Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
FISHMANPET
Mar 3, 2007

Sweet 'N Sour
Can't
Melt
Steel Beams

skipdogg posted:

You using trace32 for the logs? It should highlight any errors for you and at least give you something to google.

Yeah, using trace32, there aren't any errors that aren't routine. And those *.cpl files in the ccm directory run, so I can execute them just fine from there, it's just like they didn't register properly with the control panel.

Adbot
ADBOT LOVES YOU

InfiniteDonkey
Jul 27, 2007

I think I need a hug.

InfiniteDonkey posted:

I guess i'm going to upload the pictures into active directory. Thanks everyone for your input and advice.

Just a follow up on the subject. I loaded all the user photos into Active Directory and nothing blew up. Only a couple users complaining that their pictures are attached to all their emails, and after explaining how the photos work with GAL they were satisfied.

My colleague told me he had heard some coffeeroom talk in the morning, from a two of approx. 25-40 year old ladies, that went something like this.

:j: : Did you see that there pictures on us in emails now?!?
:byodame: : I did! And i was like OMGWTF "I'm so fat!" i look awful!
:j: : Oh come on girl, your photo ain't so bad, BUT did you see :colbert:'s photo! He used to be hot when the picture was taken! Now he just looks like :backtowork:.

It's nice to know, that sometimes the things i do in the background, can be hottest topics for a few days and pretty much nobody knows it was me who did it!

Tunga
May 7, 2004

Grimey Drawer
I'm not a network admin but I am a software dev and end up doing a bunch of general IT stuff because there is nobody else in this office to handle it. We have a new Dell rack server that just absolutely will not accept me installing server 2003, I'm sure it's a RAID driver issue but I cannot work it out for the life of me.

I want to install Server 2008 but my admins say that we can't do it because this machine needs to be a secondary domain controller and our main domain controller is on Server 2003.

I know for a fact that the above can be done because it's all over the internet and it looks like the steps required are quite simple. Am I wrong? Would this really a herculean effort or does it risk loving up the entire domain or is there something else that I am not appreciating?

(Maybe my admins are goons? Hello if you are! I don't believe you!)

FISHMANPET
Mar 3, 2007

Sweet 'N Sour
Can't
Melt
Steel Beams
Your admins are dumb, so probably not goons. You could install Windows Server 3578 and it would run at Server 2003 domain functional level.

The domain itself determines what functional level its at. Once you replaced all your domain controllers with 2008, you could raise the domain functional level to 2008 level, but newer versions are backwards compatible with older functional levels.

skipdogg
Nov 29, 2004
Resident SRT-4 Expert

2008 is fine, but there's no arguing with folks sometimes.

I don't use Dell servers, but I know HP servers come with a SmartStart DVD that has all the drivers and everything on it and walks you through installing the OS on the server. I would assume that Dell has something similar. Cursory google searches show something like a Dell Systems Build and Update Utility CD or a Unified Server Configurator option somewhere.

Tunga
May 7, 2004

Grimey Drawer

FISHMANPET posted:

Your admins are dumb, so probably not goons. You could install Windows Server 3578 and it would run at Server 2003 domain functional level.

The domain itself determines what functional level its at. Once you replaced all your domain controllers with 2008, you could raise the domain functional level to 2008 level, but newer versions are backwards compatible with older functional levels.

I found some pages like this which suggest some setup is required on the domain controller. Note specifically that the machine I am adding needs to act as a domain controller for our sattelite office so perhaps that makes it more complicated? I mean, I hope you're right, and it does look pretty simple, but it doesn't seem to be quite as simple as just plugging it in and it works.

skipdogg posted:

I don't use Dell servers, but I know HP servers come with a SmartStart DVD that has all the drivers and everything on it and walks you through installing the OS on the server. I would assume that Dell has something similar. Cursory google searches show something like a Dell Systems Build and Update Utility CD or a Unified Server Configurator option somewhere.
Dell has a thing built in to the server as well as an older CD-based thing for this. Neither of them give me the right drivers and it always blue screens. We even tried slipstreaming the drivers from the Dell site into a 2003 install disk and it gave me some other dumb error.

Basically I am at the stage of gently caress this poo poo. Installing a nine year old OS on a server we just bought is absolutely retarded and I want to argue with them about that since I have wasted hours on this for reasons that appear to be laziness on their part.

Tunga fucked around with this message at 16:19 on Jul 17, 2012

peak debt
Mar 11, 2001
b& :(
Nap Ghost
There is nothing special needed to add a 2008 server to a 2003 domain. You just install it, run dcpromo and there you go. You won't get the special features (more robust sysvol replication, readonly DCs) until you upgrade the domain of course but it runs on the same level as the 2003 servers.

Dell has the "Dell Driver Download Manager" which is pretty awesome and lets you make easy batch files that update your hardware.

FISHMANPET
Mar 3, 2007

Sweet 'N Sour
Can't
Melt
Steel Beams

Tunga posted:

I found some pages like this which suggest some setup is required on the domain controller. Note specifically that the machine I am adding needs to act as a domain controller for our sattelite office so perhaps that makes it more complicated? I mean, I hope you're right, and it does look pretty simple, but it doesn't seem to be quite as simple as just plugging it in and it works.
Dell has a thing built in to the server as well as an older CD-based thing for this. Neither of them give me the right drivers and it always blue screens. We even tried slipstreaming the drivers from the Dell site into a 2003 install disk and it gave me some other dumb error.

Basically I am at the stage of gently caress this poo poo. Installing a nine year old OS on a server we just bought is absolutely retarded and I want to argue with them about that since I have wasted hours on this for reasons that appear to be laziness on their part.

Your link doesn't work, but there isn't anything required. I've done it. The DC sees what functional level the server is at and uses that.

E: Here's a technet article that talks about. They realize that you can't upgrade every single DC in the company at once (that would be stupid) so there's the built in functionality to run a newer OS with an older domain.

Is anyone watching your back on this? Depending on your culture and relationship with management you could just install 2008 and promote and then either say you installed 2003 or point out that it just works.

FISHMANPET fucked around with this message at 16:20 on Jul 17, 2012

Tunga
May 7, 2004

Grimey Drawer

FISHMANPET posted:

Your link doesn't work, but there isn't anything required. I've done it. The DC sees what functional level the server is at and uses that.

E: Here's a technet article that talks about. They realize that you can't upgrade every single DC in the company at once (that would be stupid) so there's the built in functionality to run a newer OS with an older domain.

Is anyone watching your back on this? Depending on your culture and relationship with management you could just install 2008 and promote and then either say you installed 2003 or point out that it just works.

Sorry, clipboard fail, link is fixed and should be this:
http://www.petenetlive.com/KB/Article/0000239.htm

I'm not meaning to imply that you guys are wrong, I asked here because I trust this thread more than my admins. But I'm intrigued as to what exactly this is all about if it isn't needed. There are Microsoft pages about it too:
http://technet.microsoft.com/en-us/library/cc754670%28v=ws.10%29.aspx

FISHMANPET posted:

Is anyone watching your back on this? Depending on your culture and relationship with management you could just install 2008 and promote and then either say you installed 2003 or point out that it just works.
I would quite happily do this and my direct boss would back me 100% and it would be hilarious actually. But I'm pretty sure I don't have the required permissions. I can add machines to the domain and that's it.

Tunga fucked around with this message at 16:27 on Jul 17, 2012

Nebulis01
Dec 30, 2003
Technical Support Ninny
If my memory serves, you do have to extend the schema to add a newer DC to the domain, it doesn't change the functional level of the forest or the domain, but it does change the schema version. If by some chance, like me, you have some rear end old program that checks the schema version and refuses to work once you've changed the schema version it's a bit of a pain to roll back.

Most of the time extending the schema doesn't break anything. All you're doing is adding more containers to place poo poo in that the Domain Controllers can use.
For example extending the Schema to 2008 enables a container for certificates and therefore, you can have certificate roaming. This changes the schema version from v31 (2003 R2) to V44 (2008 RTM). It also adds some other containers but you get the general idea.

Doing this on my domain, breaks a custom piece of CMS software that was written when we were running Windows 2000 and it apparently checks to verify that the schema version isn't above 39, once you increment it to 40 it stops functioning.

Also since you have the permissions to install a DC anyway. Check the schema version yourself. If it's above v44 than install 2008 and tell your admin to jump off a bridge. (http://support.microsoft.com/kb/556086)

Nebulis01 fucked around with this message at 16:49 on Jul 17, 2012

Gyshall
Feb 24, 2009

Had a couple of drinks.
Saw a couple of things.
Q: Has anyone found a reliable solution for automated off-site backups?

I've inherited a gently caress-off mess at my job, where the main sales rep has been selling Axcient like it was the second coming of Jesus or something. I’ve had nothing but issues with the product, which I’ll detail in a bit.

It’s basically a bit of a Sales Guy vs Tech Guy stand-off, since the Axcient sales team sells the product as the end-all-be-all (which my Sales Guy regurgitates to the end-user/customer) and when the thing just doesn’t work as advertised, I’m left holding my dick. Not just that, but it is my service team that would end up having to deal with the restoration in the event of failure, not the sales team.

In a number of cases, this has been sold as a replacement for classic Tape Drive => carry your tapes off-site (which I’m honestly not against any more.)

Axcient's solution is basically:

- A rebranded HP server that runs some heavily customized *nix distribution
- Off-site infrastructure that runs on HP hardware
- A P2V solution for taking their proprietary images and turning them into virtual machines
- Exchange/image/file level backup
- After the initial backup on the local appliance, you copy the backups to an external hard drive, which is then sent back to their data center to be “seeded” out to their servers

The issues I’ve had:

- For the past two weeks, they have been having data outages at their data center, so I have a number of customers who have no solid off-site backup, which obviously is a problem
- The P2V virtual image solution does not work a majority of the time for us. We’ve had problems virtualizing or restoring a domain controller or a member server, only to be unable to log into the restored/virtual machine (Error contacting domain.) Axcient’s solution to this is to demote or remove the offending server and join it back onto the domain. In the case of a Small Business Server or an Exchange/Sharepoint server, this seems like A Very Bad Idea
- One of my customers went to restore a file from a backup and was unable to. After dealing with Axcient for about three days, they determined that the version of the firmware installed on the appliance had a bug that prevented restoration of files (ie. The whole loving reason you have the box)
- Axcient claims that they are “agentless” and don’t install software on your servers at all. I found that this was not the case when I found two services and processes running on all my servers, which my antivirus programs were having fits over.
- Twice they have had issues with the hard drive you are supposed to send back to them - once they lost the hard drive, the second time they incorrectly copied the data to their data centers

I guess this is me venting, but at this point I have enough evidence from my work-logs to show that it is counter-productive to deploy this crap, which is what the president of my company has asked us for. In the past, we have used Backup Exec (which also sucks but not as bad as Axcient.) The whole experience with the backup solution has left nothing but a bad taste in my mouth

Tunga
May 7, 2004

Grimey Drawer

Nebulis01 posted:

Also since you have the permissions to install a DC anyway. Check the schema version yourself. If it's above v44 than install 2008 and tell your admin to jump off a bridge. (http://support.microsoft.com/kb/556086)
This would be the best thing but I only appear to have permission to add a domain member, not a controller. (They also seem to just have floating bridges there so I don't think jumping off them is very effective.)

I have convinced our admin to at least read the Microsoft page so we'll see where that goes!

Their current plan is to have me try to install 2003 on ESXi instead. This seems like a stupid overcomplication and my actual boss is getting annoyed about how much time I am spending on this so it'll be fun to see how things end up, especially if that doesn't work. Who's betting on the same dumb driver errors? Meeeeee!

Anyway thanks to the people who replied so fast, it was very helpful in trying to convince them that they are dumb.

peak debt
Mar 11, 2001
b& :(
Nap Ghost

Gyshall posted:

Q: Has anyone found a reliable solution for automated off-site backups?

As far as my experience with "tape drive - carry offsite" goes, it just doesn't work. It does work for a month or two then the assistant/receptionist who's supposed to do the work inevitably gets lazy or fucks up the sorting. By the time you actually have a hardware failure and need to disaster recovery something you can be 100% sure that Murphy is going to gently caress you.

The domain unjoin thing is most likely related to stale backups. If you backup a computer, then leave the backup lying around for weeks while the live system does all kinds of edits to its account, the domain will get confused if there's suddenly a version from the past showing up and claiming to be the genuine thing, and refuse authentication. It seems that Windows 8 will improve on this.

Personally as far as bare metal backups go, I've had great experiences with Disk2VHD from SysInternals. On Windows 6.x it perfectly backs up the current hard disk, and once you launch the virtual machine or restore it to a physical one you can just boot and log in provided the backup is not more than a week old or so. Note that starting a recovered copy of a system where it can contact the domain will kick off the old PC from the domain though.
It doesn't work that well with Windows XP because of the whole HAL/drivers problems inherent to that platform, you will most likely have to sysprep a computer after restoring it.

As far as your problems with Axcient go, this is really more of a political issue... Best advice I can give you there is to document exactly what went wrong when, filing emails, ticket numbers and short descriptions so that you have something solid to back your opinion when the poo poo hits the fan (or you eventually have had enough and want to talk to the CEO about the contract). If you actually have solid proof they lost the hard disk (invoice from the courier showing that it was sent out and an email from them telling that they never got anything) that's already pretty good and proving that they suck.

Tunga
May 7, 2004

Grimey Drawer

Tunga posted:

I have convinced our admin to at least read the Microsoft page so we'll see where that goes!
Outcome: we have talked about this and decided that we will install 2003.

:bang:

skipdogg
Nov 29, 2004
Resident SRT-4 Expert

Anyone rolled out SCCM 2012 in a multi site environment? Trying to plan our sites out, but just getting confused as gently caress to be honest.

Cpt.Wacky
Apr 17, 2005
I'm trying to get Silverlight deployed in this new environment (2008 R2 and Win7 x64), but I'm not sure what I'm doing wrong.

Local WSUS server has Silverlight checked under Products and Classifications. Automatic approval is set for everything (including Feature Packs) except Drivers, Service Packs and Tools for all computers. I checked under All Updates and found IE9 and two Silverlight updates were Unapproved because they need the EULA accepted. The only other unapproved updates are for the Malicious Software Removal Tool. I approved the Silverlight and IE9 updates and then manually checked for updates on a workstation and it found IE9 but not Silverlight.

I can manually deploy Silverlight through WPKG but I'd rather do it through WSUS if I can.

MyLightyear
Jul 2, 2006
A blindness that touches perfection,
But hurts just like anything else.

skipdogg posted:

Anyone rolled out SCCM 2012 in a multi site environment? Trying to plan our sites out, but just getting confused as gently caress to be honest.

Do you have an existing 2007 deployment? Things have changed significantly with 2012, Microsoft's official guidance is to collapse your sites as many of the reasons you'd use a child site no longer apply.

If you are looking at multiple primary sites you will also needs management site which acts as the root and does not manage clients directly.

skipdogg
Nov 29, 2004
Resident SRT-4 Expert

Yeah, that's what I'm having a hard time wrapping my head around. We don't have an existing 2007 deployment, it never really left the testing phase, but it's what I'm familiar with.

I went in planning on a CAS with 2 or 3 primary sites but the more I read technet and the forums the general consensus is if you are not >100K endpoints DO NOT INSTALL A CAS. We'll be dealing with 4 to 5K clients tops.

We have 4 significant sites in the US, 2 in Europe and a significant site in India and Brazil... Everything new I'm reading says we'll be fine with just a single primary site and local distribution points across the enterprise. India and Brazil may get secondary sites as the WAN links there loving suck (4 megs if your lucky), but the rest of the company sites all have 45Mbit MPLS connections and the new 2012 stuff says thats fine.

I'll pick the consultants brain more on Monday, but for 2012 everything I've seen says for our environment the single primary site should be fine. I know right now you can't roll a Primary site into a CAS after the fact, but supposedly SP1 will fix this, so down the road if we need a CAS, we should be able to do that.

MyLightyear
Jul 2, 2006
A blindness that touches perfection,
But hurts just like anything else.
I think a single primary with distribution points for well connected sites and secondaries for where you want to roll up client health to a single point for transfer across your crap links will be fine. Your deployment strategy is sound given your amount of users and you should be avoiding the complexity of a CM and multiple Primary sites if you can.

If you are using Windows 7 Enterprise you can also take advantage of BranchCache for those poor performing links. Provides basic WAN accelleration without having to invest in a Riverbed etc.

skipdogg
Nov 29, 2004
Resident SRT-4 Expert

Thanks for the info, 2012 seems like a completely different product from 2007

I did manage to get a 5 day voucher from our Software Assurance credits for System Center 2012 training in a couple weeks but the install starts Monday so that's no help for me right now. The sanity check on the install is much appreciated, so thanks again!

MyLightyear
Jul 2, 2006
A blindness that touches perfection,
But hurts just like anything else.
It really is. 2007 felt so cobbled together and inflexible, built to support gigantic Enterprises but in doing so made it horrible to use for just about everyone. It also had probably the worst performing instance of MMC in the history of Microsoft.

It really showed how hard it was to move on from given there was such a large gap between the two products and the fact 2007 had an R3 release which I don't think a single other MS product has ever got.

peak debt
Mar 11, 2001
b& :(
Nap Ghost
The 2012 MMC isn't really any better though, mine that I run in a site with 1500 PCs needs around 2GB of RAM and 2GHz of processing power.

FISHMANPET
Mar 3, 2007

Sweet 'N Sour
Can't
Melt
Steel Beams
So I've got SCCM deploying to an iMac just fine, except that it requires me to manually intervene halfway through or it won't boot.

I'm deploying an image from a machine with only one partition to a machine with 4 partitions, so when it boots up the first time it boots to nothing and there's just a blinking cursor. Booting into a Windows 7 disk and running these commands fixes it:
code:
Bootrec.exe /FixMbr 
Bootrec.exe /FixBoot 
Bootrec.exe /RebuildBcd 
I'm not sure if they're all necessary, but after doing that it boots.

I can't run these from SCCM because they're not on the WinPE image. So I need some way to set the active partition in the deployed image. Worst case scenario I could copy the bootrec binaries to a shared folder and mount it and use those to run the commands, but that seems really hacky.

Zero VGS
Aug 16, 2002
ASK ME ABOUT HOW HUMAN LIVES THAT MADE VIDEO GAME CONTROLLERS ARE WORTH MORE
Lipstick Apathy
I've got a head scratcher here. Corporate is merging all small domains into one huge one. I'm on Windows XP clients and 2k3 servers. User is changed from domainA\username to domainB\DifferentUsername. I rename her old homefolder from her old username to the new one. Then I change the homefolder path in her Active Directory profile to match. I log in with her, and she has full access to the Homefolder, with complete folder redirection on all of it. Mind you, I went back and checked the permissions on the folder, the only two permissions on it are domainA\username and domainA\Admins.

How the hell is the ACL / NTFS allowing this?

pbow9
May 24, 2001

Zero VGS posted:

I've got a head scratcher here. Corporate is merging all small domains into one huge one. I'm on Windows XP clients and 2k3 servers. User is changed from domainA\username to domainB\DifferentUsername. I rename her old homefolder from her old username to the new one. Then I change the homefolder path in her Active Directory profile to match. I log in with her, and she has full access to the Homefolder, with complete folder redirection on all of it. Mind you, I went back and checked the permissions on the folder, the only two permissions on it are domainA\username and domainA\Admins.

How the hell is the ACL / NTFS allowing this?

SID history, most likely.

Sudden Loud Noise
Feb 18, 2007

skipdogg posted:

Thanks for the info, 2012 seems like a completely different product from 2007

I did manage to get a 5 day voucher from our Software Assurance credits for System Center 2012 training in a couple weeks but the install starts Monday so that's no help for me right now. The sanity check on the install is much appreciated, so thanks again!

I'm using both 2007 and 2012 at the moment. If it's any consolation, once it's up and running 2012 is vastly easier to manage everything.

Oh and do yourself a favor and learn Orchestrator so you never have to work again.

theperminator
Sep 16, 2009

by Smythe
Fun Shoe
Can anyone help regarding SNMP Monitoring of Windows servers?
I've set up cacti graphing for a couple of Windows 2008 R2 RDS Servers, but it's showing 135 users logged in when the actual number is something like 30, even when I do an SNMPWalk of the machine it shows the same high value.

Icesler
Jul 7, 2005
I am pretty embarrassed to be asking this, but this is how the director runs our department so here it goes: Does anyone know of some software that I can use to report an excess of 10 or more failed logins from user accounts and then have it automatically send an email to them asking them if they are aware of the failed login attempts? I guess we need it for auditing purposes but it doesn't matter what the response is from then end user.

I know that it is rather retarded and I have told the senior sysadmin and the director that I could probably just write a powershell script to handle that but they seem to think scripts are hacker voodoo. They have requested that I find software to replace our current software which is some Event Analyst thing that only generates a report that I have to manually go through each morning. Is there something simple I could use or would I be better off just trying to convince them to let me write something? This is in a 2003 environment. God, I feel dumb asking this.

jassa
Nov 7, 2005

"He's so awesome!"
He really is!
My workplace has recently migrated from Exchange 2003 to Exchange 2010. Before the migration all Service Desk staff had full access permission for every mailbox on our server. Apparently this was in place so Service Desk could easily manage mailbox permissions for users. Since the migration, they haven't had these permissions and are complaining loudly about it, passing the work on to Desktop Support instead of just showing the users how to manage their own mailbox permissions (which is what I think they should be doing).

My managers are willing to change policies/procedures and tighten up security by reducing Service Desk's access, but want me to find some best practice documentation/examples regarding Service Desk administration/management of mailbox-related issues with Exchange 2010. New account creation and mailbox permissions are the things we're most interested in at the moment.

I've tried googling but that's not bringing up anything especially useful. Can anyone here help point me in the right direction?

Zero VGS
Aug 16, 2002
ASK ME ABOUT HOW HUMAN LIVES THAT MADE VIDEO GAME CONTROLLERS ARE WORTH MORE
Lipstick Apathy

Icesler posted:

I am pretty embarrassed to be asking this, but this is how the director runs our department so here it goes: Does anyone know of some software that I can use to report an excess of 10 or more failed logins from user accounts and then have it automatically send an email to them asking them if they are aware of the failed login attempts? I guess we need it for auditing purposes but it doesn't matter what the response is from then end user.

I know that it is rather retarded and I have told the senior sysadmin and the director that I could probably just write a powershell script to handle that but they seem to think scripts are hacker voodoo. They have requested that I find software to replace our current software which is some Event Analyst thing that only generates a report that I have to manually go through each morning. Is there something simple I could use or would I be better off just trying to convince them to let me write something? This is in a 2003 environment. God, I feel dumb asking this.

How often does anyone really gently caress up a password 10 consecutive times? If that happens, forget emailing the user (they probably can't log in to check their email anyway), have it email the IT department so you can slap the poo poo out of him/her and reset their password.

Or, have it email everyone at work and people will be automatically shamed to the point that no one will get anywhere near 10 without calling you for help. :dealwithit:

Anyhoo, Googling tells me that 2008 lets you schedule tasks to trigger on security events, but it's not built in to 2003. Why not use Group Policy to lock the user's account out at 10 failed attempts in a row, and then you can write a very simple script to email the IT department with the event text when that occurs. A script for that would probably be simple enough that you can explain each line in the script for your bosses and demonstrate it.

If you're willing to settle for emailing IT staff instead of the offending user on lockout, there's a way to do this with no scripts. Install the freeware program Spiceworks on a server, give IP ranges for it to find your other servers in a scan, go to Settings -> Monitors and Alerts -> Add an Email Alert whenever event 644 (account lockout on 2003 Server) is triggered on a server.

Icesler
Jul 7, 2005

Zero VGS posted:

How often does anyone really gently caress up a password 10 consecutive times? If that happens, forget emailing the user (they probably can't log in to check their email anyway), have it email the IT department so you can slap the poo poo out of him/her and reset their password.

Or, have it email everyone at work and people will be automatically shamed to the point that no one will get anywhere near 10 without calling you for help.

Anyhoo, Googling tells me that 2008 lets you schedule tasks to trigger on security events, but it's not built in to 2003. Why not use Group Policy to lock the user's account out at 10 failed attempts in a row, and then you can write a very simple script to email the IT department with the event text when that occurs. A script for that would probably be simple enough that you can explain each line in the script for your bosses and demonstrate it.

If you're willing to settle for emailing IT staff instead of the offending user on lockout, there's a way to do this with no scripts. Install the freeware program Spiceworks on a server, give IP ranges for it to find your other servers in a scan, go to Settings -> Monitors and Alerts -> Add an Email Alert whenever event 644 (account lockout on 2003 Server) is triggered on a server.

I probably have 15+ users everyday with >10 failed logins. After 4 failed attempts their account locks out and needs to be unlocked. Usually the excessive failed logins are due to people forgetting to change the password on their iphones or forgetting what their new password is. I have a spiceworks server that I set up and messed around with for a bit but management doesn't support it since they spent so much money on Altiris. We are supposed to be upgrading to 2008 but who knows how that project is going. I will look further into the spiceworks solution though. Thanks for your help.

theperminator
Sep 16, 2009

by Smythe
Fun Shoe
Just thought I'd post an update in case anyone else was looking for a solution to monitoring RDS Sessions using Cacti or something similar.

Windows SNMP reports logins for services, file shares etc so using SNMP to graph just RDS sessions is not possible, my solution was to use WMI to get the data.

I used the wmic client for linux combined with this cacti plugin for it: http://www.parkingdenied.com/2008/12/11/wmi-monitoring-with-cacti/

Cpt.Wacky
Apr 17, 2005
What is the right way to set up wireless for an enterprise windows environment?

I've got a 2008 R2 domain and all Windows 7 clients. The wireless network is a few Cisco Aironet 1140s with WPA2 and a pre-shared key. The laptops are connected by logging in, selecting the SSID from the list and entering the password. The trouble is that the laptop doesn't seem to be joining the network until a user logs in. They'll get the warning about not being able to load their roaming profile. Subsequent logins work fine since it's already connected.

What should I be looking at? RADIUS? 802.1X? Certificates instead of PSK?

sanchez
Feb 26, 2003
I'd use NPS/RADIUS, this is a pretty good guide

http://techblog.mirabito.net.au/?p=87

It can take some tweaking to work, event logs on the client and server are your friend.

Setup a guest SSID for peoples iphones and other random devices they want to connect that gets internet access only.

Cpt.Wacky
Apr 17, 2005
Thanks, that looks like just what I needed. Guest SSID is already up and running.

InfiniteDonkey
Jul 27, 2007

I think I need a hug.
Just finished installing SCCM 2012 with a Microsoft technician.

For first time in a long time i'm truly excited about Configuration Manager 2012 :allears:

The software self-service portal will be a real time saver once we start taking advantage of it fully.

skipdogg
Nov 29, 2004
Resident SRT-4 Expert

InfiniteDonkey posted:

Just finished installing SCCM 2012 with a Microsoft technician.

For first time in a long time i'm truly excited about Configuration Manager 2012 :allears:

The software self-service portal will be a real time saver once we start taking advantage of it fully.

We're rolling it out as well. I've spent a week with a consultant setting it up, and this week has been all MS Official Training and I feel like I've barely scratched the surface.

We're a complicated environment though. 2 forests, global sites, blah blah blah. I've ran into so many 'gotchas' and headscratching moments it's insane. If this was just a single forest single domain it would be so much easier.

skipdogg fucked around with this message at 14:42 on Aug 9, 2012

MyLightyear
Jul 2, 2006
A blindness that touches perfection,
But hurts just like anything else.

InfiniteDonkey posted:

Just finished installing SCCM 2012 with a Microsoft technician.

For first time in a long time i'm truly excited about Configuration Manager 2012 :allears:

The software self-service portal will be a real time saver once we start taking advantage of it fully.

I recently got out of the consulting space and moved in house for a mining company and we are also rolling it out. I'm really excited by the improvements it's going to bring this company, particularly around how much more intuitive and easy they've made Software Updates.

Also looking at Service Manager 2012 as a replacement for ManageEngine.

Moey
Oct 22, 2010

I LIKE TO MOVE IT

InfiniteDonkey posted:

Just finished installing SCCM 2012 with a Microsoft technician.

Yea SCCM 2012 buddy!

Currently working on an install myself. Currently I have no outside guidance (other than the interwebs), so I expect I may have to trash and rebuild, but I am excited to really see what I can get out of this.

Edit:

I just ordered a copy of this guy yesterday as well.

http://www.amazon.com/System-Center-Configuration-Manager-Unleashed/dp/0672334372

Adbot
ADBOT LOVES YOU

skipdogg
Nov 29, 2004
Resident SRT-4 Expert

Definitely post up if you guys run into any issues with 2012 SCCM. Getting some knowledge sharing going on in this thread would be awesome.

I ran into one today that really wasn't documented too well. I put a DP on a Win2K3R2 server and it would not get packages copied to itself. IIS and BITS was good, but Remote Diff Compression wasn't turned on by default. Luckily google-fu eventually lead me to this blog post

http://blogs.msdn.com/b/george_bethanis/archive/2012/05/10/cm2012-packages-are-not-distributed-to-windows-server-2003-r2-dps.aspx

Runing a .5MB file fixed it and now my DP is happy.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply