Tamarside

Go have a look at post 5 in the thread I've linked to above. As I said, there are detailed steps there.

You'll find detailed instructions on this thread, which several others have linked to further above: http://www.edugeek.net/forums/windows/7041-stopping-exe-files-being-run-usb-stick.html

Surely a better and infinately more practical solution would be to simply export te ISA config and save it onto the backup server?

If you're going to try and custom write a GINA replacement, be aware of what exactly this file does, in addition to displaying pretty pictures. One of the easiest ways to subvert an entire network is through an insecure custom GINA as the GINA receives the user's password in plain text. A custom GINA could for example write username & password combinations to a central log, or even upload via HTTPS. Your firewall won't interfere with that at all, and even if your firewall asks for authentication the custom GINA could simply hand over the credentials it is about to upload somewhere. I'm not trying to spook you, but instead wanted to make you aware of the risks. My advice would be to RESHACK the msGina and push it out under a different name, as a custom GINA, alongside with the relevant reg entries, then if ever queried by Microsoft claim ignorance and state you believe by leaving the original untouched you remained with your EULA.

I'm presuming you're pinging from within your network? If so, 15 ms is slow and 57 ms is VERY slow - pinging IFL.NET I get 32 ms from inside our network and we are geographically placed more or less where you'd need to insert the tube, were you to give the UK an enema. Internally you should have an average ping response of 1 ms or less. I'd start looking at your infrastructure - - What cabling do you have in place? - Are you using any hubs instead of managed switches? Switches must be at least Layer2 devices, and ideally you'd have at least one Layer3 switch at the core of your network - Do some packet sniffing to see what exactly is on the wire. For all you know you may have infected hosts currently attacking the Pentagon!

Assign the .MSI to computers, then a day or two later add a few lines to a startup batch script assigned to the computers to copy your edited .INI file into place on all workstations, from your NETLOGON share. Take the example .INI file and tweak it to suit your needs - the app has a great deal of documentation to show you how to do this.

Actually you're completely wrong! It takes around 30 SECONDS to completely compromise a Windows 2000 PC remotely, simply because the OS is so insecure. By compromise, I mean to have full, unrestricted local admin access. Attackers fingerprint machines before attacking. This makes sense as you wouldn't want to be running XP eploits against a Linux machine, would you. The minute they detect an older, less secure OS you've made their lives SO much easier. Add to that the fact that your network isn't a secure fortress anymore, and you're in serious trouble. See, network security used to be like a castle keep. We'd have a portcullis, drawbridge, pots of hot oil, etc. protecting the ONLY access route in and out of the keep. Inside the keep everything was pretty much trusted. With mobile broadband making inroads, and all manner of portable apps being carried into YOUR network, we can't use that model anymore. It's dead. Especially mobile broadband means students can open various other ways into and out of the network, at the drop of a hat. Instead, network security has become more like modern city. Most people are good and honest, but there are thieves, robbers and even salespeople lurking about. As a result, we cannot treat the entire city as safe - it simply has too many entry and exit points to secure and most of those aren't under our control. Instead we have front door locks, and sometimes even safe rooms inside locked buildings. Our security must become so much more granular, and therefore more complex. We must have a strategy that clearly defines what we are prepared to sacrifice, and what we'd defend almost at any cost, because we don't have the resources to defend everything. In this environment security through OS geriatrics is not exactly the best way forward. Do yourself a favour and run Nessus against your network, but from INSIDE. You may be worried when you see the results!

What exactly are you trying to achieve?

We're a community college with around 1 250 students and 180 staff. We support three primaries at present, with another one joining us soon. In total we support about 1000 computers (desktop/laptop mix), 16 servers, 85 interactive whiteboards and around 95 projectors, with 80-ish printers thrown in for good measure. We have a site-wide WiFi network (some 50 WAP's) on a DMZ that is set to prioritise VoIP traffic over normal data and we support the VoIP setup, including the WinMo handsets. Additionally we have several WAP's that are on the "proper" network dotted around. The department consists of me and four technicians. We have a lot of automation, but in some respects we're still very primitive. Sadly documentation is nowhere near as detailed and accurate as I'd like it to be, but we've made good progress.

Yes, newer Nokias have the scanning software to read QR Codes installed as default.

Microsoft's released their Tag technology (Microsoft Tag - Linking real life with the digital world) and at a glance it look quite good. Obviously they're looking at marketing it heavily and history teaches us that when Microsoft sets its mind to something it normally ends up getting its own way. This is all fine and dandy so far and I must admit that I'm impressed with Microsoft Tag, especially the fact that it scans tags correctly even when oblique and out of focus. The pain is that I'm well down the road with implementing QR Codes. So much so that I've completed a browser toolbar intended to be deployed on our student PC's. The toolbar has (amongst other things) a button that, when clicked, displays the student's timetable for the day. The timetable contains a hyperlink that displayes a dynamically-created QR Code containing the timetable data, so that students only need to scan it with their phones. I can just see in future Microsoft will overpower what I'm doing with their Tags, so I'm thinking that perhaps I should look at changing NOW, seeing as we've not yet gone live with QR Codes. What do you think?

Actually Simon I think you'll find you took a massive performance hit, but the DB wasn't damaged, so my point stands that read-only access to a DB will not destroy it. SQL optimisation is a different topic altogether. Obviously you'd need to evaluate any queries run against the DB by getting a baseline of the server's performance before, then again while the query is running, so you can evaluate how much of a performance hit you'd be taking. That should form part of your normal tasks anyhow and should slot in under your change management processes.

Actually I beg to differ. READ ONLY access cannot in any way, shape or form damage the DB. And the vendors don't simply own the responsibility for support, they actually get paid for it. Nobody is expecting vendors to support every app that links to their DB, but if they started a) delivering more of what their customers actually need and b) being more transparent towards their customers this whole issue can go away. For example, if Capita released a proper API to dynamically read data from their DB and also provide AD integration (or some other identity management solution, e.g. Shiboleth, or others) then the DB would remain totally protected, while schools would enjoy a great deal more in terms of freedom and functionality. Capita aren't the only ones behaving in this manner - Serco does exactly the same. Having said that, I also have to point out that Serco's CMIS DB is FAR cleaner and easier to work with than the SIMS one.

Provided there is a valid backup of AD somewhere, or at least one other DC there is no need whatsoever to rebuild the domain from scratch. Even if there is no other DC and the backup is older than the tombstone date for AD it remains possible to recover AD from such a backup.

Not too sure what you mean by monitoring shares, but all the rest (and a GREAT deal more!) you can do using Spiceworks - get it at Spiceworks - Free Network Monitoring Software for Network Management It is an absolutely suberb tool. In fact we use it on our school network and it copes just fine (even though they say it was meant for smaller networks). We now know what printer consumable levels are at any point just by running a report and we get all sorts of automated alerts. Best of all, it's free. Well, ad-supported, but the ads are off to the side.

But it'd be SO much easier just extracting the data directly from the SQL DB. What's more, as you're not writing back there is no way Capita can see you've extracted data. No offense, Capita, but like others I feel the need to point out that you guys may have written the app, but you don't own the data. When schools want to use the data in different ways, they should be allowed to do so without being forced down the line of scheduled exports of non-live data! What you as company suggests as feasible is a joke! The time to start paying attention to your customers is NOW, because there ARE other MIS system around. There was a time when very clever companies could dazzle schools with their all-singing, all-dancing software products. But the world has moved on since the days on Windows 3.1! Almost without fail all MIS systems have now become so jaded and out of date with the needs of schools that they are a joke. They still insist on operating siloed systems that don't speak to anything else, AD integration is a rude phrase to them and identity management seems to be treated like a family scandal - best ignored and kept quiet about. Capita, Serco, wake up and wake up NOW. Your products are stale, your customers are complaining, your restrictions are extreme, and your "partner status" programmes come across as little more than outright profiteering.

The moment you start writing data back to the DB you would have broken the Serco license agreement, allowing them to completely cut off all support. The ONLY time that won't happen is if you are registered as a partner of Serco's and that is not a cheap option. Strictly speaking if you only read data from the DB you're also breaking the license, but this is less severe as you don't run the risk of writing back to the DB and breaking it. I've been working with the CMIS DB for a number of years now and like others here I've never come across a data map. Often I think even Serco doesn't have one, judging by how they sometimes botch their upgrades. Why do you need to write back to the CMIS DB anyway? You can have custom fields in AD that you can write to at will. Provided you have a link between AD accounts and CMIS (the admission number springs to mind!) you can have data straddle both systems. This should take care of practically everything you need from a SysAdmin's point of view. For any other data that needs writing back specifically to the CMIS DB, have your staff members use ePortal or CMIS itself.

That's not correct. System State backs up AD (if run on a DC), the registry and some system files but in no way does it back up the entire system drive. Anyway, here are the scripts I use. I didn't write the 1st - the author's details are in it: '=========================================================================== ' Name: SystemStateBackup.vbs ' Version: 2.0 ' Author: Jeremy Lawrence ' Bug Reports & Enhancement Req: [email protected] ' ' Main Function: Performs a System State Backup on WinXP, Win2K, and Win2k3 '=========================================================================== DIM strDate DIM strComputerName DIM strBytes Set WshNetwork = WScript.CreateObject("WScript.Network") strComputerName = WshNetwork.ComputerName strDate = month(Now) & "-" & day(Now) & "-" & year(Now) Const HARD_DISK = 3 strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colDisks = objWMIService.ExecQuery _ ("SELECT * FROM Win32_LogicalDisk WHERE DriveType = " _ & HARD_DISK & "") For Each objDisk in colDisks strBytes = FormatNumber((objDisk.FreeSpace / 1073741824),2) If strBytes <= 0.30 then Wscript.Echo "You do not have enough disk space to place the System State backup on this drive. Please find another location." Else '@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ '@ Uncomment this line if you want an interactive process '@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 'Wscript.Echo objDisk.DeviceID & " has " & " " & strBytes & "GB of space available" End If Next Set oWshShell = CreateObject("WScript.Shell") '@@@@@@@@@@@@@@@@@@@@@@@@@ '@ Comment one of the next two statements out, depending on your '@ preferences. Also, you must change the path if using the 1st statement '@@@@@@@@@@@@@@@@@@@@@@@@@ strDest="Your path here" 'strDest= inputbox("Please enter the location you would like to save the system state. The location must have a minimum 300MB of space." & vbCr & vbCr & "Example: C:\Systemstate","CSC System State Backup","C:\systemstate") oWshShell.Run "ntbackup backup systemstate /f " & strDest & "\Systemstate" & "_" & strDate & "_" & strComputerName & ".bkf /m copy" As I've stated before, these backup files will rapidly clog drive space, so I use the 2nd script to delete any such files older than seven days. Here's the script to do that: This can of course be used for all sorts of purposes, like a drop-box folder that acts as a tempory storage facility.

Here's what I do with my System State backups: I have two scripts that are task scheduled to run daily. The 1st script backs up the System State and stores it on another server (else what's the point - if the server failed and you cannot recover your system state backups!) To stop these backup files clogging up the destination server's drives, the second script deletes all such files older than a configurable number of days. If you'd like I can post the actual scripts here.

Based on what you've posted, it seems you've lost at the very least your RID Master FSMO role, which means you're in for a jolly old time! To put it into perspective, and without trying to frighten you, you will need to make repairs to the heart of AD now. As ever with major AD changes, do ensure you use NTBackup to make system state backups of all your DC's before attempting this. That way you have an escape route in place! It IS possible to recover FSMO roles, but to do so you need to ensure there isn't a server on the network now with the same name as any DC that held any of the lost FSMO roles. Also remember: NEVER seize FSMO roles unless you truly have no other choice. It is always a last-option scenario. Having said that, you can find some decent information on FSMO roles and how to deal with them here: Determining FSMO Role Holders At the end of the very detailed article there are more links to articles that teach you about seizing FSMO roles. Good luck!

It is something I had written myself. We use CMIS instead of SIMS and CMIS relies on a folder containing images of our students. The images are named according to the students' admission numbers. making it very easy to match with an AD user account. While currently containing a hard-coded path, I can modify it to instead look at a path it read from a .INI file, so it'd be more configurable. Equally I can mod it to read AD values from the same .INI, so it will work on other networks, but there is still the issue of mapping usernames to images. Obviously that depends on the naming convention you use. Depending on your setup, and available time, I can look at changing this for you? I wrote another util that checks CMIS daily for any new students. If it finds any, it creates the AD account, Exchange mailbox, home folder, sets quotas and permissions on the home folder, sets the 1st logon password and makes the account a member of the relevant groups. The SAM logon name is Surname + last 4 digits of admission number, e.g. Joe Bloggs becomes Bloggs1234, while the 1st password is Password1234. This means admin staff at the point of registration have definate values to deal with and can issue the student with the relevant detail. Because somebody asked me about doing the same for SIMS I have started on it and currently I am at the stage where I can extract new student details from SIMS. I haven't touched the code for a long while now, due to time constraints.

Except when you start writing code to extract timetable info from your MIS database for the logged on user, in which case you'd need some sort of directory for translating between MIS and AD, so you get the detail for the correct user. Ditto when you start automating user account & Exchange mailbox creation based on values entered into your MIS byadmin staff. I don't mean to sound condascending here, but the unique MIS number is pivotal in automating so many things. There's also the issue of monitoring. If my logs show a specific account tried to access a bypass site then I can easily determine the person from the user name, and I can just as easily check their timetable. We use a password reset utility that also links with the MIS system and displays a photo of the student whose password we're changing. This is because we don't know the names of all our 1200+ students. This photo feature allows us to check that the student resetting the password is the right person and not simply trying to access another student's account. This functionality also relies on us using the MIS number. For those that want user accounts not to reveal the age or identity of students, you can simply use ONLY the MIS admission number. Personally I don't like that idea as it truly will ensure students are just a number, when I prefer to see them as people.

We use CMIS instead of SIMS, but as somebody else pointed out, the admission number is unique and so we use it as part of the student's user names. We use Surname + last 4 digits of admission number, and the admission number is also added into the Initials field. That way even if a student's surname changed halfway through their school career we can still track them easily. All our accounts are arranged by OU and the home folders arranged by year group. This system has it's limitations, but many advantages, too.

If you publish them via WebDav then you can just display them via the Page Viewer component. Alternatively, you can move the files and folders inside the Sharepoint DB, but I wouldn't suggest you do so.

OK, I'm curious here: why are you using 172.18.x.x and not 172.16.x.x?