Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Gucci Loafers
May 20, 2006

Ask yourself, do you really want to talk to pair of really nice gaudy shoes?


Symantec Endpoint protection might do what you're looking for, I've used it and it's ok but not nearly as good as Bitlocker.

Adbot
ADBOT LOVES YOU

skipdogg
Nov 29, 2004
Resident SRT-4 Expert

I've had good luck with Sophos products. SMB's are not their target market though. I'm also not sure if it does remote wipe. Might be worth researching their solution though.

hihifellow
Jun 17, 2005

seriously where the fuck did this genre come from

skipdogg posted:

I've had good luck with Sophos products. SMB's are not their target market though. I'm also not sure if it does remote wipe. Might be worth researching their solution though.

I'm working on implementing Sophos SafeGuard right now and I don't think it does remote wiping? At least I haven't read anything about it or seen the option for it in the console

lol internet.
Sep 4, 2007
the internet makes you stupid
Any idea how much the MS Techs over in redmond make for their specialized enterprise support?

I assume they make decent money.. but I could be wrong?

skipdogg
Nov 29, 2004
Resident SRT-4 Expert

Glassdoor shows 77K for a support engineer and 99K for a senior support engineer. The PFE's all make 6 figures.

I've been impressed every time I've had to contact MS support

devmd01
Mar 7, 2006

Elektronik
Supersonik
Yeah, once you make it past tier 1.


So i'm rebuilding a 4-node 2008r2/sql2012 cluster with 10 instances. Not every instance is on every node, but by the end of this they will be.

I uninstalled each instance from the first node, evicted it from the cluster, reformatted/remediated hardware issues and network cabling, and now it's back in to the cluster. Adding instances back to it is godawful slow, on the order of 2 hours just to launch the sql installer, an hour to get through the install options/selecting instance/adding service accounts, and another 1-2 hours to install the instance. What, if anything, can I look at to speed this up, or is it just a result of me having a 10-instance node with 60+ clustered disks? Looking at the SQL setup log, it takes over an hour just for action DiscoverClusterData.

Gyshall
Feb 24, 2009

Had a couple of drinks.
Saw a couple of things.
Christ, without knowing much more about your environment, that is tough to say. I've never seen SQL take that long to install, even in a clustered environment.

Something you inherited? I usually take the approach to create a "new" cluster according to best practices, then move the data to that if it is at all possible to do so.

incoherent
Apr 24, 2004

01010100011010000111001
00110100101101100011011
000110010101110010

Gyshall posted:

Try using Connection Manager Administration Kit, it is a feature in Windows server.

Also make sure you have the latest GPO in your domain. You can get them here.

Zero VGS
Aug 16, 2002
ASK ME ABOUT HOW HUMAN LIVES THAT MADE VIDEO GAME CONTROLLERS ARE WORTH MORE
Lipstick Apathy
Is there a good site for understanding Microsoft licensing. This poo poo is a horrible nightmare.

I have 200 laptops that shipped with OEM Win 8 Pro and want to upgrade them to Enterprise so that I can use AppLocker/BitLocker/Windows-To-Go.

Now I'm reading some bullshit about how I need software assurance to use Windows to Go. Then I'm reading some other bullshit about how Software Assurance entitles me to run Enterprise on these laptops without actually paying for an Enterprise upgrade because Software Assurance somehow includes it.

Sacred Cow
Aug 13, 2007

Zero VGS posted:

Is there a good site for understanding Microsoft licensing. This poo poo is a horrible nightmare.

I have 200 laptops that shipped with OEM Win 8 Pro and want to upgrade them to Enterprise so that I can use AppLocker/BitLocker/Windows-To-Go.

Now I'm reading some bullshit about how I need software assurance to use Windows to Go. Then I'm reading some other bullshit about how Software Assurance entitles me to run Enterprise on these laptops without actually paying for an Enterprise upgrade because Software Assurance somehow includes it.

Here you go -

http://www.microsoft.com/licensing/about-licensing/windows8-1.aspx

They hide a lot of stuff behind the SA including WTG/AppLocker. Luckily BitLocker is available on Pro unlike 7 which required Enterprise. Its weird that they stopped requiring an SA to even get a license for Enterprise. Its not much better then Pro without all the SA benefits.

Nebulis01
Dec 30, 2003
Technical Support Ninny

Zero VGS posted:

Is there a good site for understanding Microsoft licensing. This poo poo is a horrible nightmare.

I have 200 laptops that shipped with OEM Win 8 Pro and want to upgrade them to Enterprise so that I can use AppLocker/BitLocker/Windows-To-Go.

Now I'm reading some bullshit about how I need software assurance to use Windows to Go. Then I'm reading some other bullshit about how Software Assurance entitles me to run Enterprise on these laptops without actually paying for an Enterprise upgrade because Software Assurance somehow includes it.

I'd call Microsoft directly at that quantity you're a fit for a Select agreement if Windows is the only thing you're going to purchase. If you have a trusted VAR for MS you could call them as well.

Since every license Microsoft sells via Open/Select/Enterprise agreements is an upgrade they will be Windows Enterprise Upgrades. Also since you mentioned wanting to use Bitlocker (and I assume MBAM to manage it?) the product you're after is microsft p/n CX2-00024 (Windows Enterprise Upgrade w/ MDOP and SA)

Sacred Cow posted:

Its weird that they stopped requiring an SA to even get a license for Enterprise. Its not much better then Pro without all the SA benefits.

I'm sure it's pretty much for Anywhere Access and Bitlocker in Win7.

Nebulis01 fucked around with this message at 15:05 on Oct 21, 2014

Thanks Ants
May 21, 2004

#essereFerrari


I think it's bullshit that you can have 200 laptops with Windows 7 Pro OEM but to be able to buy SA you need to purchase 200 Windows licenses.

KillHour
Oct 28, 2007


I'm trying to figure out whether we need to sell CALs with our recording servers. We sell servers that have a specialized software for recording surveillance cameras (Milestone). We're looking to sell these servers through distribution. Do users using a client software to view footage recorded on this server need CALs?

CLAM DOWN
Feb 13, 2007




KillHour posted:

I'm trying to figure out whether we need to sell CALs with our recording servers. We sell servers that have a specialized software for recording surveillance cameras (Milestone). We're looking to sell these servers through distribution. Do users using a client software to view footage recorded on this server need CALs?

Licence requirements will likely depend on the software itself.

Thanks Ants
May 21, 2004

#essereFerrari


If it's a Windows Server providing services then the clients that connect to it will need to be covered by a CAL, either a User or Device. But any company with a Windows server (should) already have those CALs. I guess it can get messy if you're selling a box with Server 2012 R2 on and the existing CALs are only 2008.

I think this is why a lot of people go "gently caress it" and shove Windows 7 on.

KillHour
Oct 28, 2007


Thanks Ants posted:

If it's a Windows Server providing services then the clients that connect to it will need to be covered by a CAL, either a User or Device. But any company with a Windows server (should) already have those CALs. I guess it can get messy if you're selling a box with Server 2012 R2 on and the existing CALs are only 2008.

I think this is why a lot of people go "gently caress it" and shove Windows 7 on.

So this applies even if the software providing services is a third party program, and not a Microsoft program? Even though the only way to access the data stored on the server is through another 3rd party program on the desktop? Like, nobody's accessing the data directly, it's getting streamed to the viewing program, which is decoding and displaying the streams.

CLAM DOWN posted:

Licence requirements will likely depend on the software itself.

The software has its own licensing requirements, if that's what you mean.

I've seen a lot of these systems out there, and I've never seen anyone buy CALs for the server it's running on.

Edit: Also, it's quite possible that a lot of these companies we're selling to don't have an existing server. We're selling this as an embedded appliance, so expecting the customer to understand CALs kind of defeats the purpose.

KillHour fucked around with this message at 23:58 on Oct 21, 2014

Zero VGS
Aug 16, 2002
ASK ME ABOUT HOW HUMAN LIVES THAT MADE VIDEO GAME CONTROLLERS ARE WORTH MORE
Lipstick Apathy

Nebulis01 posted:

I'd call Microsoft directly at that quantity you're a fit for a Select agreement if Windows is the only thing you're going to purchase. If you have a trusted VAR for MS you could call them as well.

Some Googling suggests that Select has been phased out for Software Assurance. Also, kill me, I've been researching this poo poo for 12 hours straight.

CLAM DOWN
Feb 13, 2007




KillHour posted:

So this applies even if the software providing services is a third party program, and not a Microsoft program? Even though the only way to access the data stored on the server is through another 3rd party program on the desktop? Like, nobody's accessing the data directly, it's getting streamed to the viewing program, which is decoding and displaying the streams.


The software has its own licensing requirements, if that's what you mean.

I've seen a lot of these systems out there, and I've never seen anyone buy CALs for the server it's running on.

Edit: Also, it's quite possible that a lot of these companies we're selling to don't have an existing server. We're selling this as an embedded appliance, so expecting the customer to understand CALs kind of defeats the purpose.

If you're running a 3rd party problem, you don't buy Microsoft CALs for that. MS CALs are for something like SQL Server, or Remote Desktop Services, etc. I'm not familiar at all with your application but I hope that makes a little sense.

Thanks Ants
May 21, 2004

#essereFerrari


I've always been told that it doesn't matter what the software was, if it was running on Windows Server then you were in CAL territory. Although you could probably phone up 5 different reps and get different answers.

CLAM DOWN
Feb 13, 2007




Thanks Ants posted:

I've always been told that it doesn't matter what the software was, if it was running on Windows Server then you were in CAL territory. Although you could probably phone up 5 different reps and get different answers.

We use datacentre licencing for internal use only so that totally may be possible. We don't do deliverables. And you're right, call 5 reps and probably get 5 answers. The only thing more obtuse than MS licencing is Oracle licencing.

parasyte
Aug 13, 2003

Nobody wants to die except the suicides. They're no fun.

KillHour posted:

So this applies even if the software providing services is a third party program, and not a Microsoft program? Even though the only way to access the data stored on the server is through another 3rd party program on the desktop? Like, nobody's accessing the data directly, it's getting streamed to the viewing program, which is decoding and displaying the streams.

Officially, yes. Every user either needs an individual user CAL or the device they are using needs a device CAL. It doesn't matter that they aren't accessing the feed in the server directly, they are communicating with a service that is running on the server. The license terms for all Microsoft software also say that multiplexing or other ways to share connections will not reduce the number of CALs required.

A frequent example I see is DHCP or DNS - if a Windows Server is hosting DHCP server or DNS server, then a CAL is required for each person getting an IP, or making DNS requests, whether they work for you or not.

Thanks Ants
May 21, 2004

#essereFerrari


I want some billionaire to bring a test case against MS for this CAL bullshit. It just reeks of a scam once you've already paid for the server license and the client license.

Zero VGS
Aug 16, 2002
ASK ME ABOUT HOW HUMAN LIVES THAT MADE VIDEO GAME CONTROLLERS ARE WORTH MORE
Lipstick Apathy

Thanks Ants posted:

I want some billionaire to bring a test case against MS for this CAL bullshit. It just reeks of a scam once you've already paid for the server license and the client license.

It's like paying for some prostitutes then having to pay for their lunch to replace the calories burned. Or something.

Thanks Ants
May 21, 2004

#essereFerrari


But with less regulation somehow

Nebulis01
Dec 30, 2003
Technical Support Ninny

Zero VGS posted:

Some Googling suggests that Select has been phased out for Software Assurance. Also, kill me, I've been researching this poo poo for 12 hours straight.

Call and talk with them, we just renewed and signed a new one in September. Unless they've changed drastically in 30 days (possible, but unlikely) you should be able to sign an agreement.

KillHour
Oct 28, 2007


Okay, corollary to my previous question, then. If an end user purchases an appliance I built and it isn't properly licensed with CALs for their environment, can they go back and sue me in the event of an audit?

Maneki Neko
Oct 27, 2000

This is a pretty thorough "DO I NEED A CAL" ARTICLE:

http://blogs.technet.com/b/volume-licensing/archive/2014/03/10/licensing-how-to-when-do-i-need-a-client-access-license-cal.aspx

KillHour posted:

Okay, corollary to my previous question, then. If an end user purchases an appliance I built and it isn't properly licensed with CALs for their environment, can they go back and sue me in the event of an audit?

Maybe, someone can sue you for anything. Whether or not they will win is probably a better question for your lawyer, not an internet message board.

Maneki Neko fucked around with this message at 05:37 on Oct 22, 2014

KillHour
Oct 28, 2007


Already looked into it. Windows server embedded needs CALs too, because *reasons*.

Maneki Neko
Oct 27, 2000

KillHour posted:

Already looked into it. Windows server embedded needs CALs too, because *reasons*.

There are server versions of Windows that don't require CALs, if any of those will support your application:

http://www.microsoft.com/OEM/en/licensing/productlicensing/Pages/server-cal.aspx

Xenomorph
Jun 13, 2001
I'm having a weird issue with Windows Server 2008 R2 VPN, and I don't know what the problem is.

1) Fresh Windows Server 2008 R2 install, SP1, all updates.
2) Added Routing and Remote Access.
3) Configured VPN to work with NAT.

At first, it works fine. People connect, they get assigned an IP, and everything works.

After a few minutes, web traffic dies. They can still ping servers, but cannot load any web page.

I traced the issue to MTU settings.

When things are working, MTU looks like this:

code:
C:\>netsh int ipv4 sh int

Idx     Met         MTU          State                Name
---  ----------  ----------  ------------  ---------------------------
  1          50  4294967295  connected     Loopback Pseudo-Interface 1
 27          18        1400  connected     RAS (Dial In) Interface
 15          10        1500  connected     LAN
When things stop working and the connection seems to just "die", MTU looks like this:

code:
C:\>netsh int ipv4 sh int

Idx     Met         MTU          State                Name
---  ----------  ----------  ------------  ---------------------------
  1          50  4294967295  connected     Loopback Pseudo-Interface 1
 27          18     Default  connected     RAS (Dial In) Interface
 15          10        1500  connected     LAN
Uh, what? Why would it switch to say Default for the RAS/VPN MTU? What is the default? 1500?

If I set RAS/VPN back to 1400 like this;
code:
netsh interface ipv4 set subinterface "RAS (Dial In) Interface" mtu=1400
...the connection "comes alive" again and all web pages start loading.

Other stuff I tried:

* I tried adding "store=persistent" to the command. The RAS/VPN MTU still switches from 1400 to "Default".
* I tried applying Hotfix KB2266686 to enable use of the "TunnelMTU" registry entry, and set that to 1400. The RAS/VPN MTU still switches from 1400 to "Default".
* I tried setting the LAN interface to 1400 MTU. That persists just fine, but the RAS/VPN MTU still switches from 1400 to "Default". I figured that when set to "Default" it would fall back to the MTU of the LAN interface (which I set to 1400), but it didn't help.

Right now I have a Scheduled Task set up to re-set the RAS/VPN ("RAS (Dial In) Interface") to 1400 every 1 minute to keep changing it back from "Default". This is clearly a terrible work-around, but I don't know how else to make the 1400 MTU "stick".

I'm testing this with Ubuntu 14.04, Windows 8.1, OS X 10.7, OS X 10.10, iOS 6.1.6, iOS 8.1, and Android 4.4.4 clients. They all seem to connect and function when MTU is set to 1400 on the server, so that number should be fine.

Any idea why MTU changes from 1400 to say "Default"? How to get it to stop doing that? If I cannot stop it from changing, can I make it so that Default=1400?

There's a ton of Windows Server VPN guides online, and none of them bring up having to dick around with MTU like this.

I'm using L2TP/IPSec and PPTP for the VPN connection types, with just the ports opened on the firewall for those to work. The server has a Public-facing IP address, so I'm directly connecting to it.

KillHour
Oct 28, 2007


Not really, since these systems could have any number of viewing stations, and may need to be joined to a domain.

Here's a fun one: let's say I'm using user CALs and I have a public view monitor set up with a stream from the software. Do I need a CAL for every person that might walk past the monitor? If I do device CALs, do I need one for every cell phone that might use the mobile client? What about home computers viewing over the web client? The CEO's iPad? We've set up systems that stream the video to a public website! :suicide:

parasyte
Aug 13, 2003

Nobody wants to die except the suicides. They're no fun.

KillHour posted:

Not really, since these systems could have any number of viewing stations, and may need to be joined to a domain.

Here's a fun one: let's say I'm using user CALs and I have a public view monitor set up with a stream from the software. Do I need a CAL for every person that might walk past the monitor? If I do device CALs, do I need one for every cell phone that might use the mobile client? What about home computers viewing over the web client? The CEO's iPad? We've set up systems that stream the video to a public website! :suicide:

So in order: maybe technically yes but probably no, yes on cell phones, home computers, and ipads, and public web is ok without CALs per the license terms.

Oh but any that would be joined to a domain should be covered by that org's CALs.

Zero VGS
Aug 16, 2002
ASK ME ABOUT HOW HUMAN LIVES THAT MADE VIDEO GAME CONTROLLERS ARE WORTH MORE
Lipstick Apathy
Yes! I figured out some seriously great and simple folder redirection with Office365, no domain needed.

Install OneDrive For Business while the user is logged in.

By default it will install a OneDrive sync folder to:
"C:\Users\%username%\OneDrive for Business\"

Bring up the locations tab for Desktop, Documents, Pictures, etc., instructions here: http://windows.microsoft.com/en-us/windows/redirect-folder-new-location#1TC=windows-7

For each of the folder location tabs, click the "Move..." button and set each new path to:
C:\Users\%username%\OneDrive for Business\Desktop
C:\Users\%username%\OneDrive for Business\Documents
and so on.

Each time you hit apply, all of the contents will be scooped into the harddrive OneDrive folder, and synced to the internet, but the files still appear to be in the same place as far as the user is concerned. If you repeat the same steps on a new PC, all the files will be restored to that hard drive. Not only does it back up all documents, but all Office documents get Version History in case someone overwrites the wrong thing.

I've done plenty of folder redirection but never on a synced drive+cloud like this. Astonishingly there's no loving guide/wizard to do this for PCs when it's the most obvious no-brainer I've seen.

Edit: I think non-business OneDrive doesn't leave the files available offline by default so watch out for that if you're using the personal version.

Xenomorph
Jun 13, 2001

Xenomorph posted:

I'm having a weird issue with Windows Server 2008 R2 VPN, and I don't know what the problem is.

I still don't have a fix, yet, but I just found out that the problem seems to be caused by iOS.

When an iOS device connects, things look normal:

code:
C:\>netsh int ipv4 sh int

Idx     Met         MTU          State                Name
---  ----------  ----------  ------------  ---------------------------
  1          50  4294967295  connected     Loopback Pseudo-Interface 1
 25          18        1400  connected     RAS (Dial In) Interface
 15          10        1500  connected     LAN
As soon as an iOS device disconnects, the MTU changes:

code:
C:\>netsh int ipv4 sh int

Idx     Met         MTU          State                Name
---  ----------  ----------  ------------  ---------------------------
  1          50  4294967295  connected     Loopback Pseudo-Interface 1
 25          18     Default  connected     RAS (Dial In) Interface
 15          10        1500  connected     LAN
Any device already using VPN will suddenly lose web access until MTU is manually changed back to 1400.

Edit:
Since the MTU only seems to change when an iOS user disconnects, I've updated my Scheduled Task to only run my "Set MTU = 1400" script when Event ID 20272 occurs (user disconnect) instead of every minute. This isn't perfect, but it's better than a script running every minute, regardless of connection status.

Xenomorph fucked around with this message at 19:43 on Oct 22, 2014

Captain Foo
May 11, 2004

we vibin'
we slidin'
we breathin'
we dyin'

I've got a Windows Server 2012 machine with a 20Gb System Volume Information folder, and I've already looked at making sure VSS is off. I've run the DISM tools to clean out WinSxS as well - what the hell is going on here?

capitalcomma
Sep 9, 2001

A grim bloody fable, with an unhappy bloody end.

Captain Foo posted:

I've got a Windows Server 2012 machine with a 20Gb System Volume Information folder, and I've already looked at making sure VSS is off. I've run the DISM tools to clean out WinSxS as well - what the hell is going on here?

Do you run DFS? I'm pretty sure DFS replication data is kept there as well.

Captain Foo
May 11, 2004

we vibin'
we slidin'
we breathin'
we dyin'

capitalpunctuation posted:

Do you run DFS? I'm pretty sure DFS replication data is kept there as well.

I don't.

incoherent
Apr 24, 2004

01010100011010000111001
00110100101101100011011
000110010101110010

Thats the only thing in there that could take 20 gigis. Give your self admin privileges to the folder and dig deep. (REMOVE THEM AFTER YOUR'RE DONE).

Captain Foo
May 11, 2004

we vibin'
we slidin'
we breathin'
we dyin'

incoherent posted:

Thats the only thing in there that could take 20 gigis. Give your self admin privileges to the folder and dig deep. (REMOVE THEM AFTER YOUR'RE DONE).

I tried this, still didn't have access. I'll have to try again when back at my desk. But seriously, vss is not enabled on this server and neither is dfs. Neither ever has.

Adbot
ADBOT LOVES YOU

Anonymouse Mook
Jul 12, 2006

Showing Vettel the way since 1979

Captain Foo posted:

I tried this, still didn't have access. I'll have to try again when back at my desk. But seriously, vss is not enabled on this server and neither is dfs. Neither ever has.

Data Deduplication?

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply