ICTNUT

You could use XCALS, I use it as part of the new intake script I run every August. When I get into the office on Monday I will post a link to it and a copy of the script I use, it is really easy and straight forward and modifies the permissions on the share and the NTFS permissions also.

I have been looking into this for the past 3 months as our LEA will not provide remote access into the school network for RDP/terminal services or even web based apps such as sharepoint/class server. Anyhow you will all need to be carefull when bonding multiple ADSL lines as you will be subject to the numerous "Fair use policies" that ISPs seem to be hiding in the T&C's these days. I went to BT, and a few others all of whom could only provide at best 24hour fault report and fix ( in BT's case an extra 10.00 per month per line), the business SLA was patchy at best, and when appraoched about Fair usage none of them could say that you would not get capped. Remember Fair Usage Policies are at the hardest DURING business hours exactly at the time when we are likely to be using them. The only other option we was looking at was 10Mb Leased Lines from Enta.net starting at £7,200 per year, at least you get 10Mb each way, no conention and no capping.

We have on in the ICT support office used by two of us. I get around 3.5k prints from it in econo mode and as yet have not had any issues with it at all. An all round good printer

Goto the GPO you have setup for the students and follow: User Configuration --> Admin Templates --> Windows Components --> the two areas you are looking for is Start Menu & Desktop Both of these have options to disable right click context menu which will remove ANY right click menu from both the desktop and the start menu/bar

Seems to me thay have lost a number of deals due to being a little expensive and are trying to stop people from trying to play of one quote against another, which is what we all do. Another thing is that I guess they have been made to sign some NDA's and have either mis understood it and think that everyone they speak too or look at need to sign one also. I love this bit, looks like they are more intrested in keeping thier reseller status with Dell rather than get the business to sell them... Leave them well alone......

Have looked at SIMS but given the issues we have had getting it to do basic things and now that it is working I don't want to rock the boat. @Indie, I would be intrested in the setup that you have seems simple, and as we know the simple things tend to be the best. @Webman, i'll take a look and let you know.

I am looking into electronic document storage for our admin department and wondered if any of you guys have gone down this route yet for storage and archiving of invoices and other such paper work. The actual physical storage is not a problem as I have a couple of terrastores that I plan to use, what I after is they way to "Scan and Store". Ideally it would be done from a central scanning location but how then would we define folders and directories. Any thoughts would be great.

faza: you need to establish that the permissions one the folders are correct, if everyone has access to the root share then they will be able to move around and yes eventually see all you have on the network. I would take a single student login as them and check that you can traverse the network as you say above. Next work from the students home share upwards checking the permissions not only on the share but the NTFS permissions also, I am sure you will see that there are permissions set that is allowing user to go all the way up. [edit] Looking at the workflow I would assume that this is the scenario that you are following: You creat a new user in AD and at the same time under the profile tab for the new user you point to \\server\studentsshare Whent he new user logs on you are using some kind of login script to map the above home drive. If this is the case them the user will be able to move all the way up. You will need to create the user in AD and add the path to thier home share under the profile tab. Then you will need to go into the GPO that affects the student and goto; User Configuration --> Windows Settings --> Folder Redirection --> My Documents --> right Click --> Properties The first option should be set to "Basic" and the second option should be "redirect to the users home folder". Now by doing this when you click on the "Up one level" button it will take you to "My Computer" and then the Desktop and no further. This would allow you to investigate UNC path mapping at your leisure and remove some pressure. [/edit]

@Faza: How have you mapped that pupils home drives via GPO or scripted i.e. Bat file ot vbs...?? [edit] I agree with ChrisH our root folder is Students$ which only the admins have access to and then within that we have year group folders (NOT SHARED) and within those you get the individual students folders themselves shared as studentname$ with admins having full access and only the required students have full access also. [/edit]

If you do not want users to be able to see shares on the servers you will need to create an administrative share by simply putting a $ at the end of the sharename. Next make sure that the folders themselves have only permissions that are required for the job i.e. Our assignments drive has the following; Students : List, View, Read Teachers: List, View, Read, modify Admins: Full Control The everyone group has been removed. This generally means that the students can do nothing more that just read the contents of that folder. There is a GPO setting that will stop UNC browsing so if you goto explorer and type in \\server-name\foldername it would be dissallowed. I do not have it's location to hand but will find it and update this post [edit] Just had a thought, when you click open it should default to "My Documents" now ours are all redirected to thier home shares and if we select up on level it takes the to My Computer and then the desktop and no further. Are your My Docs folders redirected or not, that could be the issue. [/edit]

Definatley a GPO issue. Have not been able to track down which one it was, I will continue to hunt though as I am sure it gonna happen again. For now have created a new GPO for the students and rolled that out and all is now working again. Funny thing is if you look at the old GPO vs the new one they are identical. @Geoff: Thanks for the input, I have heard of it but I know it as ghosting, anyhow you could be right however once I do get to the bottom of it I will post up the solution here.

Have you done a group policy change recently? There is a section within the GPO that allows you to remove "Programs Pinned" and "Recently accessed programs" from the start menu. I also assume that you have removed the username from the menus on purpose.

Well I have checked with FireFox under the same user that was having the above problems and it all works, going back into IE and it don't. Now here comes the good bit, I then logged in as the same user but with GPO removed which resulted in everything working in both IE and FF. This proves that there is a GPO restriction somewhere. I have removed (set back to default) ALL IE settings in GPO for this user (is only subject to one GPO) but still no joy, I have a funny feeling this is not confined to the IE section of GPO. Any ideas anyone.....

@edie209: Are you sure these cards are PXE enabled from the start? we have only been able to find them with optional boot ROM support, requiring you to spend an additional £10 - £12 for the ROM

We use 3Com (3C905CX-TX-M) and work superb with our RIS setup. The down side is that they do cost £20 each. You can find info on them here --> http://www.3com.com/prod/en_UK_EMEA/detail.jsp?tab=features&sku=3C905CX-TX-M

Geoff, The sharepoint sites are in the local and trusted zones which have been given very LOW security. I will try your suggestion of FireFox and let you know.

Hi All, Does anyone know to what extent GPO effects Windows Sharepoint Services and Sharepoint Portal 2003. We have been using this for some time now without any problems but recently our students can no longer fill in any forms, the questions themselves appear but the actual form fields do not. Nothing has changed at all on/with the SPS server or setup, but I am always "tweaking" GPO and as this is the only thing that has changed over the last few weeks I can only put it down to this. I have posted on the Technet forums but as yet no replies or answers, this problem effectively renders sharepoint useless (we make extensive use of the surveys you see) Any help would be great and would earn the winner a virtual beer :-)

It's trying to do stuff with the printer settings. If you are a user with some elevated user rights is seems to do this once in the background silently but if you are a restricted user (like students) it goes trhough the install process and then comes up with "you are not allowed to modufy the printers settings, please see you administrator" yada yada yada. I have trawled the macromedia / adobe webistes for a solution but none yet. I have even phoned the support line for macromedia, what a waste of time that was.

We have been using an old AMD 2000+ with 512MB and 60GB drive, 1 x 100Mb NIC (INTEL) and 1 x 1000MB NIC (INTEL) Software Installed: Smoothwall Dans Gaurdian ClamAV DSpam Average User Load: 750 Users Has not fallen over yet however I have a job setup to reboot the box and clear the cache each Sunday so that helps abit too.

@eejit : Any chance of a "How To" mate, I am suffering with the same problem here and it's driving me nuts !!!!!

Running here as above with McAfee Enterprise Virus Scan ver8.0i

Not that I am aware of, as far as I am concerned we are adopting a "Safe Use" policy in order to protect users and the school itself from any "Harm" this has been in place for over four months now and have not had any bad feedback over it from anyone including the SMT.

Hi All, For those of you, like us, that have the ability of blocking sites at the root tld level please find below all those available net wide. We have taken the stance of blocking all except .com, .net, and .co.uk for language subjects we get the teachers to do a bit of research and once they have found sites to use and are vetted by us we then add them to the safe list that we have, so in essence for students they almost have a total block. [edit]This is not a full and complete list but covers most[/edit] .com United States .net Network .ca Canada .uk United Kingdom .de Germany .fr France .it Italy .nl Netherlands .au Australia .jp Japan .be Belgium .se Sweden .es Spain .fi Finland .ch Switzerland .ap Asia/Pacific Region .pl Poland .dk Denmark .no Norway .cn China .at Austria .br Brazil .edu US Educational .mx Mexico .tr Turkey .il Israel .pt Portugal .nz New Zealand .gr Greece .ru Russian Federation .za South Africa .kr Korea, Republic of .sg Singapore .in India .tw Taiwan .hu Hungary .cz Czech Republic .ie Ireland .ar Argentina .my Malaysia .hk Hong Kong .is Iceland .uy Uruguay .eg Egypt .cl Chile .si Slovenia .hr Croatia .ro Romania .ee Estonia .org Non-Profit Organizations .th Thailand .mil US Military .lt Lithuania .pe Peru .ph Philippines .id Indonesia .sk Slovakia .yu Yugoslavia .ve Venezuela .cy Cyprus .lu Luxembourg .pk Pakistan .ua Ukraine .lv Latvia .co Colombia .vn Vietnam .pr Puerto Rico .kw Kuwait .bh Bahrain .arpa Old style Arpanet .bg Bulgaria .ir Iran, Islamic Republic of .mt Malta .gov US Government .ae United Arab Emirates .cr Costa Rica .fo Faroe Islands .mu Mauritius .lb Lebanon .jo Jordan .ba Bosnia and Herzegovina .ma Morocco .mk Macedonia, the Former Yugoslav Republic of .lk Sri Lanka .tt Trinidad and Tobago .gu Guam .mc Monaco .sa Saudi Arabia .do Dominican Republic .vi Virgin Islands, U.S. .by Belarus .qa Qatar .pa Panama .dz Algeria .gt Guatemala .sy Syrian Arab Republic .bo Bolivia .mo Macao .kz Kazakhstan .ec Ecuador .bd Bangladesh .gi Gibraltar .bm Bermuda .sv El Salvador .ng Nigeria .eu Europe .bs Bahamas .az Azerbaijan .zw Zimbabwe .am Armenia .lc Saint Lucia .ge Georgia .ad Andorra .li Liechtenstein .an Netherlands Antilles .hn Honduras .ag Antigua and Barbuda .ps Palestinian Territory, Occupied .bn Brunei Darussalam .gh Ghana .ke Kenya .sr Suriname .bb Barbados .ye Yemen .cc Cocos (Keeling) Islands .sm San Marino .np Nepal .md Moldova, Republic of .ws Samoa .tz Tanzania, United Republic of .na Namibia .om Oman .jm Jamaica .ni Nicaragua .bz Belize .ly Libyan Arab Jamahiriya .pf French Polynesia .aw Aruba .uz Uzbekistan .iq Iraq .fj Fiji .nu Niue .kg Kyrgyzstan .nc New Caledonia .sn Senegal .zm Zambia .ht Haiti .py Paraguay .to Tonga .mv Maldives .gp Guadeloupe .gy Guyana .mp Northern Mariana Islands .mz Mozambique .pg Papua New Guinea .gl Greenland .ao Angola .al Albania .kh Cambodia .mn Mongolia .ci Cote D'Ivoire .mm Myanmar .et Ethiopia .ml Mali .ga Gabon .ck Cook Islands .bw Botswana .vg Virgin Islands, British .cu Cuba .ug Uganda .gd Grenada .cm Cameroon .af Afghanistan .dm Dominica .lr Liberia .mq Martinique .bt Bhutan .kn Saint Kitts and Nevis .cx Christmas Island .ky Cayman Islands .tm Turkmenistan .sd Sudan .bj Benin .tn Tunisia .st Sao Tome and Principe .la Lao People's Democratic Republic .tv Tuvalu .mg Madagascar .dj Djibouti .sc Seychelles .bf Burkina Faso .gn Guinea .fm Micronesia, Federated States of .vu Vanuatu .cv Cape Verde .mw Malawi .tg Togo .ai Anguilla .io British Indian Ocean Territory .tj Tajikistan .sb Solomon Islands .rw Rwanda .sl Sierra Leone .vc Saint Vincent and the Grenadines .er Eritrea .mr Mauritania .gq Equatorial Guinea .tc Turks and Caicos Islands .cf Central African Republic .tf French Southern Territories .gm Gambia .re Reunion .ne Niger .pw Palau .bi Burundi .sz Swaziland .as American Samoa .so Somalia .ms Montserrat .gf French Guiana .va Vatican City State .gw Guinea-Bissau .mh Marshall Islands .fk Falkland Islands (Malvinas) .cg Congo .yt Mayotte .td Chad .ls Lesotho

What a superb find ! Top marks for broc, come and sit at the front of the class ;-)

@Tosca: The scripts I use are as follows: First of I add a folder called Install to the following path: \\YOUR_RIS_SERVER\REMINST\Setup\English\Images\YOUR_IMAGE_NAME\$oem$\$1 Within this folder there are a number of batch (.cmd) files that correspond to various installs that need to be done and by placing them in this folder the are copied over to the machince during the text portion of setup. Example Files 0.cmd cmdow @ /HID @echo off SET KEY=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx REG ADD %KEY% /V TITLE /D "Installing Drives And Applications" /f REG ADD %KEY%\001 /VE /D "Mapping Network Drive" /f REG ADD %KEY%\001 /V /1 /D "%systemdrive%\install\1.cmd" /f REG ADD %KEY%\005 /VE /D "Adobe Reader 7" /f REG ADD %KEY%\005 /V 1 /D "q:\AdobeReader7\acroread702.exe" /f REG ADD %KEY%\006 /VE /D "Smoothwall IDT" /f REG ADD %KEY%\006 /V 1 /D "q:\Smoothwall_Ident\SWIDent.msi /quiet" /f REG ADD %KEY%\007 /VE /D "User Hive Cleanup" /f REG ADD %KEY%\007 /V 1 /D "MSIEXEC.EXE /i q:\UserCleanUp\UPHClean-Setup.msi /q" /f REG ADD %KEY%\010 /VE /D "Microsoft Office 2003" /f REG ADD %KEY%\010 /V 1 /D "q:\Office11\setup.exe TRANSFORMS=q:\Office11\Setup_Office_20_01_06.MST /qb-" /f REG ADD %KEY%\011 /VE /D "Macromedia Dreamweaver 8" /f REG ADD %KEY%\011 /V 1 /D "msiexec /qb! /i q:\Studio8\Macromedia_Dreamweaver_8.msi" REG ADD %KEY%\012 /VE /D "Macromedia Extension Manager" /f REG ADD %KEY%\012 /V 1 /D "msiexec /qb! /i q:\Studio8\Macromedia_Extension_Manager.msi" REG ADD %KEY%\013 /VE /D "Macromedia Fireworks 8" /f REG ADD %KEY%\013 /V 1 /D "msiexec /qb! /i q:\Studio8\Macromedia_Fireworks_8.msi" REG ADD %KEY%\014 /VE /D "Macromedia Flash 8" /f REG ADD %KEY%\014 /V 1 /D "msiexec /qb! /i q:\Studio8\Macromedia_Flash_8.msi" REG ADD %KEY%\015 /VE /D "Macromedia Flash 8 Video Encoder" /f REG ADD %KEY%\015 /V 1 /D "msiexec /qb! /i q:\Studio8\Macromedia_Flash_8_Video_Encoder.msi" REG ADD %KEY%\016 /VE /D "Macromedia Patch Update 3.0.1" /f REG ADD %KEY%\016 /V 1 /D "Msiexec /update q:\Studio8\CT_3.0.1_PatchPackage.msp /quiet" REG ADD %KEY%\017 /VE /D "Macromedia Patch Update 3.1.1" /f REG ADD %KEY%\017 /V 1 /D "msiexec /update q:\Studio8\CT_3.1.1_PatchPackage.msp /quiet" REG ADD %KEY%\018 /VE /D "Macromedia Contribute 3.11" /f REG ADD %KEY%\018 /V 1 /D "msiexec /qb! /i q:\Studio8\Macromedia_Contribute_3.11.msi" REG ADD %KEY%\019 /VE /D "IS Script 10.5" /f REG ADD %KEY%\019 /V 1 /D "MSIEXEC.EXE /i q:\MindManager\ISScript1050.msi /qn" /f REG ADD %KEY%\020 /VE /D "Mind Manager" /f REG ADD %KEY%\020 /V 1 /D "MSIEXEC.EXE /i q:\MindManager\Mindjet_MindManager_Pro_6.msi /qn INSTALLDIR=C:\Progra~1\MindJet\MindManager6 EULA_REGION=2 ISX_SERIALNUM=XXXX-XXX-XXXX-XXXX-XXXX USERNAME=USER COMAPNYNAME=JCOMPANY" /f REG ADD %KEY%\025 /VE /D "IS Script 11" /f REG ADD %KEY%\025 /V 1 /D "MSIEXEC.EXE /i q:\QuickTime\ISScript11.msi /qn" /f REG ADD %KEY%\030 /VE /D "Quick Time Player 7" /f REG ADD %KEY%\030 /V 1 /D "MSIEXEC.EXE /i q:\QuickTime\QuickTime.msi /t q:\QuickTime\1031.MST ISSETUPDRIVEN=1" /f REG ADD %KEY%\035 /VE /D "Windows Media Player 10" /f REG ADD %KEY%\035 /V 1 /D "q:\WM10\mpsetupedp.msi /quiet" /f REG ADD %KEY%\045 /VE /D "McAffee Anti Virus" /f REG ADD %KEY%\045 /V 1 /D "q:\ePOAV\framepkg.exe" /f REG ADD %KEY%\050 /VE /D "Cleaning Up and Rebooting" /f REG ADD %KEY%\050 /V 1 /D "%systemdrive%\install\2.cmd" /f shutdown.exe -r -f -t 5 -c "Windows will now restart...." Exit This is the first thing that is run and add all the entires into registry under RunOnceEx and then reboots the machine Within our *.sif file we have set the autologin count = 2 as this is the number we need. Once the machine has rebooted and logs in the registry stuff we entered in 0.cmd is executed and the next .cmd is run 1.cmd cmdow @ /HID @echo off :: Create an authenticated connection to the server by mapping a drive. net use q: \\YOUR_SERVER\RemoteInstall\Programs /user:DOMAIN\USER /persistent:no PASSWORD :: Change to the Q Drive q: exit All this script does is map a physical drive to our remote apps server where we hold all the install files and then changes to it. Once this is done and all the applications have been installed we need to tidy up abit so we run the final .cmd file 2.cmd CMDOW @ /HID @echo off :: Start >> set AUPSM=%ALLUSERSPROFILE%\Start Menu del "%AUPSM%\New Office Document.lnk" del "%AUPSM%\Open Office Document.lnk" del "%AUPSM%\Set Program Access and Defaults.lnk" del "%AUPSM%\Windows Catalog.lnk" del "%AUPSM%\Windows Update.lnk" :: Start >> Programs >> set UPSMP=%USERPROFILE%\Start Menu\Programs del "%UPSMP%\Remote Assistance.lnk" set DUSMP=C:\Documents and Settings\Default User\Start Menu\Programs del "%DUSMP%\Remote Assistance.lnk" :: Start >> Programs >> Accessories >> set AUPSMPA=%ALLUSERSPROFILE%\Start Menu\Programs\Accessories rd /s /q "%AUPSMPA%\System Tools" rd /s /q "%AUPSMPA%\Communications" set DUSMP=C:\Documents and Settings\Default User\Start Menu\Programs\Accessories del "%DUSMP%\Tour Windows XP.lnk" del "%DUSMP%\Program Compatibility Wizard.lnk" del "%DUSMP%\Synchronize.lnk" del "%DUSMP%\Command Prompt.lnk" :: Start >> Programs >> Administrative Tools set AUPSMPA=%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools rd /s /q "%AUPSMPA%\Component Services.lnk" rd /s /q "%AUPSMPA%\Computer Management.lnk" rd /s /q "%AUPSMPA%\Data Sources (ODBC).lnk" rd /s /q "%AUPSMPA%\Event Viewer.lnk" rd /s /q "%AUPSMPA%\Local Security Policy.lnk" rd /s /q "%AUPSMPA%\Performance.lnk" rd /s /q "%AUPSMPA%\Services.lnk" :: Start >> Programs >> TightVNC set AUPSMPA=%ALLUSERSPROFILE%\Start Menu\Programs\TightVNC rd /s /q "%AUPSMPA%\Administration" rd /s /q "%AUPSMPA%\Documentation" rd /s /q "%AUPSMPA%\Show About Box.lnk" rd /s /q "%AUPSMPA%\Show User Settings.lnk" rd /s /q "%AUPSMPA%\TightVNC Viewer (Best Compression).lnk" rd /s /q "%AUPSMPA%\TightVNC Viewer (Fast Compression).lnk" rd /s /q "%AUPSMPA%\TightVNC Viewer (Listen Mode).lnk" :: Start >> Programs >> Macromedia set AUPSMPA=%ALLUSERSPROFILE%\Start Menu\Programs\Macromedia rd /s /q "%AUPSMPA%\Readme Files" :: Start >> Programs >> QuickTime set AUPSMPA=%ALLUSERSPROFILE%\Start Menu\Programs\QuickTime rd /s /q "%AUPSMPA%\About QuickTime.lnk" rd /s /q "%AUPSMPA%\Uninstall QuickTime.lnk" set UPSMPA=%USERPROFILE%\Start Menu\Programs\Accessories del "%UPSMPA%\Tour Windows XP.lnk" del "%UPSMPA%\Program Compatibility Wizard.lnk" del "%UPSMPA%\Synchronize.lnk" del "%UPSMPA%\Command Prompt.lnk" del "%UPSMPA%\Address Book.lnk" :: Copy Macromedia Licence Information Over Call macro_licence.vbs DEL "%systemroot%\*.bmp" DEL "%systemroot%\system32\dllcache\*.scr" DEL "%systemroot%\system32\*.scr" DEL /F /Q %SYSTEMDRIVE%\*.7z DEL /F /Q %WINDIR%\system32\setupold.exe DEL /F /Q %WINDIR%\system32\7za.exe DEL /F /Q %WINDIR%\system32\presetup.cmd RD /S /Q %SystemDrive%\D RD /S /Q %systemdrive%\Drivers RD /S /Q %systemdrive%\Macromedia net user aspnet /delete shutdown.exe -r -f -t 5 -c "Windows will now restart...." RD /S /Q %systemdrive%\install EXIT All this does is gut out a few shortcuts from the various profiles and remove all the driver files and extra stuff that was copied over during the text part of the setup. All you need to do to kick the whole thing off is add the following to you /sif file: [GuiRunOnce] %systemdrive%\install\0.cmd And that's it really, by doing our installs this way all our machines get a complete clean install (not based on an image which is problematic in itself) and becouse we use RISult for driver intergration and post-SP2 fixes we have a very stable base image that we simply add .sif files to if we need another set of programs for a particular function i.e ICT, Science, Maths etc... Now as you may have guessed if you add alternative .sif files to the templates folder within I386, for example: XPSP2.sif XPSP2ICT.sif XPSP2SCIENCE.sif and number you initial .cmd files to correspond to the .sif file for example: 0.cmd --> XPSP2.sif 0a.cmd --> XPSP2ICT.sif 0b.cmd --> XPSP2SCIENCE.sif you can quickly build up a very flexible imaging solution that works, doing it this way our ICT rooms using the batch files above take around 35-40mins each to image from start to finish however we are running a true 1GB backbone so your may take a little longer. I think thats it for now but if I think of anything else I update this post. Any questions please ask....