Search the Community

System Administrator Appreciation Day 2011 is ALL DAY tomorrow 29th July 2011, Lets all hug and celebrate and see whom actually does appreciate us! <passes everyone a virtual beer> System Administrator Appreciation Day Happy SysAdmin Day Everyone! James.

Loreto College are looking for an enthusiastic, organised and technical minded Systems Support Technician to join our IT Support team. To work as part of a team to assist staff and students in using all forms of IT equipment in the college, assist in the running and development of the in-house college IT infrastructure. This is an interesting and hands on technical role with plenty of project works along with BAU. https://www.loreto.ac.uk/vacancies https://www.loreto.ac.uk/wp-content/uploads/2021/08/Vacancy-Application-Form.docx https://www.loreto.ac.uk/wp-content/uploads/2021/11/Job-Description-and-Person-Specification-Systems-Support-Technician-November-2021-1.pdf

I am managing a mainly Windows-based network and have been using an M1 MacBook Pro for a while. What laptops are other Network Managers / Technicians preferences? Any decent Windows recommendations? I love the battery life and efficiency but regular remote sessions and remoting into RSAT etc largely defeats the point of using the Mac as the main machine.

We are looking to appoint an experienced, highly technical individual to lead the support and ongoing development of all network storage, infrastructure and systems for our growing Multi-Academy Trust. The successful candidate will have an expert understanding of supporting and developing Microsoft networks, to include LANs, WANs and server virtualisation and be able to demonstrate the successful implementation of O365 and cloud services. The role provides for a high degree of autonomy, so candidates must demonstrate a logical and organised approach to project management, planning and problem-solving. Full details on this position can be found at: Vacancies - Burnt Mill Academy Trust

Curious how you guys are celebrating SysAdminDay today (assuming you've even heard of it!) Here at Spiceworks, we threw a pizza party for our two IT masters and provided public thanks on the Community site. Share what your companies have been doing. And if it's nothing, you may want to remind the ones in charge that the IT guys hold your online lives in their hands!

A couple of weeks ago I posted a question regarding setting up one of my labs for an upcoming online final exam. A paraphrased summary of the question is below: Having now successfully configured the lab in question and hosted the exam I thought others may find the solution useful. First here is the general description of of our lab environment: Windows 7 clients joined to a Server 2008 R2 hosted domain on a relatively large campus. Network infrastructure under centralized control thereby making physical changes impossible. No practical way of physically isolating the lab in question. Windows domain under centralized control. Only permissions to manipulate department OUs, computer objects, security groups, and GPOs in the domain. The solution I used involves the creation of three GPOs in the AD; actually the first one below was previously in place. Normal Login restriction GPO. This is the preexisting GPO that used in our labs to limit which users are allowed to log into which lab machines. If you have not used this style of GPO before the catch is that the GPO tattoos the client machine. This means that disabling the GPO will not reverse the effects of it. If you need to change the allowed list of users you need to either change the GPO or disable it and use a second GPO to tattoo the client with the changed user list. In this scenario this GPO will be re-applied after the exam is over to allow all the regular uses access to the lab clients. This GPO is linked, enabled but not enforced in the appropriate OU before, during, and after the exam. It is not necessary to modify this GPO specifically for the exam. GPO details: Computer Configuration/Policies/Windows Settings/Local Policies/User Rights Assignment/Allow log on locally Add all users that you normally allow to access to the client machine. Do not forget to add BUILTIN\Administrators and NTAUTHORITY\SYSTEM. In my case this included AD Security Groups that are populated with our department's personnel and students along with a few local groups including one ExamAccounts group. Computer Configuration/Preferences/Control Panel Settings/Local Users and Groups/Group (Name: ExamAccounts) Action: update NOTE: you do not want to use Replace here as a new SID will be created each time the policy is applied. This will mean the group SID will differ from the SID allowed to logon above. Delete all member users: disabled Delete all member groups: disabled Stop processing items on this extension if an error occurs on this item: no Remove this item when it i no longer applied: yes [*]Exam user account GPO. This GPO creates/deletes the local user account to be used during the exam by the students. It can be enabled anytime previous to the exam but only disable it when you are sure that none of the exam files on each machine are no longer needed. Hopefully you have backed up all the files to a central location "just in case" right after the exam anyway. GPO details: Computer Configuration/Preferences/Control Panel Settings/Local Users and Groups/User (Name: exam) User name: exam User cannot change password: true Password never expires: true Account is disabled: true Account expires: never Stop processing items on this extension if an error occurs on this item: no Remove this item when it is no longer applied: yes [*]Computer Configuration/Preferences/Control Panel Settings/Local Users and Groups/Group (Name: ExamAccounts) Action: Update Group name: ExamAccounts Delete all member users: disabled Delete all member groups: disabled Add members: exam Stop processing items on this extension if an error occurs on this item: no Remove this item when it i no longer applied: yes [*]Exam environment GPO. This is the GPO that does all the heavy lifting and provides the actual exam environment. This includes enabling the exam account, restricting the allowed accounts, and setting up the firewall. This GPO must be set to enforced to ensure that its settings overrides any other GPO. Enable this GPO and reboot the machines just prior to the exam. Then after the exam, disable the GPO and reboot the machines for normal access. GPO details: Computer Configuration/Policies/Windows Settings/Local Policies/User Rights Assignment/Allow log on locally Add all users that are allow to access to the client machine during the exam. As above do not forget to add BUILTIN\Administrators and NTAUTHORITY\SYSTEM. BUILTIN\Administrators NTAUTHORITY\SYSTEM ExamAccounts (local group created above) [*]Computer Configuration/Policies/Windows Settings/Windows Firewall with Advanced Security/Domain Profile Settings Firewall state: on Inbound connections: block Outbound connections: block Apply local firewall rules: no Apply local connection security rules: no Display notifications: no [*]Computer Configuration/Policies/Windows Settings/Windows Firewall with Advanced Security/Inbound Rules Add the predefined rule "Core Networking" - Action: allow Remote Desktop - Action: allow, Scope: limited to particular machines or networks as desired Add exceptions for any other particular machines (remote scope set to the IP address) used to remotely administer the machines if needed. [*]Computer Configuration/Policies/Windows Settings/Windows Firewall with Advanced Security/Outbound Rules Add the predefined rule "Core Networking" - Action: allow The one exception to the "Action: allow" is for "Core Networking - Group Policy (NP-OUT)" which must be set to block. This prevents the exam participants from accessing any network drives. Accessing GPO files in the AD is still permitted by a specific targeted rule below. Add rules for specific servers such ad the AD DCs, CAS servers, Moodle server (for handing in exams), A/V update servers, etc. The one catch is that although you may have dc1.mydomain.edu through dc4.mydomain.edu you also have a machine called mydomain.edu which you will need to add in this list; this server hosts the actual GPO files for your domain. Typical settings: Enabled: true Program: any Action: allow Protocol, Local/Remote ports, Local scope, and ICMP settings: any Remote scope: IP address(es) of your server(s) [*]Computer Configuration/Policies/Administrative Templates/Network/Network Connections/Windows Firewall/Domain Profile These settings are here to override any similar settings in other GPOs. Windows Firewall: Allow inbound file and printer sharing exception: disabled Windows Firewall: Allow inbound Remote Desktop exceptions: Enabled - Limit scope as above Windows Firewall: Allow local port exceptions: disabled Windows Firewall: Allow local program exceptions: disabled Windows Firewall: Define inbound port exceptions: disabled Windows Firewall: Define inbound program exceptions: disabled Windows Firewall: Prohibit notifications: disabled Windows Firewall: Protect all network connections: enabled [*]Computer Configuration/Preferences/Control Panel Settings/Local Users and Groups/User (Name: exam) User name: exam User cannot change password: true Password never expires: true Account is disabled: false Account expires: never Stop processing items on this extension if an error occurs on this item: no Remove this item when it is no longer applied: no Apply once and do not reapply: no Using the above configuration I was able to have the remotely flip the lab into exam mode, and then back into regular mode simply by enabling and disabling GPO number 3 above. Once the course instructor confirmed that all exam files were collected and submitted disabling GPO number 2 above removed the local exam account and all files from the lab machines. I'd love to hear your comments and any suggestions for improvements on the above. In the case that you use the above information I'd appreciate hear how it went. Merlin.

I know this question gets asked from time to time, wanted a fresh perspective. Searching MS doesn't seem to be a "best practices" way for creating a home directory is there one? As in GPO drive map versus AD home directory creation in user object? At my current location they use GPO for drive mappings and have always used that method: Drive Map (Drive: H) H: (Order: 6) Action Update PropertiesLetter H Location \\server\users\%username% Reconnect Enabled Currently with the Home Drive H: using GPO there are intermittent issues with it not working. Other drives created with GPO working, just issues with home. Only difference with home is variable used --> %username% I "grew up" in networking learning directory services from the world of Novell Netware and have taken that experience over to the world of MS Active Directory. I remember learning NW Admin where the home directory was created as part of creating a user object, creating users from user template objects. Now that I have suggested creating the home drive in AD where I am now, I get asked to document the reasons for wanting to change things. It sets you back a step when some challenges why you do things a certain way when you've doing that way with no problems for years. Searching for answers on Microsoft site difficult at times looking for best practices. You can find numerous ways on how to do things, but how to do it is not always best practices for using it.

Hi guys, I am wondering if anybody uses any kind of mnemonic rules in everyday sysadmin job or in related fields? Let's share the knowledge! PS Not sure if it's the write branch to ask a question like that, so please move it if necessary

Our independent school client is based near Hounslow. The senior school for boys aged 11-18 is partnered with a prep and pre-school for boys aged 3-11 and girls aged 3-7. The school is highly ranked in the independence schools tables for GCSE results in 2016. Along with the school’s academic excellence it also offers a range of extracurricular activities that take advantage of their excellent facilities such as a state of the art 3G all weather football pitch. The school aims to get the best from its pupils academically whilst preparing them for their futures outside of school life. Systems administrator will be responsible for 3rd line support as well as providing occasional 1st and 2nd line support as well as mapping requirements for new IT projects and deputising for the IT operations manager. This is a highly technical role for somebody with at least five years’ experience, ideally from the education sector. This role will be key to integrating systems, implementing security policies, insuring software licensing, analysing and capacity planning as well as developing budget proposals, monitoring core IT systems and reporting to management. Candidates will have an in depth knowledge of virtualisation, windows server, active directory, cloud based services, firewall and filtering, network services including DHCP, DNS, LDAP, wireless and VPN. This is an excellent opportunity for someone who wants to remain technical but have an input into IT strategy as well as working with a strong support team. Please send your detail to [email protected]

A Senior System Administrator role has become available at Nescot College. Please view the full job spec and apply here You can also send in your CV to [email protected] quoting the job title in the email.