|
Not everyone can specialize in moving things around.
|
#
?
Nov 1, 2017 06:26
|
|
|
|
| # ? May 19, 2024 16:08 |
|
|
At the core of it, isn't all of IT just about moving data around?  But yeah, the line between sysadmin/operations and coder/development is becoming increasingly muddled, especially with the idea of "treat your infrastructure as code". If you've never touched code before, it's time to learn. Of course you don't need to be some crazy kernel hacker, but on the knowing your way around Powershell would be a good start. Also learn how Git and version control in general works.
|
|
#
?
Nov 1, 2017 11:37
|
|
|
Collateral Damage posted:Also learn how Git and version control in general works. To this end, I just started playing with VSTS. Within a couple hours I had cloned my previously local only git repository, and setup build automation so that whenever the master branch is checked in it automatically updates the “production” file share
|
|
#
?
Nov 1, 2017 16:31
|
|
|
What method is everyone using when deploying applications via sccm. Pretend the app is Google Chrome and the requirement is you can't force a user to reboot or log out. Task sequence is one I guess, have something kill the process, then run the installer but realistically users will launch chrome right away if they noticed it just shut down regularly.
|
|
#
?
Nov 3, 2017 08:13
|
|
|
lol internet. posted:What method is everyone using when deploying applications via sccm. Are you talking about installing fresh? Just use Application type deployments. Import the msi, point to the collection with a maintenance window set and you’re done. Updating, you can use 3rd party patch management like Shavlik, or set Chrome to automatically update through GPOs or script it using the Package method with Maintenance Windows to deploy off hours. I couldn’t imagine using a TS for something like that. Also, saying that rebooting during a patching window is off limits is a little ridiculous if that’s the case. Every place I’ve worked at has a set window for patching where that kind of behavior is expected.
|
|
#
?
Nov 3, 2017 08:47
|
|
|
Sorry should of been indepth, lets see the software itself has 5 other "pre-requisites" before the actual software can install. Is really the best method is to daisy chain it all as a pre-requisite in the application setting of the actual app? That was why I was mentioning TS.Sacred Cow posted:Also, saying that rebooting during a patching window is off limits is a little ridiculous if that’s the case. Every place I’ve worked at has a set window for patching where that kind of behavior is expected. But same question, what if a user has his computer locked with chrome open during the maintenance. How do you deal with forcing the update (pretend new MSI and Chrome doesn't have the auto updater option.) if the user is locked in and the app is open. A TS would be able to force a reboot before the install.
|
|
#
?
Nov 3, 2017 15:12
|
|
|
The 1702 build of SCCM includes a feature to kill running processes as an initial step in deploying an application. https://www.systemcenterdudes.com/sccm-install-behavior-for-applications/
|
|
#
?
Nov 3, 2017 15:18
|
|
|
lol internet. posted:What method is everyone using when deploying applications via sccm. I always advise the "Enough rope to hang themselves with" philosophy. Management buy-in is key to this but you can show you're being reasonable. First up, make the deployment Available earlier than the deadline. Significantly earlier. A week is a good place to start, 2 weeks might be even better. Use the cool little pop-up notifications to tell users to install the thing. Make sure they have been told that this is their opportunity to install on their schedule. At the mandatory deadline, they're screwed. It installs, and reboots and they have no right to complain because you gave them AMPLE opportunity to choose the timing. Most management can get behind this.
|
|
#
?
Nov 3, 2017 15:19
|
|
|
Zaepho posted:I always advise the "Enough rope to hang themselves with" philosophy. Management buy-in is key to this but you can show you're being reasonable. First up, make the deployment Available earlier than the deadline. Significantly earlier. A week is a good place to start, 2 weeks might be even better. Use the cool little pop-up notifications to tell users to install the thing. Make sure they have been told that this is their opportunity to install on their schedule. At the mandatory deadline, they're screwed. It installs, and reboots and they have no right to complain because you gave them AMPLE opportunity to choose the timing. Most management can get behind this. This is really great advice, you should follow it.
|
|
#
?
Nov 3, 2017 15:20
|
|
|
Zaepho posted:I always advise the "Enough rope to hang themselves with" philosophy. Management buy-in is key to this but you can show you're being reasonable. First up, make the deployment Available earlier than the deadline. Significantly earlier. A week is a good place to start, 2 weeks might be even better. Use the cool little pop-up notifications to tell users to install the thing. Make sure they have been told that this is their opportunity to install on their schedule. At the mandatory deadline, they're screwed. It installs, and reboots and they have no right to complain because you gave them AMPLE opportunity to choose the timing. Most management can get behind this. This is exactly how we handled our upgrade from O365 2013 to 2016 and every Windows 10 Feature update/upgrade.
|
|
#
?
Nov 3, 2017 21:18
|
|
|
I think this is the best place for this post after checking the first few pages of SH/SC. I have a friend's dad who is looking for me to clarify the estimate he received from his normal IT company for a new server. He's a CPA w/ 3 employees, to my knowledge the server is mainly for backups and running server copies of the software they use. I'm gonna see if he and I can conference in with the IT company to have them break down how and why they came up with this estimate because it seems really high for his someone with his size office. His previous server was about $7k according to him, he also received an estimate for a NAS separately, which I can wrap my head around, although not sure why a NAS AND a server considering some of the components in the server... however, my background is in consumer level stuff and have never dealt with a server, let alone planning one, etc. I'm tentatively starting a new position in a week or so in a corporate office, so I hope to get more knowledge on this kind of stuff in the coming months/years. I was hoping to get some insight and see if you guys might be able to tell me why the IT company made the recommendations they did. https://imgur.com/a/tpoal Let me know if there's anything else I should provide! Thanks, y'all!
|
|
#
?
Nov 4, 2017 15:20
|
|
|
I don't know why they're running Exchange locally in TYOOL 2017 and it's not listed in the licensing (neither are the RDS licenses). Otherwise, looks pretty standard? We can't really tell without knowing what kind of software they're running (and it doesn't really belong in the Enterprise thread).
|
|
#
?
Nov 4, 2017 15:28
|
|
|
Jeoh posted:I don't know why they're running Exchange locally in TYOOL 2017 and it's not listed in the licensing (neither are the RDS licenses). Otherwise, looks pretty standard? We can't really tell without knowing what kind of software they're running (and it doesn't really belong in the Enterprise thread). Gotcha. Would the small biz thread be better? I went by server being in the thread title, so I’ll happily hop over to wherever. EDIT: Could have sworn the thread title had Windows Server in it a couple days ago. Ugh, I clearly needed more sleep or some coffee. Boywhiz88 fucked around with this message at 15:34 on Nov 4, 2017 |
|
#
?
Nov 4, 2017 15:31
|
|
|
Zaepho posted:I always advise the "Enough rope to hang themselves with" philosophy. Management buy-in is key to this but you can show you're being reasonable. First up, make the deployment Available earlier than the deadline. Significantly earlier. A week is a good place to start, 2 weeks might be even better. Use the cool little pop-up notifications to tell users to install the thing. Make sure they have been told that this is their opportunity to install on their schedule. At the mandatory deadline, they're screwed. It installs, and reboots and they have no right to complain because you gave them AMPLE opportunity to choose the timing. Most management can get behind this. This is the best advice, however it could also get shot down for one big reason: 1/2 weeks for enforcement of browser security patches isn't a great idea. You mentioned pre-reqs. Are these what need a restart? Forcing a restart just to make sure a browser is closed is overkill. Like was said, if you have the kill process feature, use it. I haven't dealt with Chrome in a while, what's the behavior if you run the msi while chrome is running?
|
|
#
?
Nov 4, 2017 15:58
|
|
|
Boywhiz88 posted:I think this is the best place for this post after checking the first few pages of SH/SC. Backups are probably best just done as a service assuming they don't have weird bandwidth limitations, and they should check out if whatever software that is can be hosted by the vendor.
|
|
#
?
Nov 4, 2017 18:03
|
|
|
We're working on re-deploying SCCM 1706 and the exporting of things like device collections is not exporting all the little things that we've configured that make our environment go. For example, when we export a certain device collection, none of the entries on the "Collection Variables" tab is exported. Is there a way to know for sure that this stuff is gonna get backed-up somewhere? Documenting all this stuff is gonna take days (not that documenting it is a bad thing).
|
|
#
?
Nov 6, 2017 17:17
|
|
|
Boywhiz88 posted:I think this is the best place for this post after checking the first few pages of SH/SC. I was able to put something comparable together on a Dell server tower for about $4.5k and considering what role you're describing that was massively overbuilt. I'm raising an eyebrow at the use of low-capacity 10k SAS disks, flash is generally better on $/gb these days along with being faster and more reliable. e: Those v4 Xeons are going on 2 years old as well, seems like they're trying to unload old inventory.
|
|
#
?
Nov 6, 2017 21:02
|
|
|
It's been a long time since I've had to worry about this so I need help jogging my memory: Assuming two-way transitive forest trusts exist: Global groups can contain members from the same domain or other domains in the same forest Global groups can be added to an ACL in any domain in the same forest only Universal groups can contain members from other trusted forests Universal groups can be added to an ACL in any trusted domain in any trusted forest Did I remember this correctly?
|
|
#
?
Nov 10, 2017 00:28
|
|
|
Does the table on this page cover it? https://blogs.msmvps.com/acefekay/2012/01/06/using-group-nesting-strategy-ad-best-practices-for-group-strategy/
|
|
#
?
Nov 10, 2017 00:36
|
|
|
Thanks Ants posted:Does the table on this page cover it? Nice, thanks for that table, it helps. I'm encountering an oddity then. I'm finding myself able to add a global group to an ACL in my domain from a different domain in a different forest, which according to everything I'm reading shouldn't be possible. Am I going crazy?
|
|
#
?
Nov 10, 2017 00:40
|
|
|
Was it a previously migrated group/identity that has SID history turned on?
|
|
#
?
Nov 10, 2017 01:04
|
|
|
Wrath of the Bitch King posted:Was it a previously migrated group/identity that has SID history turned on? It's a built-in global group, "Domain Controllers". SID history is disabled across the board on all objects.
|
|
#
?
Nov 10, 2017 01:06
|
|
|
Does anyone use Data Protection Manager 2012r2 and Azure online backup? Our DPM server does a local backup to a 20+ tb local array and then uploads the backup to Azure. The DPM server has a local 500gb array for the os and (as it turns out) staging area, which is a major problem when trying to restore data from Azure. The staging area is used for temporary storage of the recovered file, vhds in my case since i can't get into the vhd through Azure or DPM. The actual vhd is 1.5 TB. I've tried moving the staging area by doing the Azure-configuration again and pointing it to 1: UNC path, does not work 2: Mapped network drive, does not work 3: Symlink, does not work 4: Junction, does not work. Some of these refuses to complete the configuration right after i choose the new location. The restore-job starts, runs for 30-something minutes then errors out when it actually starts trying to download the data from Azure. Has anyone been able to move the staging area to something other than a locally connected disk? If so i'm probably stopped by ntfs or smb-permissions. Can i somehow use the big local array as staging area? It's not visible for the Azure -configuration as all i can see there are local connected drives. I found a 2TB drive in our lab but it turns out my colleagues think that broken drives should be put in the "good"-pile with no labels, otherwise usb-drives work but my boss does not want to invest anything and still yelled at me because i found out that we cannot restore any of our customer fileservers because of the lack of space.
|
|
#
?
Nov 13, 2017 18:13
|
|
|
thanks ants is sh/sc mvp how do you do it?
|
|
#
?
Nov 14, 2017 21:57
|
|
|
Is there a reason SCCM is still showing these "Security Only" updates as required even though I'm downloading and deploying the "Security + Quality" updates?
|
|
#
?
Nov 15, 2017 15:09
|
|
|
May I ask a rather amateur question? Haven't done this before. Got a ThinkServer box with Server 2008 Foundation as AD DC (so, 15 users), using folder redirection but not roaming profiles. Now the site needs more users, and they'd like to be able to hop desks easier. Flat network, about 10 Windows 7 workstations joined to the domain. Server 2008 doing DHCP and DNS, also. I didn't set it up, and I think the folder redir permissions aren't quite right. Question: What's my "most success for least chance for mistakes" procedure for standing up a new Server 2016 system and getting roaming profiles set up? It will become DC et all so the 2008 box can be scrapped. Two stage question about a) the best way to set up roaming profiles "around" existing user accounts, and b) proper steps/procedure for replacing a single?PDC. For the sake of a clean process and avoiding any issues, I'm planning on just making new user accounts (with a different naming convention) on the new server, enabling folder redirection and roaming profiles, and manually copy over docs/pics/etc. But, I'm not really certain of the order... 1) Setup Server 2016 and join it to existing domain 2) Promote to DC 3) Create users on new server (now? later?) ... but how to get rid of the old server's roles/need? ... I'm looking at dcdiag and repadmin results for starters. 5) transfer FSMO roles from 2008 to 2016 6) Turn off AD role in 2008 7) turn off DHCP and DNS in 2008 and enable in 2016 8) something else before removing the 2008 box? Referencing these guides to some degree: http://www.rebeladmin.com/2016/10/step-step-guide-migrate-active-directory-fsmo-roles-windows-server-2012-r2-windows-server-2016/ https://blog.thesysadmins.co.uk/server-2012-add-domain-controller.html https://www.petri.com/transferring_fsmo_roles This is a month or so out, but I would really value the feedback or counsel of the thread. Thank you.
|
|
#
?
Nov 15, 2017 17:13
|
|
|
I'm reading conflicting things about standard user accounts on Windows 10 when managed with Intune - lots of posts saying "oh my god don't demote the user after they have enrolled it breaks everything", which does sort of make sense. However, AutoPilot seems to think it has resolved this problem. Does anybody here have any experience with Windows devices and the new MDM way of doing things (I am aware of the limitations here vs. GPO) that can verify if an AutoPilot deployment with an Azure AD join and Intune enrollment is a workable thing now, or is it a waste of time?
|
|
#
?
Nov 19, 2017 16:58
|
|
|
Tapedump posted:May I ask a rather amateur question? Haven't done this before. They don't make it easy to migrate because they don't want people having full server and foundation\essentials working together. Machines can coexist for about 21 days once you've promoted them. I'd advise migrating it to a 2016 server essentials, then dropping a standard key into 2016 https://docs.microsoft.com/en-us/windows-server-essentials/migrate/migrate-windows-server-2008-foundation-to-windows-server-essentials Standard has the "essential" tools baked in. Easiest and cleanest way to migrate and, if you need to call microsoft, "supported". Also set your DHCP server to be very agreesive on the release times. this will typically trip up a smooth semeles move. Also don't use roaming profiles, redirect folders. incoherent fucked around with this message at 09:04 on Nov 20, 2017 |
|
#
?
Nov 20, 2017 08:58
|
|
|
For desk hopping, there are better solutions than roaming profiles too, like VMWare User Environment Manager (formerly Immidio Flex Profiles / Flex+)
|
|
#
?
Nov 20, 2017 09:43
|
|
|
Thank you for the replies, but incoherent, I am not talking about upgrading the current server. I want to set up a new Server 2016 on all new hardware and scrap the old 2008 system entirely. Do you mean that upgrading 2008 to 2016 Server Essentials, as you said, is a needed/desired step just to replace it (with a non-Foundation version of Server)? Man, I hope not.. Oh, and while we're here, why not Roaming Profiles? Too breaky? Their complaint with redirected folders is that is that it does not account for Outlook client settings, task bar icons, etc. (does it?), and those bits are "very important" to them. Tapedump fucked around with this message at 17:04 on Nov 20, 2017 |
|
#
?
Nov 20, 2017 17:01
|
|
|
Roaming profiles is and has always been hot flaming garbage that's prone to breaking in ever new and frustrating ways. Centrally storing user settings is a good idea, there are just better ways to do it.
|
|
#
?
Nov 20, 2017 18:47
|
|
|
We did a hybrid config where roaming profiles excluded the Downloads folder and all other stuff (Desktop, Documents, whatever) was redirected to their personal network drive and cached with Offline files which handles large data transfers much better than the roaming copy at logon/off. Would have redirected AppData too but we had one or two lovely applications that didn't like it and couldn't get away with it. Worked very well at keep profile size down and the logon times at bay. Biggest thing we ran in to was IE generating a million cookie files that had to be slowly synced one by one for people with profiles that were a decade+ old. Tacked on a logon script that nuked cookies with a modify date older than a year and that got better.
|
|
#
?
Nov 20, 2017 19:12
|
|
|
Tapedump posted:Thank you for the replies, but incoherent, I am not talking about upgrading the current server. I want to set up a new Server 2016 on all new hardware and scrap the old 2008 system entirely. Actually found another link that explains the proper path. You'll install a full version of 2016, install the essential role, and proceed through the steps. The two links (my OP and this one) are nare indistinguishable except for the following quote:For environments with up to 100 users and 200 devices, you can follow the same guidance to migrate to the Standard or Datacenter editions of Windows Server 2012 R2 with the Windows Server Essentials Experience role installed. IT says 2012 R2, but same process for 2016. incoherent fucked around with this message at 23:06 on Nov 20, 2017 |
|
#
?
Nov 20, 2017 23:04
|
|
|
Alas, I'm confused. Why the need for Essentials Experience? Is that just a number of often used Roles but introduce that hokey dashboard and stuff I don't want like RWA? Please excuse my ignorance, but I genuinely appreciate your help and knowledge, all.
|
|
#
?
Nov 21, 2017 01:33
|
|
|
The roll is required to update the 08 foundations schema and prepare the foundation 08 domain to be brought to the "new" foundation server, which is your standard install with the "foundation role". Once you're done migrating the domain you'll demote the 08 foundation server\domain controller and remove the foundation role from 2016 giving you....a standard windows server install with the active directory role with your migrated domain.
|
|
#
?
Nov 21, 2017 20:59
|
|
|
I think I grok that, thank you. I had no idea the schema differed nor abou this requirement at all! Dang. More and more I'm liking the idea of starting a new domain from scratch, given this and the general history of the 08 Server (my predecessors really did a number on it during its lifespan). Once again, I appreciate the guidance. I suppose either way, I'm going to have to decide how to best offer hotseat desks (without using Roaming Profiles, but still keeping non-Folder Redirectable stuff like Outlook client setup, task bar icons, etc. persistent across desks). This has been deemed a Big Deal by those running the office.
|
|
#
?
Nov 22, 2017 02:16
|
|
|
How would I add Windows 10 group policies to our environment? Would simply adding a Server 2016 DC work? Or do I need to add ADMX files?
|
|
#
?
Nov 22, 2017 06:42
|
|
|
Just the ADMX files in your central store. 08 R2 and later is fine. https://www.microsoft.com/en-us/download/details.aspx?id=56121 NOTE: You'll need to update them for every windows 10 version and 2016 server. Also you only need to copy the language you need, no need to add the all ADML files. Tapedump posted:
UE-V is the new replacement for roaming profiles https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/uev-v2/ If it's a REALLY BIG DEAL they can pay for it. incoherent fucked around with this message at 08:02 on Nov 22, 2017 |
|
#
?
Nov 22, 2017 07:57
|
|
|
UE-V looks ideal, but I see that even though Windows 7 Pro is listed under the compatibility chart, when they upgrade to Win10 (post-1607) they'll have to change to Enterprise, correct? That's the cost they'd have to pay for it it's in fact a MegaBigDeal, huh? If it's not SoBigADealGivenCost, my next best bet is RDS since I doub't they'll agree to the costs of VMware User Environment Manager, either.
|
|
#
?
Nov 22, 2017 19:12
|
|
|
|
| # ? May 19, 2024 16:08 |
|
|
incoherent posted:Just the ADMX files in your central store. 08 R2 and later is fine. Wait so you mean every version like pro enterprise or every major release like 1604\1704
|
|
#
?
Nov 22, 2017 19:51
|
|