon-logon.bat, add it as a domain logon script, create a shared folder on the server for the logs giving it read/write permissions for all users.