GreenNight posted:

We were told to install a KMS server and use that. As long as the OEM desktops have keys on it, it's fine to have them all activate with KMS even if you don't own volume licensing.

Orcs and Ostriches posted:

Got a weird issue with Windows 7 deployment with WDS here.

We just started using a 64 bit image. Instead of using a master computer with an image on it, that we brutalize and repeatedly reimage with whatever configurations we need to change, I threw together a hyper-v server. In theory, it seems to work great. I have a couple base images, and snapshots of the various configs I need to deal with. The problem comes when I try to deploy to a 64 bit machine:

I create the system in Hyper-V, initially using a local account I create - IT, and run sysprep. I capture the image in WDS, and then reboot the VM. The system goes through the properly configured startup, thanks to my Unattend.XML file.

I deploy that (sysprepped) image to a new laptop with WDS. During startup, every single configuration change I make is ignored, and I have to do the regular windows 7 install wizard. <- This is my big wtf moment. It's a 64 bit VM, 64 bit laptop. The sysprep file only has AMD64 configs. Anyways, I have to create a local account to proceed in the wizard, so I make IT2.

At this point, I can log on to the laptop with the local account I created before sysprepping the original (IT). IT2, which I just created, won't log in due to login service errors. I can sysprep the system again, using the same Unattend.XML file that's still on the hard drive, and reboot the system. It comes back with all the modifications and specified in the unattend file...

Anyone seen something like that before? I'd like to cut out the bullshit steps after doing the sysprep the first time.

Orcs and Ostriches posted:

Another question. Is Nagios still the go-to monitoring solution? That'll probably be my next project, so I'm wondering where else (if anywhere) I should look?

Mr. Clark2 posted:

I'm using Opsview (a Nagios fork), I found it much easier to set up and configure but YMMV.

chizad posted:

(Crossposting here and the GPO thread)

Is there any way to create a GPO for IE compatibility view settings that only applies to a particular IE version (IE11, in this case)? From what I can tell, the Group Policy Preferences settings only let you target IE10 or greater (without making a distinction between IE10 and IE11) and the root\cimv2\Applications\MicrosoftIE WMI namespace was removed after XP. Unless my google-fu is failing me, that means the only way to determine IE version is by grabbing the version number property of iexplore.exe, which seems incredibly hacky. Is there some other option (using MS's native tools) I'm overlooking?

Or alternatively, is it possible to add just a subdomain to the compatibility view list? I really just need to have http://bar.foo.com use compatibility mode, but it only seems to let me add *.foo.com to the whitelist.


For context, I find myself in an annoying position. Because MS didn't bother testing to see if the Business Portal portion of Dynamics SL 2011 works in IE11, I need to push out a GPO to force time.company.com to use compatibility mode. However, that means that https://www.company.com is also forced to use IE7 compatibility mode, but it doesn't work properly with anything older than IE8.

If I could either have the GPO only apply to IE11, or have it just use compatibility mode for time.company.com, that would solve my problem.

potato of destiny posted:

There's a GPO setting for "Use policy list of internet explorer 7 sites". The issue with it is it prevents users from adding their own entries to the compatibiltiy view list. I think it works on any IE8+.

e: according to the help text they can add/remove any except the ones in the gpo.

Caged posted:

If you have control over the web server hosting the application then you can send an HTTP header that turns on compatibility mode.

http://msdn.microsoft.com/en-us/library/jj676913(v=vs.85).aspx

Snorri posted:

2) How much of a pain is it to rename my DC from dot whatever to dot local? I thought I was a clever boy and matched our external domain suffix to our internal. Turns out I am a dumb gently caress and this causes intermittent DNS issues. Obviously this is my first DC from scratch.

GreenNight posted:

Probably be easier to build a new DC and migrate the roles over and promote/demote.

Snorri posted:

Will renaming cause that much of a headache you think? I figured it would but had to ask. Thanks SkippDogg and nexxai for that info, will use dot com if I do end up renaming.

Caged posted:

All I've heard about renaming a domain is not to do it.

nexxai posted:

Do NOT do this. Rename it to .internal.company.com - as of November 1, 2015, you will never be able to get a publicly-trusted SSL cert signed for any PC with a .local hostname as it can't be verified by the CA.

Source: http://support.godaddy.com/help/article/6935/phasing-out-intranet-names-and-ip-addresses-in-ssls

FISHMANPET posted:

I upgrade our SCCM 2012 to R2, becuase I was really excited about some of the new Powershell Cmdlets.

And what a crock of poo poo. Incomplete documentation, wrong documentation, functions that just plain don't do anything.

Specifically, get-cmdevice is supposed to return an object to be used with commands like new-cmdevicevariable, but get-cmdevice returns an object of a different type than new-cmdevicevariable expects. new-cmdevicevariable can also use a resourceID, but when you actually use that, it just doesn't do anything.

I've actually done the best I can to file a bug on the first issue: https://connect.microsoft.com/Confi...mdevicevariable

FISHMANPET posted:

I upgrade our SCCM 2012 to R2, becuase I was really excited about some of the new Powershell Cmdlets.

And what a crock of poo poo. Incomplete documentation, wrong documentation, functions that just plain don't do anything.

Specifically, get-cmdevice is supposed to return an object to be used with commands like new-cmdevicevariable, but get-cmdevice returns an object of a different type than new-cmdevicevariable expects. new-cmdevicevariable can also use a resourceID, but when you actually use that, it just doesn't do anything.

I've actually done the best I can to file a bug on the first issue: https://connect.microsoft.com/Confi...mdevicevariable

Maneki Neko posted:

Why wouldn't you just have an internal CA at that point?

FISHMANPET posted:

lol internet. posted:

Oh yay, someone I can talk SCCM 2012 R2 with. I just spent the last month setting up SCCM at my new company. I've setup 2007 in the past. I thought the Update component would be better, but at the end of the day, it still sucks. A bit more manageable but still overhead as software update groups handles max 1000 updates.

Some quick questions I'll dump in the event you might have an answer to:

1. I'm re-imaging a machine. When it gets re-imaged it comes back with the same name as previously. This would be fine if it didn't start installing apps that might be in collections which have mandatory advertisements to them. Any idea? My 2007 setup always just created a new record with a MININT-* hostname, which I was totally fine with.

2. If you set policies via collections\SCCM agent (ie. power management) users are now able to override those changes?

3. Have you successfully got WOL working? How did you go about enabling WOL on the workstations?

4. Are you Apply all updates for OSD? I'm trying to do a build and capture while applying all updates, but it says download 140 updates, then just ends that task. (I know, I should probably look at the logs, but just got the issue when I was leaving for the day.)


edit: Non SCCM, but what the gently caress, citrix is so lame and overprice. Can anyone tell me why people still use it? Sure it's super secure, but there's tons of alternatives. We have it in a company of 75 people. Maintenace\Software Assurance for it is like 10,000\year almost. That is absolutely insane when you compare it to other possible alternatives.

The whole token poo poo is lame, and pretty annoying. Half the time I forget to bring the token with me.