Bruce123

What are people doing with their old OHPs (which nobody uses anymore)? Bruce.

We've done some limited testing of Windows 7 running on our oldest hardware (which happens to be 1.7Ghz and 2.4ghz P4 1GB RAM). It seesm to run well, apart from one thing... no driver for the onboard Intel graphics. Unless this is resolved, it may actually scupper the option of installing it onto the 180 PCs which are are this spec in Summer 2010. Does anyone have any opinions on this? I don't think it's worth upgrading these with better graphics cards. We have to hold on until we can afford to replace them. Thanks, Bruce.

WAN link upgrade options. Does anyone have any experience of BT's LES100 (100 Mbit "point-to-point") for WAN connectivity? Or does anyone have any experience of NTL:Telewest's (part of Virginmedia) Metro VPN any-any product ("cloud topology") or their "point-to-point" product? We are going to upgrade the 2Mbit links which currently connect the 4 College sites together (in a star topology with one site at the centre). The sites are within a relatively small geographic area (each is less than 25K apart from another). Using BT's product it would remain a star topology, but with Virgin's VPN any-to-any, it would be more like a "mesh". Unfortuantely, one of the site's isn't within Virgin's coverage so would be provided by Openreach and interfaced into their network, but would form part of the overall package from Virgin. Ordinarily we'd need a router to be installed at each site, as each site has its own subnet. But Virgin suggested using Layer 3 Cisco Switches instead (to reduce cost). Has anyone any experience of this? VoIP would be prioritised using COS flags, in either case. Quoted install costs are subject change depending on a survey (which only happen once you have agreed in principle to going ahead with a provider). Lead times seem to be 60 working days (3 months). Any info (particularily if you have experience of either of these WAN options), would be appreciated. Thanks, Bruce. Leeds, UK.

As far as I know, the two programmes are funded/administered very differently. With the Building College's for the Future programme (2001-), College's were asked to put forward proposals (e.g. for a totally new building or a rebuild/refurb). Some College buildings were in a dire state after historical underfunding compared to Schools, so some programme to improve facilities was (and still is) essential. The LSC would then assess it and approve/modify/reject the proposals and agree to pay for a certain proportion of the cost (e.g. half). The rest would be normally be born by the individual College (e.g. through the sale of land, or the loan from a bank), and perhaps one or two other public/private bodies. As I understand the BSF programme for rebuilding schools (which I know little about), most of this is funded through the PFI. A great way (or an Accounting trick) to get money pumped into upgrading building/facilities without putting the treasury's budget into the red, but where we will all pay for it (several times over) decades down the line. The LSC will be disbanded soon, and the responsibility for the on-going funding for 16-19 year students will move back to the LEAs (as was the case in the 90s), so perhaps the two Capital building programmes may merge to some extent. Who administers the BSF prgramme, or is it not centrally managed like the College building programme was? The main thing that surprised me about the Capital Buidling program defecit, was the size of the gap between grants that they agreed to and how much money they actually had. I mean, how can anyone possibly end up agreeing to pay £2bn (£2,000m ) more than they had??! Do they not own a calculator? This recent report recommended that the Goverment assess the risk reocurrance of such problems in DIUS (and presumably other departments.) There were also some other deficiencies inherent with the programme identfied in the previous report, the fact that it was "demand led" meant that it depended on Colleges to ask for money, and there was no national/regional assessement/analysis on the basis of need. The LSC were in the news again for the wrong reasons in the last 12 months; those related to serious problems with the EMA programme and the SATs results (both subcontracted after a tendering exercise). Regards, Bruce. Leeds, UK.

I wouldn't be confident that 802.11n would have a throughput to match the 100 BaseTX (100Mbit Ethernet). With 100Mbit Ethernet you'll probably manage to get an effective throughput of 70-80% of the quoted bandwidth (i.e. 70-80Mbit). My experience of wireless is more like 50%, so 802.11n would have to be operating at a 160Mbit theoretical to outperform a 100Mbit port and cause a bottlekneck on the port. And don't forget the backplane of a 100Mbit Switch is much more than 100Mbit, so a bottlekneck there is unlikely. However, it would certainly be advisable to have at least one 1Gb port to link the Switch to other Switches (such as the Switches that have the servers connected to them), as you could end up with a bottleneck there if you connect it to the other switches on 100Mbit. Has anyone see any throughput tests of 802.11n, which could confirm or refute this proposition?m I.e. are throughputs of over 80Mbit achievable? Thanks, Bruce.

I think we are on version 5.x and would have to pay again to upgrade to version 6 (since it is a major rather than minor version change). One issue is we had with version 5 was that it wasn't very "user" aware (i.e. it doesn't really understand user and groups in ADS). One consequence of this is that you couldn't specifiy that someone using the control software shouldn't be able to monitor/control the PC if a member of staff was logged in. However, AB Consulting did advice us on a solution to this, which we have implemented. Another issue was that the logging (Internet access logs) could be read by any user as long as they knew where was stored on the PC. And I don't think there is an easy way to setup a central blocked list or policies. Finally, it was too easy for students to unplug and plug the network cable to stop a teacher from monitoring/controlling a PC (NB this was reported to me but I don't know if it was an issue if autoconnect was enabled). I don't know whether these issues have been fixed. Other than them I feel it is a useful software, and just as good for postive use (i.e. demonstrating software with the Show/Demo feature), as opposed to locking the mouse/keyboard etc. Thanks, Bruce.

I've put quite a lot of work into reducing any unnecessary load on the WAN links, in order to improve bandwidth for when it's needed; Setup a system which looks at where students logged on the most during the past week, and automatically moves their H drive contents / roaming profile to the site where they are most logged on. There are two DCs at each site; so accounts/GPOs/scripts are replicated already. Setup folder redirection: My Documents/Desktop for all learners and My Documents/Desktop/Cookies for all College staff. For some staff setup what I call a distributed roaming profile (using DFS/FRS) so that a copy of their profile is stored on a server at each site, which for the most part works fine for these users. Using DFS/FRS is good in theiry, but it is not feasible/suitable for much of the College data for following reasons:- In some/many circumstances it can actually result in additional load on the WAN, rather than less (e.g. when data is replicated across to sites where it may not be used, or when a recync of large ammounts of data takes place) The increase in storage capacity that would be required (for each item of data that is replicated the space used would multiply by a factor of four). It cannot be used on shared drives (as in group drives) due to consistency issues; a lot of our data is is stored in drives which are accessed by multiple users. Although it is supposed to improve fault tolerance, I have found it to be quite unreliable at times; and it can be a right pain to fix if it stops working. Adds an extra layer of complexity to the network, which requires technical knowledge to maintain and to fix. I had similar thoughts about making extensive use of DFS/FRS to help resolve the bandwidth issue, but I just don't think it work in practice, sometimes there is no substitute for having physical bandwidth. I still considering setting up a TS Server so that staff could RDP to that rather than logging in with their own account locally. However, good bandwidth would still be required in cases where a USB memory stick is used to transfer files to/from the PC and for printing (which are both common ocurrences on our network). Many Thanks, Bruce.

Yes, thanks, Bruce

I was looking at a subnetmask of 255.255.0.0. We don't actually need 65K IP addresses, it's just that /16 is the next step up from a /24 range, which we are on. One other reason for totally changing the range (which I didn't mention) is that some MS software considers our range as "external" to our Intranet, presumably this is because it isn't within any of the private ranges specified in RFC1918. But I'd really prefere to not change range just yet, as I have a feeling that it get really complex and time-consuming, but we may have to. Thanks, Bruce.

Our College has 4 sites in South Leeds; there is one central site and the other sites each connect to it using 3x 2Mbit BT MegaStream links (I'm guessing he underlying technology is framerelay). With expansion over the past 10 years the slow performance of these links are beginning to have a detremental impact on the network and the users/applications. Each site has over 100 PCs/and around 100 staff/students at one time (sometimes more / sometimes less), the LANs operate at 100Mbit, I don't believe these is a serious problem with the speed of the LANs. We base staff files/roaming profiles on a server at the site they spend most of heir time, but inevitably quite a lot of staff need to logon at different sites various times of the week (e.g. lecturers and student support), and access to files/logging on can be very slow if they don't logon at their main site. Students tend to stick to just one site, so we base their files/profiles at the local server, and there isn't too much of a problem with their logon times/access to their files. Can anyone recommend any technologies / companies / prices we'd expect to pay? I am going to write a "invitation to quote" document, and send it to 3-4 telecoms companies. I am looking at around 10Mbit for a substantial improvement in performance, without breaking the bank, with a possible completion date of before September. Couple of issues: We also run telephone calls (VoIP) over these links (perhaps not very relevant). Internet access is via one 10Mbit connection at the main site, so any Internet access at the other sites have to go over these links to go out over the 10Mbit Internet connecttion at the main site. I'm not sure if the routers at each site support more than 2Mbit on their WAN serial interfaces, so any upgrade may require new routers. I wonder if it feasible to upgrade the existing 2Mbit (I think at least two of them are fibre) at little cost? Any help / advice much appreciated! Thanks, Bruce. Leeds / UK.

Hi all, We have come up against a problem, which I am sure must be fairly common, but I have been unable to find any good documentation/guides on options, and on how best to deal with it. Basically, when the network at the main College site was first setup it was done using an class C IP address range (funnily enough it's not a private range, but a public one we which we no longer own and may be used elsewhere on the Internet, but that's another matter). This limits us to 254 hosts on the network. Anyway, with steady expansion over the years, we now find that we are running out of IP adresses (the DHCP server was regularily running out) causing serious problems with laptops/PCs not working on the network. For the moment I have addressed this by setting the lease period to 30 minutes, and we have an autoshutdown system (primarily used to save power) to to turn PCs after 35 mins of idletime (on the logon screen). But it's not going to keep things going for much longer, as there is need for further expansion (e.g. PCs and Wifi access points). We cannot deploy additonal access points, even though we have them, because it will tip the no. of IP addresses over the limit too often. So as you can see we are up against a problem. I have considered: Changing to IP range to private/16 (e.g. 172.16.0.0) thus giving us around 65,000 IP addresses (I think). But this sounds like a big job, we'd need to change the IP addresses on all static devices, servers. Setting up routing to split the network into two; but what is the best way/device to do this? We have a Netgear WiFi Controller which manages our WAPs. I wondered if we could use this to hand out a different range IP addresses to all WiFi devices. But having looked that the config/docs, I don't understand how to do it; not being very familar with VLANs. Netgear ProSafe support don't sound too sure either; one said we would definately need to plug the Netgear Controller into a physical router device. We do have several routers already (to route traffic to the 3 other College sites), would it be feasible to use one of these? I'm not sure but with them being very old, their Ethernet ports may only work at 10Mbit (10BaseTX) so it may cause a bottleneck. I just wish there was some simple, not too expensive, hardware device with 2-3 ports which could be used for this purpose. One underlying concern with the routing option is how the other routers on the network will find out about this new subnet. Would this happen through some automatic routing discovery protocol? Can this be done by just tick a RIP tick box somewhere? Even though I think our routers use a new protocol than this. Sorry this is turned out to be very long. Any advice much appreciated! Many Thanks, Bruce.

Hi Everyone, We are planning to update from our current version of Office (2003) to Office 2007, ready for September 2009. Previously we have just upgraded to new versions of Office over the Summer and it hasn't affected users very much. But as the interface has changed radically we thought that we would install it along side the existing version (possible this week half term week), thus allowing staff to try it out, before removing the older version before September. We are also arranging staff development sessions at the end of June, to allow staff to familiarise themselves with the new look/feel. We have about 450 PC and 80 laptops, across 4 sites to do. I am just wondering how other Schools/Colleges are planning to do the upgrade? For those that have already taken this step, how did it go? What were the issues? My plan was to copy an an MSI version of the install (with SP2 slipstreamed) to a server at each site, and to create an MST file, and use these as the Group Policy install points for each site (as we'd done for our previous upgrades). However, I've now read some MS articles (e.g. the white paper on office 2007 deployment) which recommends against using Group Policy for Deployment, and to use Systems Management Server instead. Having not used SMS before, and with limited time and I'd prefere to use Group Policy. However, it must be able to: Include SP2 in the deployment Install alongside the existing version Some minimal customisation parameters What would people recommend? Go with GP deployment or spend some time learning SMS and do it that way? Also, in our tests there appeared to be some issues with installing Office 2007 (affecting stability of Office/Windows), but it the test PCs weren't on any SP, and the PCs weren't fully patched (either Windows or Office 2003). However, they soon will be. Any tips/advice much appreciated Many Thanks, Bruce Gilbert. Leeds, UK.

We deal with this issue via scripts. The script is linked to the domain/site; it looks at the first 6 letters of the computer name (which includes the College site and room); and maps to the printer (e.g. \\server\printer) and also maps another printer to the site's copier-printer combi, it then sets the former as the default. This ensures that any student/staff will always print to the printer in the room by default, but they can always select the copier as an alternative (it's useful if the printer in the room isn't functioning for some reason). We use this in all student rooms which contain computers; full computer rooms or classrooms (many of our classrooms include some IT; usually 9 computers along one wall). How do other College/schools have IT distributed? I understand that Win2008 Server has built-in facilities for this; so we may look at moving over to this, but I haven't investigated it yet.

I too am bit perplexed by the comment in PC Pro that you quoted. We have two College sites setup with printing going via one central server at each site, and my plan is for us to move over to this model at the other two sites as well. As far as I know this is still recognised best practice. At the two other sites there are networked printers, but each PC has a local printer driver installed - each printing directly to the IP address/name of the printer which is in the room. Having one central (Windows) printer server, and printers mapped to this (via UNCs) at logon/unmapped at logoff has several key advantages over this; Centralised control/management of printers/printing (e.g. for setting security/properties/default preferences) Each PC can see what jobs are in the queue (with the security tab on the printer on the server you can just allow staff to delete jobs) Allows third party print quota software to log/report/restrict printing Mind you, it is a potential single point of failure. All its takes is for the spooler server to stop and all printing at the site grinds to a halt. I must say I don't purchase the mag as it is so expensive, but I used to flick through the network section at the end. What is the PC Pro journo proposing? Is he implying that printers should to map/unmap at logon, but directly to to the printer's built-in printer server, rather than a Windows-based server? Or is he really just having a go at desktop PCs setup as printer servers (it doesn't sound like this is the case)? Or is he refering to another scenario? Thanks, Bruce.

With an order of 75 PCs, you should be able to get a huge discount with from supplier. We purchased 100 Dell OptiPlex 755 SFF PCs from Dell in 2007, and some more in 2008. I think the website price was around £700, and we got the price down to around £370 (ex VAT). With a one-off purchase of this value I have a feeling that you may have to use a tendering process. I'm not 100% sure, but this may be a legal requirement for public money expenditure over a certain value. However, you can use a purchasing consortium to avoid this (and get a competitive price), as they have already gone through the tendering process for you. As an educational customer, Dell also gave us a 3 year Next Business Day on-site warranty as standard (on desktops, but not laptops). However, if you prefere to fix them yourself yourself, they are willing to send you the parts, following a diagnosis on the phone. Also, they won't sell budget PCs from their home range (e.g. Dell Inspiron) to businesses/schools/colleges. One issue we have recently discovered with our Dell machines is the non-standard power supplies in the SFF models (and presumably the USFF model as well). Three of ours needed replacing after learners flicked the switch the PSU from 240V to 220V and went pop! We are going to superglue the switches in-place. If you contact Dell they'll charge £107 for a replacement. This is where they make their money! You should also be careful if you prefere 4:3 aspect radio displays to widescreen. Dell would probably try to slip in widescreen because they are cheaper to manufacture than 4:3 (due to the smaller screen area). Widescreen is good for video, but perhaps not as good for normal office applications like Word. Check the spec in your quotation; and look for a W in the product code as it's an indication of widescreen. There are other companies which offer good bulk discounts on desktop machines: Stone computers provided us with a good quotation (inc standard parts and 5 year NBD warranty), and HP are also geared up for this. Others include RM and Viglen. Thanks, Bruce.

Yello

Just thought i'll pass on our experince of the above product (in a 4 site FE environment). The product seems pretty reliable and is great for deploying a wireless network with a global config (same SSID and Key across all 4 sites; several WAPs per site). You can set the config once on the master controller and have the config replicate to the salve controller and they send their config to the WAPs. You can also have multiple SSID/configs going in parallel (including WPA, WPA and 802.11X). The product gets pretty good reviews and seems to be "feature packed". We have barely delved beneith the surface. But one downside that the features do seem incredibly complex to configure and the online manual is very big. One problem we have at one of the site is lack of IP addresses available in our class C private range, so we'd like the controller to provide IP addresses to the laptops in another range and route between them and the rest of the network, but working out how to do this has been a challenge. I you needs a CCNP or something to figure it out. Does anyone know how it's done? Thanks, Bruce.

As pointed out WSUS should provide the update automatically; if you don't have WSUS setup than you can deploy the patch automatically (.exe downloadable from MS) in the startup script (may require a command line option to do it silently). However, the update will only apply to WinXP SP2 (and above) PCs. Thanks Bruce.

We've had this infection for a couple of week and now that it is half term I see it as an opportunity to eradicate it properly. Up to now; we have deployed the patch to all servers, pcs and laptops; disabled autorun in portable devices. To actually remove the worm from infected systems we have setup a shutdown script which runs f-secure's f-downadup.exe to scan for the worm; it returns an error level of 1 it has detected the worm and in this case runs f-downadup.exe again but with --disinfect. All infections are logged centrally. We are going to keep this going and if it doesn't work we may shutdown the network for the afternoon. One potential niggle is I suspect that if a PC is infected and an admin user logs on the worm inherits admin right; thus giving it full rights to infect all PCs and servers, irrespective of the patch. I agree that this episode exposes just how insecure some networks can be. The real problem is that all networks are inherently insecure. A centralised thin client network may help and the TCM module (with associated software) may also (future). Bruce.

I just went onto their website and can't see a free version for educational use. It does say that the trial version would keep going (after the 40 day trial period), but only if there are less than 5 network accounts; and we have over 7,000 (although only about 2,500 actually logon in one year). Thanks, Bruce.

Thanks - will try this. Bruce.

Just a quickie, does anyone know of any free printer quota / monitoring software? Thanks, Bruce.

Christ, the amount of trouble I had logging on just so I could write a reply! I obviously can't remember the password I chose of every website I happen to register an account with We've setup a VBScript logon script for dealing with the issue of printing from wireless laptops. When a users logs on it first checks that they are logging onto a laptop (checks if the name of the computer contains *lap"). It then presents the user with a pop-up box where it asks the user to enter the classroom room number (from a list), and it then maps a network printer to the printer in the room and sets it as the default. Note: all network printers are actually managed by just the one server. At logoff it unmaps the printer (all of the network printers actually). Bruce.