Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord

The Onion posted:

So I'm currently playing with MDT 2010 and WDS in an attempt to find a better deployment solution for our network. We currently use altirs, but we do not have control over the servers, and the people who run it are on a old version that does not fully support windows 7 yet. We have machines in the ceiling that we need to get imaged, Is it possible to make a fully unattended (ZTI) install with just MDT 2010 and WDS? It seems like the only hurdle is forcing the machines to automatically boot from PXE, without touching them. Everything else unattended seems to be completely doable at this point. Thoughts?

Be careful what you wish for. A fully automated, zero touch install that anyone can boot from the network is just asking for someone to fiddle with their settings, network boot and accidentally nuke their PC.

Adbot
ADBOT LOVES YOU

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord

lol internet. posted:

Actually, just don't advertise the task sequence to "All Systems/All Desktops & Servers" and you should be okay. Also, setup a password on the boot disc. (Will ask during PXE boot, not mandatory advertisements)

Just create a collection, and advertise to the collection. For the machines you want to re-image, just drop them into the collection. Just be careful on making the advertisement mandatory or not.

Absolutely. This is completely different, and the right way to do it with an SCCM environment.

I was more referring to The Onion's specific situation, where it didn't sound like he had such access.

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord

Zero VGS posted:

I don't drink :-/

Great news, this will be fixed shortly!

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord

Tab8715 posted:

Also, is there still a need for Domain Users to be apart of the local admins on the local machine?

holy gently caress, no absolutely not good god run away

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord

BangersInMyKnickers posted:

Virtualstore redirects in Vista+ easily fixed 90% of the compatibility issues we had with this. Being sysadmin on an XP/2003 domain without granting your users local admin was a compatibility nightmare because absolutely nobody tested their software and were writing reg keys and files any place you could possibly think of.

Fuckin' truth, especially when you add terminal services/Citrix into the mix. I've probably spent months of time in procmon/regmon/etc figuring out what relaxations needed to be made for medical apps.

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord

Internet Explorer posted:

Yuuuuup.

Check out RegShot if you haven't already. I lived in RegShot back in the dark days.

https://sourceforge.net/projects/regshot/

oh my god this is fantastic, thank you

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord
FRS is trash, pull that ripcord baby

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord

The Fool posted:

you forgot the heavy drinking when nothing works right because you forgot one stupid little thing 5 steps ago and now you have to start over

oh i see you've also attempted to deploy a multi tier PKI infrastructure

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord

Thanks Ants posted:

Office on Mac can be distributed through the App Store now, not sure if there's any differences that would cause you problems vs. what comes from MS.

Oh man, I'm going to try this. Microsoft AutoUpdate on OSX is just a dumpster fire.

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord
As lovely as charging for SSO is, that's one of the things I'm sure absolutely has a quantifiable cost in terms of support resources to deal with people that don't have the first loving clue about how any of it works trying to stumble through a config and blowing up everything in the process.

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord
I've seen it both ways. Some companies will tell you to go piss up a rope and others will actually help, just like some customers actually understand what they're trying to accomplish and others are drastically out of their element. I've had to be the third wheel on more than a few of those calls.

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord

Tab8715 posted:

Why wouldn’t you want customers to use SSO for products or services?

That has got to be one of the worst business decisions I’ve ever heard of in my entire IT Career. Having to remember dozens of credentials is absolutely mind boggling and I can’t even fathom how much we’ve spent on just resetting passwords.

Once again - I am not arguing against SSO. SSO is fantastic and great and everyone should implement it everywhere yesterday.

I'm just trying to bring some context into the discussion. For example, password resets are quick and can be processed by anyone with a pulse. SSO issues are more difficult and require a level of familiarity with how everything is supposed to work and troubleshooting skills. Being angry that companies don't provide SSO for free is a perfectly reasonable position, but to pretend that there is no overhead associated with providing SSO to customers is false.

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord

lol internet. posted:

Trying to do a Computer/User GPO to block all USB access on all computers with the exception of AD users in _____ AD Group. The policy itself is actually the same for User/Computer configuration. It doesn't seem to work? I'm on 2019 LTSC at least.

I'm doing this in a "Test OU" with inheritance blocked. Created two seperate GPOs. Computer Configuration GPO which disables all USB access in "Test OU" and User Configuration GPO which enables GPOs for users in the AD group. The user policy has precedence over the computer policy.

Test user and Test PC is in the "Test OU." I login with the test user and USB still seems to be blocked. Running GPRESULT shows that it the user policy to enable is being pushed down.

Any ideas?

Which settings exactly are you changing?

If the user policy to deny USB works like you want it to then I think you should be able to get away with creating one policy that disables USB and edit the security on the GPO to set Deny permissions on it for your "allow USB" group.

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord
If they're using something like a cablecard then just get them a tivo. I don't think there's anything else that will allow you to record copy protected content outside of OTA broadcast.

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord
yeah you want to make sure you roll your own crypto first so you can secure those SAML calls

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord

FISHMANPET posted:

I once used OBS for a work presentation with a green screen. Outputting to a virtual camera will probably miss a step (it did with Zoom). I was using OBS to put my talking head in the bottom corner of the screen while my content was being shared. OBS could set that scene up well enough, but I ended up setting it to display on a 3rd monitor, and then I shared that screen via Zoom. So I had my main monitor for what I was showing off, my left monitor had OBS and zoom running, and then OBS played its output on my right monitor, and that's the screen I shared in Zoom.

Outputting to a virtual camera doesn't work that great because Zoom optimizes the experience of a camera feed for faces, which is different from the experience of a shared screen.

This 100% tracks with my experience. OBS is fantastic for demos and presenting content, but using virtual camera mode for mixed-mode presenting goes against how every collaboration platform works. You'll run into problems like people inadvertently stealing focus, people who normally have video disabled not knowing why they aren't seeing any content, etc. Sharing the OBS output by selecting its output window as the app to share (or more easily by just using another monitor and full-screening the output and sharing that) is the best platform-agnostic option.

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord
Microsoft has been lazy with quality-of-life improvements for AVD and such because if customers want the easy button then they just bring in Citrix to back up the truck and sprinkle their bits on top. It literally makes them more money that way.

I'm sure they're working on gradually chipping away at the differentiators that people actually use Citrix for, and I suspect the recent buyout and ransacking is only going to push that timetable up.

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord

Internet Explorer posted:

Pretty funny, because you could have said the same exact thing 20 years ago.

I get where you're coming from but not really, IMO. Once terminal services transitioned to RDS they certainly started closing some gaps but it wasn't a huge priority. AVD is a totally different situation.

Adbot
ADBOT LOVES YOU

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord
Conceptually, sure, but I'm talking on an actual feature level where there are distinct differences. Thankfully I got laid off so I don't have to stay on top of it anymore.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply