Tech Blog

UAC prompt for users after Chrome Update

2014-01-27T11:54:00.000-05:00

Hello all,
I migrated my deployments to SCCM a few months ago, and every time I pushed out a chrome update several users would get a UAC prompt each time they open Chrome.

I identified the problem; the users were opening chrome during the installation, so the installation tried to complete the next time they opened chrome.
Chrome does this by naming the new version

"new_chrome.exe"

This file is then moved to chrome.exe, but the standard user does not have permission to do this and gets UAC prompt.

I have built in a few checks to the deployment process to prevent this.
I have added the version number to the detection method for chrome.exe.
In the screen shot below we have the MSI detection then two detection for chrome.exe with the current version.
One is for program files and the other is for program files (x86).

I have also changed the deployment method from msi to script and use the following script to install Chrome.
First I kill any chrome process then install the browser.
Then I kill chrome again if the user has opened it and check the existence of new_chrome.exe
If the file exists I delete the older version of chrome and replace it with the new one.

taskkill /f /im chrome.exe

msiexec.exe /i "GoogleChromeStandaloneEnterprise.msi" ALLUSERS=1 /q /norestart

IF EXIST "%programfiles%\Google\Chrome\Application\new_chrome.exe" GOTO X86

IF EXIST "%ProgramFiles(x86)%\Google\Chrome\Application\new_chrome.exe"  GOTO X64

exit

:X86
cd %programfiles%\Google\Chrome\Application

taskkill /im chrome.exe /f
ping -n 2 127.0.0.1
del chrome.exe /q
move new_chrome.exe chrome.exe

exit


:X64
cd %ProgramFiles(x86)%\Google\Chrome\Application
taskkill /im chrome.exe /f
ping -n 2 127.0.0.1
del chrome.exe /q
move new_chrome.exe chrome.exe

exit

This has greatly reduced the number of support calls I get after a chrome update, I hope it helps you as well.

Java 7u51 exception.sites deployment

2014-01-27T11:17:00.001-05:00

Hello all,
Today I’ll outline how to deploy Java’s new exception sites settings for 1.7 update 51.
Normally the exception.sites file is a per user setting. However we would like to deploy site exceptions to everyone.
I use SCCM to deploy Java, and it’s configuration files. I have a separate application in SCCM just for deploying updated configuration files, but this can be done with GPP or logon script too. Use the method that works best for your environment.
There are three files needed
Deployment.config Java system level configuration file
Deployment.properties Java deployment properties
Exception.sites file containing the url exceptions

All three of these files should be in
C:\WINDOWS\Sun/Java\Deployment\

Here is a batch file I use to create the directory and copy the files

mkdir %SystemRoot%\Sun\Java\Deployment
copy deployment.config %SystemRoot%\Sun\Java\Deployment\ /Y
copy deployment.properties  %SystemRoot%\Sun\Java\Deployment\ /Y
copy exception.sites %SystemRoot%\Sun\Java\Deployment\ /Y

The deployment config file points to the location of the deployment properties file

deployment.system.config=file\:C\:/WINDOWS/Sun/Java/Deployment/deployment.properties
deployment.system.config.mandatory=true

The deployment properties file contains several deployment options including the location of the exception.sites file and security level.

deployment.user.security.exception.sites=C\:/WINDOWS/Sun/Java/Deployment/exception.sites
deployment.browser.vm.iexplorer.locked
deployment.browser.vm.iexplorer=true
deployment.browser.vm.mozilla.locked
deployment.browser.vm.mozilla=true
deployment.expiration.check.enabled=false
deployment.security.level=HIGH

The exception.sites file is a list of urls one per line

http://excemple.com
https://domain.com

For full details on available deployment properties, and the format of the exception.sites list see the following oracle documentation

Deployment Properties

Exception Sites

I hope this has helped you deploy the new java update, thanks for reading.

wbadmin Backup Script

2013-03-10T11:56:00.000-04:00

Hello all, I’m back with another script. This script will allow for multiple server backups to a network share. The wbadmin tool does not allow for incremental / differential backups to a network location. It takes a full backup every time you run it, overwriting the previous backup. One method to get around this limitation is to point the backup to a different location each time it runs. This is what my script does.

Map a drive to the backup server
Create a folder for the computer name and subfolder with the current date
Create a log file in the folder
Run wbadmin pointing it to the current date folder
Email a report when complete

At this point you need to manually clean up the old backups, but I’ll be working on a solution to that. In the script you need to set the backup location, smtp server and email address.

You may want to add -include:driveletter to the argument list for wbadmin if you need to backup additional drives. This script will work on any system with wbadmin, I have tested on windows 7/8 and server 2008/2008r2/2012.
It should also work on vista, but I haven't tested it there. You will need to make sure the windows server backup feature is installed on the machine.
Now schedule the script to run with task scheduler and wait for the report.
Thanks for reading.

Note: The brtag puts line breaks in the html email report, but also put line breaks in the code below. So that there were not line breaks in the wrong place I changed <br> to brtag in the script be. Replace all instaces of brtag with <br> for the script to work properly.

#script will backup computer to backup location
clear
$date = get-date -UFormat %Y-%m-%d
$comp = gc env:computername
$share = '\\backupserver\backupshare'
$folder = $share + '\'  +$comp + '\' + $date + '\'
$log = $folder + $comp + '.log'

# Map share
try{
$mapprocess = start -Wait  net -ArgumentList  "use  i: $share backupuserpassword /USER:backupuser" -PassThru  -NoNewWindow
$mapcode = $mapprocess.exitcode 
if ($mapcode  -ne 0 ){
$result = "$result brtag Computer $comp FAILED to map drive brtag with error code $mapcode brtag brtag"
}}
catch [exception] {
$result = "$result brtag Computer $comp FAILED to map drive brtag brtag"
}

#create backup folder
try {
if ( ! (Test-Path  -Path $folder ) ){
New-Item  -Path $folder  -ItemType Directory -ErrorAction Stop
}}
catch [exception] {
$result = "$result brtag Computer $comp FAILED to create folder brtag brtag"
}
# create log file
try {
if ( ! (Test-Path  -Path $log ) ){
New-Item  -Path $log   -ItemType File -ErrorAction Stop
}}
catch [exception] 
{
$result = "$result brtag Computer $comp FAILED to create log file brtag brtag"
}
$start = Get-Date 
$process = start -Wait  wbadmin.exe -ArgumentList "start backup -backuptarget:$folder -allCritical  -quiet" -PassThru -NoNewWindow -RedirectStandardOutput $log 
$code = $process.exitcode 
if ($code  -eq 0 ){
$end = Get-Date 
$result = "$result backup complete on $comp, user $user brtag Started: $start brtag  Ended: $end brtag brtag"
$status = "good"
start net -ArgumentList "use i: /delete /Y" -NoNewWindow  
}
else { 
$end = Get-Date 
$result= "$result Backup Failed on $comp, brtag Started: $start brtag  Ended: $end  brtag brtag"
$status = "BAD" }
$loghtmlfile = $log + '.html'
$File = Get-Content $log 
$FileLine = @()
Foreach ($Line in $File) {
 $MyObject = New-Object -TypeName PSObject
 Add-Member -InputObject $MyObject -Type NoteProperty -Name backupstatus -Value $Line
 $FileLine += $MyObject
}
$FileLine | ConvertTo-Html -Property backupstatus | Out-File $loghtmlfile 
$loghtml = gc $loghtmlfile  
$result = "$result $loghtml"
#Setup Email Report
$mail = New-Object system.net.Mail.MailMessage 
$mail.From  = "BackupScript@yourdomain.local"
$mail.To.add("youremail@yourdomain.local")
$mail.Subject = "Backup Script Results $status $comp $date"
$smtp = new-object system.Net.Mail.SmtpClient("your.smtp.server")
$mail.IsBodyHtml = "True"
$mail.body = $result  
$smtp.send($mail)

Add Users Script

2012-10-24T10:29:00.002-04:00

Hello everyone,

I have had a few people ask about my script for creating user accounts, and thought I would share. This script is customized for my environment, and you will have to edit it to fit your domain. Thoroughly test in your environment first I am not responsible if something goes wrong.

What does this script do?

Retrieve a csv file of user information from an ftp server

Read the csv file and create users

If the user is in CSV but not AD they must be new create account

If the user is in AD but not CSV they must have withdrawn disable account

If the user is in CSV but their AD account is disabled, they are a returning student enable account

If the internet field is blank no AUP disable account

If they later turn it in re enable the account.

The month of august is a grace period where this check is ignored.

If a student’s name changes, rename account and user folder.

If a student changes year groups their files and account are moved to the new year group OU and folder.

Call the GADS script to sync with Google Apps

Email a report of all changes made.

How this script works and what you need to do.

My Environment

I do not collect student addresses in active directory, I only use the city because Moodle requires a city.

I use the postofficebox field to store the student ID number

I use the description field to store their year group studentsxxxx this is important in determining if their year has changed.

I write most of my notes in the web page field such as account disabled by script.

Our elementary students have a separate password policy so there is a separate default password for them in the script.

Usernames are generated to be last name + first initial + last four of student ID Hyphenated names are truncated at the first hyphen. This is coded into the script.

There is a check box in power school to indicate if a student has returned their AUP, if they do not have a signed AUP their account is disabled until they do.

I have an OU called groups were all groups are stored, each student is put in a group called studentsxxxx The script does not create the groups, OU’s or year group folders you must do this. The script does create the user folders in the year group folders.

We have a group called general accounts, the script ignores accounts in this group.

We have a group called noiaf for students who do not have their AUP signed. They are put into this group based on the value of the internet access field.

We have a group called disabled, this is if you need to manually disable a student account for some reason, the script will not re enable accounts in this group.

My OU and home drive directory structure is;

Students

GradYear

Username

Groups

Noiaf
General accounts
studentsxxxx

The schoolid field is an identifier assigned to each building in powerschool, it is in the export file and I filter for it in the script. I filter out the electronic building (students the school is required to track but not actually in our buildings, so they do not need accounts).

My most recent changes, so not fully tested, is to evaluate based on student ID instead of name. This allows me to detect name changes and rename accounts as opposed to disabling one and creating a new one. The script used to search for existing students based on samaccountname. This was changed in the most recent version. I recommend using something like bulk AD users to populate postofficebox field or modify the script to search by samaccountname again.

Some of the code could use a cleanup and there are places I should have used variables, but it works. Some of the paths are hard coded you will have to change them or use the same directory structure.

Here are some rough notes on what you need to change for your environment.
You will need Quest's Active directory cmdlets for this script to work.

Create the OU and home drive directory structure

Enter ftp ip
Enter domain information
Enter your default password for new accounts, and default password for elementary accounts.
Enter email information
Edit header information to match your CSV
Enter your school name on the new user line
Edit the elementary year
Modify any other variables I missed, or that you want set differently

Here are the scripts, I hope they help you to automate your user account process.

Again I am not responsible for any damages, use at your own risk and test in your lab environment thoroughly.

==========================================

Add users powershell script

clear
#This script will add users to active directory based on a csv file it retrives from ftp
#If the user is in the csv but not AD the account is created
#If the user is in AD, but not the CSV the account is disabled.
#If the user's name changes they will be renamed.
#If the users grade changes they will be moved, alog with their home directory.
#This will send an email report of all chnges. 

#Function list

function ftpexport {
#get ftp export.csv
cd c:\psscript
ftp -s:c:\psscript\ftpcmd.txt -n enter ftp IP here
#end function
}

function report {
#send report

$table |Sort-Object -Property Action | Export-Csv "c:\report.csv" -NoTypeInformation
$table | Select-Object Name, Year, Action | Sort-Object Action | ConvertTo-Html | Out-File  c:\report.html 
$mail.IsBodyHtml = "True"
$body = $table | Select-Object Name, Year, Action |Sort-Object Action| ConvertTo-Html 
#$body = Get-Content c:\report.html 
$mail.body = $body 
$mail.Attachments.Add("c:\report.html")
$smtp.send($mail)
#END Function
}


#test for and load quest cmdlets
if (!(Get-PSSnapin -Name Quest.ActiveRoles.ADManagement )){Add-PSSnapin Quest.ActiveRoles.ADManagement }

#set constant vars
$domain ="your.domains.fqdn";$nbdomain = "yournbdomain"; $edomain = "@youremaildomain"
$password = "yourdefaultpassword"
$homepathroot = "\\yourserver\\yourshare\students";$homedrive = "S:"
#year for elementary students needs updated yearly 
$elemyear = 2019

#Setup Email Report
$mail = New-Object system.net.Mail.MailMessage 
$mail.From  = "your from address"
$mail.To.add("your email address")
$mail.Subject = "Script Results" #+ {get-date)
$mail.Body = $table 
$smtp = new-object system.Net.Mail.SmtpClient("your smtp server")

# Create Data Table for Reporting
$table = New-Object system.Data.DataTable "Account Report"
$table.Columns.Add("Name", [string]) | Out-Null ;$table.Columns.Add("Year",[string]) | Out-Null ;$table.Columns.Add("Action",[string]) | Out-Null 


#CSV Setup
#powerschool feild list 
@"
last_name
first_name
student_number
grade_level
city
state
zip
schoolid
zz_Internet_Access_Allowed
"@

ftpexport

$csvfile = "C:\psscript\exportAD.csv"
if ((Get-Content $csvfile ) -eq $null )
{
$row = $table.NewRow();$row.Name ='Null File'; $row.Year = 'check ftp' ; $row.Action = "export file is blank exit and check files "
$table.Rows.Add($row)
report

Copy-Item  c:\psscript\exportAD.csv c:\psscript\$date-exportAD.csv
del c:\psscript\exportAD.csv
exit
}

#edit hearder information to match your CSV
$csvusers = import-csv  $csvfile -Header lastname,firstname,postofficebox,grade,City,State,PostalCode,schoolid,internet

#current Date
$date = Get-Date 

#Usernames are generated to be last name + first initial + last four of student ID
#Hyphenated names a truncated at the first hyphen.  

ForEach ($csvuser in $csvusers){
$a = $csvuser.postofficebox;$a = $a.substring($a.length - 4, 4)
$lastname = $csvuser.lastname.split("-")
$user = $lastname[0].tolower() + $csvuser.firstname.substring(0,1).tolower() + $a
$user = $user -replace ' ' ,'' 
if ($csvuser.schoolid -eq xxxx) {continue} #electronic building, enter school ID to exclude
if ($csvuser.grade -eq "KG") {continue}
if ([int]$csvuser.grade -ge 13) {continue}
#if ([int]$csvuser.grade -lt 5) {continue} #Uncommnet to exclude elementary 

if ($date.month -lt 7 )
{
$year = (12 - [int]$csvuser.grade + $date.year)
}
else {$year = (12 - [int]$csvuser.grade + $date.year + 1)}

$parDN = $domain + "/Students/" + $year ;$userDN = $parDN + "/" + $user
$groupid= $domain + "/groups/" + "Students$year"
$dname = $csvuser.Firstname + " " + $csvuser.Lastname
$upn = $user+"@"+$domain; $email =$user+$edomain
$homepath = $homepathroot + "\" + $year + "\" + $user
$noiaf = $domain + "/Groups/noiaf"
#$renamed = $domain + "/Groups/renamed"
#Array of CSV user to  test AD users agaist
[array]$csvtest = $csvtest + $user
#chek if user is in AD
$quser = Get-QADUser -PostOfficeBox $csvuser.postofficebox
if ($quser.SamAccountName -eq $user)
{#user is in AD
#Grade period August
if ($date.month -ne 8){
#test for NO AUP
[string]$group = $quser.MemberOf 
if ($group -notlike  "*noIAF*" -and $csvuser.internet -eq "" ) {
Set-QADUser -Identity $user -WebPage "Disabled No AUP" -Fax "NO AIF"
Set-QADGroup -Identity $noiaf -Member @{append=@($user)}
Disable-QADUser -Identity $user  
$row = $table.NewRow();$row.Name =$quser.DisplayName ; $row.Year = $year ; $row.Action = "NO AUP Account Disabled"
$table.Rows.Add($row)
continue}}

# Disabled group if students are in this group script will ignore them

if ($quser.MemberOf -like "*disabled*"  ) {continue}

#check for disabled accout returning student
if ($quser.AccountIsDisabled -eq "True"){
#user is in AD with disabled account
#check for Internet AUP
if ($csvuser.internet -eq "") 
#user does not have form skip to next user
{continue}
#Check for disabled accounts with allow internet
if ($group -like "*noIAF*"){
Set-QADUser -Identity $user -Fax "" -WebPage "Enable has AUP"
Set-QADGroup -Identity $noiaf -Member @{delete=@($user)}
Enable-QADUser -Identity $user 
$row = $table.NewRow();$row.Name =$quser.DisplayName ; $row.Year = $year ; $row.Action = "Has AUP Account Enabled"
$table.Rows.Add($row)
continue
}

#student account is enabled and active
Enable-QADUser -Identity $user 
Set-QADUser -Identity $user -WebPage "returned vis script"
#report Line
$row = $table.NewRow();$row.Name =$quser.DisplayName ; $row.Year = $year ; $row.Action = "Returning Student Account Enabled"
$table.Rows.Add($row)}


#Update User Info
#Update city
if ($quser.City -ne $csvuser.City){
set-QADUser -Identity $user  -City $csvuser.City  -PostalCode $csvuser.postalcode 
Add-QADGroupMember -Identity $groupid -Member $userdn
$row = $table.NewRow();$row.Name =$quser.DisplayName ; $row.Year = $year ; $row.Action = "student info update to " + $quser.City  
$table.Rows.Add($row)}

#uncommnet to update email for 6th graders
#if ($year -eq $elemyear){ Set-QADUser -Identity $user -Email $email }

#update year
$desc = $quser.Description 
$desc = $desc.substring($desc.length - 4, 4)
if ($desc -ne $year){
set-QADUser -Identity $user -Description "Students$year"
Add-QADGroupMember -Identity $groupid -Member $quser.DN 
Remove-QADMemberOf -Group  "$domain/groups/Students$desc" -Identity $quser.DN 
Move-Item $quser.HomeDirectory -Destination "$homepathroot\$year\" 
set-QADUser -Identity $user -HomeDirectory $homepath 
Move-QADObject -Identity $quser.DN -NewParentContainer "$domain/students/$year"
$row = $table.NewRow();$row.Name =$quser.DisplayName ; $row.Year = $year ; $row.Action = "update Year From " + $desc  
$table.Rows.Add($row)}

}

if ( $quser.samaccountname -eq $null)
{#Create User info
#Create AD account
New-QADUser -ParentContainer $parDN -Name $user -SamAccountName $user -LastName $csvuser.LastName -FirstName $csvuser.FirstName -City $csvuser.City -StateOrProvince $csvuser.State -PostalCode $csvuser.PostalCode -PostOfficeBox $csvuser.PostofficeBox -Description "Students$year"  -UserPassword $password -DisplayName $dname -UserPrincipalName $upn -Email $email -HomeDrive $homedrive -HomeDirectory $homepath -Company "Your School Name" 
Add-QADGroupMember -Identity $groupid -Member $userdn
Set-QADUser -Identity $user -UserMustChangePassword $true -ObjectAttributes @{c='US';userAccountControl=512;}
#if elementary password never expires and user can't change password
if ($year -gt $elemyear) 
{
Set-QADUser -Identity $user -UserMustChangePassword $false -PasswordNeverExpires $true  -UserPassword passwordforelem

}
$row = $table.NewRow();$row.Name = $dname ; $row.Year = $year ; $row.Action = "New Student Account Created"
$table.Rows.Add($row)
#folder info
if (!(test-path -path $homepath )){ 
#Create Home Directories
New-Item -ItemType directory $homepath
#Assign Access Rights
$account=$nbdomain + "\"+$user
$rights=[System.Security.AccessControl.FileSystemRights]::FullControl
$inheritance=[System.Security.AccessControl.InheritanceFlags]"ContainerInherit,ObjectInherit"
$propagation=[System.Security.AccessControl.PropagationFlags]::None
$allowdeny=[System.Security.AccessControl.AccessControlType]::Allow
$dirACE=New-Object System.Security.AccessControl.FileSystemAccessRule ($account,$rights,$inheritance,$propagation,$allowdeny)
$dirACL=Get-Acl $homepath
$dirACL.AddAccessRule($dirACE)
Set-Acl $homepath $dirACL
#Report Lne
$row = $table.NewRow();$row.Name =$dname ; $row.Year = $year ; $row.Action = "Home Folder Created"
$table.Rows.Add($row)}
continue
}

#updated name
if ($quser.samaccountname -ne $user ){

Move-Item -Path  $quser.HomeDirectory -Destination $homepath

Set-QADUser -Identity $quser.DN -SamAccountName $user -LastName $csvuser.LastName -FirstName $csvuser.FirstName -City $csvuser.City -StateOrProvince $csvuser.State -PostalCode $csvuser.PostalCode -PostOfficeBox $csvuser.PostofficeBox -Description "Students$year"  -DisplayName $dname -UserPrincipalName $upn -Email $email -HomeDrive $homedrive -HomeDirectory $homepath -Company "your school name" 
Rename-QADObject -Identity $quser.DN -NewName $user 

$row = $table.NewRow();$row.Name =$quser.DisplayName ; $row.Year = $year ; $row.Action = "0Renamed  "  + $user + $user.displayname 
$table.Rows.Add($row)
continue
}
}

#Get AD Users 
$ADusers = get-qaduser -sizelimit 3000 -SearchScope subtree -SearchRoot "$domain/students" 
echo "ad loop"
#Disable accounts not is CSV
foreach ($aduser in $ADusers){
if ($aduser.MemberOf -like "*noiaf*" -and $aduser.AccountIsDisabled -eq "False" ) 
#user does not have form disable account
{disable-QADUser -Identity $aduser.CanonicalName 
Set-QADUser -Identity $aduser.CanonicalName -WebPage "Disabled by Script NO AUP"

}
#if ($aduser.MemberOf -like "*renamed*" ){continue}


if ($csvtest -notcontains  $aduser.SamAccountName){
if ($aduser.AccountIsDisabled -eq "True") {Continue}
if ($aduser.MemberOf -like "*General Accounts*"  ) {continue}
if ($aduser.MemberOf -like "*disabled*"  ) {continue}
disable-QADUser -Identity $aduser.CanonicalName 
Set-QADUser -Identity $aduser.CanonicalName -WebPage "Disabled by Script"
$year = $aduser.Description 

#Report Line
$row = $table.NewRow();$row.Name =$aduser.DisplayName ; $row.Year = $year  ; $row.Action = "Withdrawn Student Account Disabled"
$table.Rows.Add($row)}}

report
$date = get-date -UFormat %Y-%m-%d

Copy-Item  c:\psscript\exportAD.csv c:\psscript\$date-exportAD.csv
del c:\psscript\exportAD.csv
c:\GADS\gads.bat

ftpcmd.txt used in the ftpexport function class="brush:ps">

USER ftpusername
ftppassword
get exportAD.csv
bye

GADS.bat called at the end to sync with Google Apps

c:
cd "C:\Program Files (x86)\Google Apps Directory Sync"
sync-cmd.exe -c "C:\GADS\gadsStudent.xml" -a 

sync-cmd.exe -c "C:\GADS\groups.xml" -a

script to call the power shell script from a scheduled task

powershell -file c:\psscript\addusers.ps1

Syntax Highlighter and Blogger Dynamic Views

2012-03-25T13:05:00.001-04:00

I recently switched to Bloggers dynamic views, and lost use of Alex Gorbatchev’s syntax highlighter. It took quite a bit of time but I got it working again. Instead of rewriting what others I have I just want to thank them and provide links to their work.
First Alex Gorbatchev for the Syntax Highlighter it’s self http://alexgorbatchev.com/SyntaxHighlighter/
The crux framework blog http://blog.cruxframework.org/2011/10/easy-code-syntax-highlight-on-blogger.html
The syntaxhighlight-blogger-dynamic project is what finally worked for me http://code.google.com/p/syntaxhighlight-blogger-dynamic/

I of course built my own Google code project to host the highlighter myself so that I could compile it with the brushes I wanted.
The SVN repo also contains the script I used to build my version and the wiki has a copy of the code used to insert code into your blog.
http://dlehman.googlecode.com

Thanks to all of these projects for helping me get syntax highlighting working.

Thinstation 5.0 and Windows Deployment Services

2012-03-10T16:20:00.000-05:00

My scenario

I have several old PC’s with 256 MB ram the hard drives are slow and the processors are not too speedy either. They are 7 years old, purchased in 2005. Some of them are just too slow to use effectively.

We are a windows shop, I have server 2008 WDS for imaging, which has tftp, and MS DHCP. Rather than setup another tftp and manage DHCP reservations I opted to install pxelinux on my WDS server.

What you need

Old pcs capable of pxebooting or look at Etherboot.
PXElinux
WDS server
DHCP server
Linux box to build thinstation
Web server to store and download configuration files
Time and patience

Optional helpful tools

Filezilla (to upload and download your conf files and the files you build later)
Notepad++ (to edit the conf files, use shell syntax highlighting)
vmware (to test changes faster)
putty (to login to the Linux box)

Install pxelinux to your WDS server

The following is a copy and paste of the first section on WDS from syslinux.org. I do not create the Linux folder because I am not deploying Linux, I create a thinstation folder.

http://www.syslinux.org/wiki/index.php/WDSLINUX

Download syslinux from http://www.kernel.org/pub/linux/utils/boot/syslinux/

Extract core\pxelinux.0 com32\menu\vesamenu.c32 andcom32\modules\chain.c32 from the syslinux download and put it on your WDS server in $WDS-ROOT\Boot\x86\ and $WDS-ROOT\Boot\x64\(substitute WDS-ROOT for where your WDS root folder is)

In the $WDS-ROOT\Boot\$ARCH folders Rename pxelinux.0 to pxelinux.com

Create a folder named pxelinux.cfg (in the $WDS-ROOT\Boot\x86\and$WDS-ROOT\Boot\x64\ folder)

In the pxelinux.cfg folder create a text file named default and add the following to it (you can substitute MyMenuBackgroundPicture640x480.jpg for any image you want as your menu background)

DEFAULT vesamenu.c32 

PROMPT 0 

NOESCAPE 0 

ALLOWOPTIONS 0 

# Timeout in units of 1/10 s 

TIMEOUT 300 

MENU MARGIN 10 

MENU ROWS 16 

MENU TABMSGROW 21 

MENU TIMEOUTROW 26 

MENUCOLOR BORDER 30;44 #20ffffff #00000000 none 

MENU COLOR SCROLLBAR 30;44 #20ffffff #00000000 none 

MENU COLOR TITLE 0 #ffffffff #00000000 none 

MENU COLOR SEL 30;47 #40000000 #20ffffff 

MENU BACKGROUND MyMenuBackgroundPicture640x480.jpg 

MENU TITLE PXE Boot Menu 

#--- 

LABEL wds 

MENU LABEL Windows Deployment Services 

KERNEL pxeboot.0 

#--- 

LABEL Abort 

MENU LABEL AbortPXE 

Kernel abortpxe.0 

#--- 

LABEL local 

MENU DEFAULT 

MENU LABEL Boot from Harddisk 

LOCALBOOT 0 

Type 0x80

Make a copy of pxeboot.n12 and name it pxeboot.0

make a copy from abortpxe.com and rename it to abortpxe.0

Create a folder named Linux (in the $WDS-ROOT\Boot\x86\ and$WDS-ROOT\Boot\x64\ folder)

Open the Windows Deployment Services Console,

Right Click on your Server and Select Properties,

From the Boot Tab change the default boot program for your architecture(x86 and x64 as well) toBoot\x86\pxelinux.com and Boot\x64\pxelinux.com respectively

NOTE: In the WDS included in Windows Server 2008 R2 the UI has changed and you have to use the command line to set the the default boot program.

Thus to change the boot program to pxelinux.com, the wdsutil command line tool has to be used: (do this also for x64 if you have x64clientsalso)

wdsutil /set-server /bootprogram:boot\x86\pxelinux.com/architecture:x86

wdsutil /set-server/N12bootprogram:boot\x86\pxelinux.com/architecture:x86

Now when you pxe boot a machine you will get your custom boot menu.

I recommend booting a machine to make sure you get the custom menu before going any further.

Getting and Installing Thinstation

I recommend reading the getting started and FAQ’s they cover a lot of information. Looking at the sample conf files provides a lot of insight as well.
http://sourceforge.net/apps/mediawiki/thinstation/index.php?title=Developer:2.5-starting
http://sourceforge.net/apps/mediawiki/thinstation/index.php?title=FAQ
http://thinstation.sourceforge.net/faq.html (the configuration section explains the order precedence of the conf files)
I chose to use the new http wget method for downloading conf files because tftp on WDS requires modifying the registry and it didn't work for me. Having the conf files on a webserver made them easier to edit in the long run.

Download thinstation from source forage

http://thinstation.org/

There are two options an ISO which you can boot and install the buildenviroment or a tar ball to set up the environment on an existing Linux box.

I chose the tar ball

download, extract, and run the setup chroot script

Building and Configuring Thinstation

CD to /ts and edit build.conf and thinstation.buildtime.conf

these are the two files that control build time options

build.conf controls what modules (think of drivers in the windows world) and packages that are included in the image. packages are the software, remote desktop ssh firefox etc.

some of the packages I added are;

rdesktop (windows rdp client)
ssh (to access conf files)
xterm (to access conf files)
icewm (window manager)

you will want to add extensions-x if you want to use hwlister

thinstation.conf.buildtime sets all options in the image.

These options include what sessions are available, sound and video options, but the most important ones to set are the settings related to finding your network configuration files.

near the bottom of build.conf you will find this
```
param baseurl http://yourwebserver.local/thinconf/
```
Now in thinstation.conf.buildtime you need to ensure these options areset

NET_FILE_ENABLED=On



NET_FILE_METHOD=wget

The rest needs to be relevant to your environment but here is what I chose and why.

There are no sessions defined at build time, this was to make sure I was pulling a conf file from the network, I could build one in now that network configuration is working, but probably won’t.The build time file contains items such as default audio level, ntp server time zone and much more.

Thinstation.conf.network contains the default window manager and its options. This allows me to get an environment to work in when no sessions are defined, or the machine doesn’t belong to a group yet.

thinstation.conf.network Snippet

SCREEN=0

WORKSPACE=1

KEYBOARD_MAP=en_us

USB_ENABLED=On

DAILY_REBOOT=On

RECONNECT_PROMPT=off

ICONMODE=OFF

MENU_SHOWRES=On

MENU_SHOWAPPS=on

MENU_SHOWABOUT=On

MENU_SHOWLOGOUT=on

SESSION_0_TYPE=icewm

ICEWM_THEME=blueCrux

SESSION_0_AUTOSTART=On

SESSION_0_ICON=Off

Building the image

Thinstation recommends

./build–allmodules

Run hwlister.sh

Add machine profile

Rebuild with only selected modules ./build

see getting started with thinstation 2.5 for details

There was no noticeable performance hit by using the all modules build. I used the all modules build because when I add another model machine I won’t have to rebuild and get a profile for it.

After running ./build –allmodules you will find your pxeimages in;

/ts/5.0/boot-images/pxe/

The only two files you need are

Initrd
Vmlinuz

All the other files were setup when we installed pxelinux to the WDS server

These files go in the folder you created for thinstation on WDS,

$WDS-ROOT\boot\x86\thinstation

/ts/5.0/boot-images/pxe/pxelinux.cfg

Contains a default file which is where I got the information to modify the default file we created earlier

this is my default file, I also added another subdirectory to test new builds and features now that this is in production.

DEFAULT
vesamenu.c32

 PROMPT 0

 NOESCAPE 0

 #ALLOWOPTIONS 0

 # Timeout in units of 1/10 s

 TIMEOUT 30

 MENU MARGIN 10

 MENU ROWS 16

 MENU TABMSGROW 21

 MENU TIMEOUTROW 26

 #MENU COLOR BORDER 30;44 #20ffffff #00000000 none

 #MENU COLOR SCROLLBAR 30;44 #20ffffff #00000000 none

 #MENU COLOR TITLE 0 #ffffffff #00000000 none

 #MENU COLOR SEL 30;47 #40000000 #20ffffff

 #MENU BACKGROUND MyMenuBackgroundPicture640x480.jpg

 MENU TITLE PXE Boot Menu

 

 #---

LABEL Thinstation

MENU Default

KERNEL thinstation/vmlinuz

APPEND initrd=thinstation/initrd video=uvesafb:1024x768-32,mtrr:0,ywrap
splash=verbose,theme:default intel_iommu=off amd_iommu=off console=tty1
loglevel=3 LM=3 

 #---

LABEL Thinstation Testing

KERNEL thinstation/test/vmlinuz

APPEND initrd=thinstation/test/initrd
video=uvesafb:1024x768-32,mtrr:0,ywrap splash=verbose,theme:default
intel_iommu=off amd_iommu=off console=tty1 loglevel=3 LM=3 

 #---

 LABEL wds

 MENU LABEL Windows Deployment Services

 KERNEL pxeboot.0

 #---

 LABEL Abort

 MENU LABEL AbortPXE

 Kernel abortpxe.0

 #---

 LABEL local 



 MENU LABEL Boot from Harddisk

 LOCALBOOT 0

 Type 0x80

Adding Groups

I have this working in my elementary and left myself room to add by using the groups feature.

I defined the rdesktop sessions for the elementary in a group called ES

thinstation.conf.group-ES

you add machines to a group by editing

thinstation.hosts

The group names are case sensitive and each host is required to have a comment after it.

I had to visit each machine to set it to pxe boot so populating the group file wasn’t much extra work.

After your in the icewm session use xterm to ssh to your webserver. The default hostname of your machine is ts_macaddress This makes it easy to get the current machines mac address for your hosts file. You can define a new host name and any number of groups like this.

Hostname macaddress groupname # comment

Reboot the machine and you should have the sessions you defined in your group file.

Congratulations if everything went will you have a working thinstation setup, I hope this article helped you find all the resources you needed to get this done faster than I did.

Printing in Chrome

2012-02-26T09:04:00.001-05:00

Recently my staff and students have had 3 separate issues with printing from chrome, all with the same solution.

1. Printing PDFs are low quality and the letters are not fully formed on the page.

2. Print preview shows everything on one page but the last line or two is cut off when the document is printed.

3. The printer prints a kernel error instead of your document.

To solve all of these issues skip the chrome built in print settings and use the traditional windows print dialog.

press ctrl + shift + P

I hope this helps some of you solve your chrome printing issue.

Google Apps Active Directory Real Time Password Sync

2011-07-15T17:18:00.000-04:00

Tools needed
Google Apps Directory Sync
Google Apps Manager
sha1hexfltr
passwordhk

There are a number of ways to sync passwords to Google Apps, the most common method is to use Google’s own tool, Google Apps Directory Sync (GADS) or the Google API. This tool does not natively read Active Directory’s binary password field. GADS will accept a sha1 hashed password, and that’s exactly what the sha1hexfltr does.
Sha1hexfltr captures the user’s password and puts the sha1 hash in the division field of active directory.
Setup GADS to use the division field as the password attribute. Once this is working correctly move on to the real time syncing.
Real Time Syncing
I have used GADS and sha1hexfltr combination successfully for a few months with my test users. GADS runs nightly to sync up.
Moving everyone to Google this summer, I wanted to head off as much confusion as possible in regard to what password to use. I knew of a password filter that would run the password through a script.
Setup gam to use OAuth and copy the gam directory and token to each domain controller.
Passwordhk will take any program or script that accepts two arguments, username and password

gam update user %1 password %2

Set the batch file as the pre change program with no arguments, the temp working directory to your gam folder

Problems and Solutions
Problem
The biggest problem with this setup is creating new user accounts. The password will be passed to gam and fail because the user is not in Google yet.
If you have users that are not in Google, this will be a problem.
Solution
I added two lines to my user creation script. one to rem out the gam update statement, and the other to put it back when the script finished
I added another line to call GADS.
With this setup Active directory and Google will stay in sync. The only gotcha to watch out for is changing, resetting a Password, or creating a user that will not have access to Google.

Google Apps + Postini with directory sync

2011-07-14T18:10:00.000-04:00

The process of getting Google apps and Postini in sync with your Active Directory can be challenging. Here is an overview of what you will need.

Passwords

Directory Sync

Postini Mail Filtering

Resources

Passwords

The first challenge is getting the user password to Google. As of this writing Google Apps Directory Sync (GADS) does not support Microsoft Active Directory Passwords (NTLM)
However it does support passwords hashed as sha-1 A project called sha1hexfltr is a password filter you can install on your domain controllers to rehash the user password into sha-1 and store it in the division field. You can get more information on this from the project home page

Directory Sync

After installing GADS you need to setup your configuration file. Most of this is straight forward just walk through the wizard and fill in all the information. In my case I am only syncing users.
The challenge I had here was excluding disabled users, my normal query gave me errors. This is one I found to work.

All users except disabled accounts


(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

The administration guide has lots of examples and will walk you through step by step. This is the only query that gave me trouble. I recommend doing several simulations starting out with a test OU.
To apply the changes you have to run the sync tool from the command line. I wrote a simple batch file to do this and made it a scheduled task, this keeps everything in sync.

Postini Mail Filtering

I will make a few things clear up front because Google's documentation is lacking.
I have the free version of Postini that came intergraded with Google apps. My users are synced over to Postini from Google. Postini DOES NOT replicate your Google apps OU structure.
The Google Apps Directory Sync for Email Security DOES NOT work with the intergraded version of Postini. I believe this tool is for syncing with Postini if you have it as a separate paid service.
The purpose of Postini is to provide spam and virus protection in addition to custom content filters. A custom content filter will allow you to allow or deny email based on a number of criteria, including who the message is to, or if the body contains certain words.

You can manually create org units to apply different filters to different users. There is two ways to get users into an org. Postini has a form you can just put the email addresses in, or they have batch processing commands you can use as well.
If you want to just keep email in your domain there is now an easier way. In your admin panel under advanced tools you will find email delivering options.

For details on configuring Postini suited to K12 environments go to www.appsusergroup.org.

Apps User Group was started to connect and assist schools who want to use Google Apps. The site contains links to Google's administration guide, and links to example configurations and policy guidelines.

Resources

sha1hexfltr http://code.google.com/p/sha1hexfltr/

Google Apps Directory Sync

Google Apps Directory Sync for Email Security

Apps user group http://www.appsusergroup.org

FirstClass Google Apps duel Delivery

2011-07-14T17:06:00.000-04:00

Here is a how-to on setting up FirstClass and Google apps for dual delivery, with two domains.

My setup

I am not moving existing mail at this time. My hope is that by giving users access to both systems, the email that is in FirstClass and not Google will be irrelevant for the majority of my users when the time comes to shut FirstClass down.

FirstClass original domain with all staff accounts, no students
Google apps new domain has student and staff accounts
This distinction is important later.

My domains

school.k12.oh.us original domain for staff (FirstClass)
school.org Google apps domain
ga.school.org
With this setup staff have three email addresses.

Configure Google to route mail to first class.

Email settings

Add route
Enter public IP of FirstClass server
Do not change SMTP envelope
Deliver for provisioned accounts

Configure FirstClass to accept mail from Google

This was easier than I thought. Shay Smith has a lot of information about this migration but the instructions for duel delivery did not work for me and generated undeliverable messages for non FirstClass accounts, such as students. This setup may have worked if Google and FirstClass had the same users.
https://sites.google.com/a/ddouglas.k12.or.us/shay_smith/Home/FirstClass-Migration-Plan

Setup Aliases

Use batch admin to set aliases for all users

PUT USER username 1252 0 username@school.k12.oh.us,username@school.org

I used a spreadsheet to parse this for a list of users
This allows FirstClass to accept mail for only those aliases specified and does not try to deliver to nonexistent student accounts.
Internet Services >> Advanced Directory >> Aliases >> inbound mail address set to Aliases only

Setup internal forwarding

Use batch admin to setup a forward rule for all users to send internal mail to the Google apps sub domain

PUT PREFERENCES username 1104 7 1 1157 7 0 4 -1 username@ga.school.org

Again use a spreadsheet
This subdomain is not set as an alias in FirstClass, this avoids duplicate messages in FirstClass.
Forwarding internet mail is not necessary because it is already getting delivered to Google first.

Conferences

Create a Google group that corresponds to your conferences
Setup and advanced rule on the conference to redirect all messages to the group.
It is not necessary to have group postings sent to the conference because it is delivered to the user’s inbox.

Migrated users

For users that have gone completely to Google and do not wish to use FirstClass anymore, set up forward and delete rules.
Setup an advanced mailbox rule to forward and delete if match local name
This will continue to forward the messages to the Google accounts that are sent internally on FirstClass.
Setup an advanced mailbox rule to delete messages that match internet address, these do not need forwarded because mail is delivered to Google first.

I hope this rough how to saves you all the research and mistakes I went through.

Hello World

2011-02-13T20:41:00.001-05:00

Well, this is my first blog post. This blog is planned primarily for my own reference of documentation and how-tos, in the hope that others can benefit from my experience as well.