The Comms Room

AdrianK

8:04 PM

@84104 Actually, I'd find your rant highly entertaining. Please indulge yourself....

pauska

does anyone here know if there are any drawbacks of using asynchronous group policy processing on terminal servers?

MDMarra

A true thing of beauty:

84104

@AdrianK Don't have quite enough rage for a rant. Maybe enough to carry around a protest sign that reads "Authentication != Authorization".

Iain

@WesleyDavid data.stackexchange.com/serverfault/q/122251 questions with accepted answers that have no upvotes

MDMarra

Universal Print Drivers make me not want to kill myself.

AdrianK

8:06 PM

@84104 That is perhaps the one single thing that my management DOES understand. The business rules around access to information in our in-house web-app would make a byzantine politician feel all warm & fuzzy.

Jeff Ferland

@84104 Carry on

Jacob

@MDMarra Well, old printers and nonuniversal drivers make me want to do the opposite.

84104

@MDMarra Xerox has less hubris, but the results are much the same. "Global" Printer Drivers for them.

pauska

@MDMarra and thats one of the reasons we don't use them

(they also fuck up EVERY single application we have that uses virtual printers for PDF etc)

jscott

@MDMarra Until someone updated the 32-bit, and not the 64-bit driver. Yes, love the UPD though.

MDMarra

8:10 PM

@jscott Well that's just silly

@pauska Interesting

jscott

Yeah, me and all the users thought so too.

MDMarra

Have you tried it lately?

Anything before 5.x was shit and we didn't use them

But we've had a lot of good luck with 5.3 and up

pauska

I tried a few months ago

I broke our RD farm

MDMarra

nice

jscott

@MDMarra When was v5.4 released? Oh, I can just look it up myself. Still on 5.3...

pauska

8:12 PM

argh.. nested group policies are toying with me head

MDMarra

recently

pauska

I cant get even a simple home page setting in IE to work

MDMarra

Our administrative printers are still on 5.3

The screen shot that I uploaded is for printers in academic areas. Labs mostly.

jscott

We're down to only one model-specific-HP driver. A DesignJet 500 plotter.

And there's only one of those in the whole district. Once the final XP clients are gone, we can also drop 21 32-bit drivers from the server.

pauska

ok.. what the F is wrong with this gpo

it doesnt even show up in the filtered list in rsop

Peter Grace

8:21 PM

FYI, I'm on serverfault.com/about now.

Thanks guys who care enough about me to notice :P

MDMarra

Big day

Peter Grace

You ain't kiddin. I just friended someone on google+ I met at LISA

He shared a link someone else posted that was... a link to my blog.

I feel important now.

I feel sorta like sally fields right about now.

jscott

And they gave you a larger image than Kyle or George!

TylerShads

we need stuff like this here

hatdash.com

tombull89

@TylerShads you reckon we could get SE to buy a SSD San for one of us to...uh...test?

TylerShads

8:25 PM

@tombull89 cough @PeterGrace cough

pauska

@TylerShads <blabla>

tombull89

I think Zypher and the SF team were looking at SSD SANs a while back.

I also believe chat runs on them. (SSDs in a server, not on a SAN)

TylerShads

@pauska first socks, now unicorns?

pauska

@TylerShads Unicorns? No idea what you're talking about

ok - new discovery.. apparently you MUST have authenticated users in a gpo delegation

and then block whoever who shouldnt get the gpo

jscott

@pauska Are you sure? I've policies that only list a specific group (not Authenticated Users)

pauska

8:29 PM

@jscott Its the only way the gpo showed up here

Peter Grace

@TylerShads magic 8 ball says "No Chance in Hell, Dude."

pauska

maybe I'm doing something wrong, but gpresult /r on the specific user didnt even list the gpo until I put authenticated users there

Peter Grace

@jscott Yeah, it's tough to contain my awesome in smaller pixel pictures.

TylerShads

@pauska gotta be because i have an account specifically for testing GPOs so that i dont bork the whole system w them, and its the only one i have in the list

WesleyDavid

@Iain You win one internet

jscott

8:31 PM

@pauska Weird, I just verified this policy applies to students. We do this all the time:

FWIW, "All Students" is not a member of any additional groups.

Iain

@WesleyDavid is it what you wanted ?

WesleyDavid

Everyone, can we dedicate a large portion of our upvotes to righting this heinous evil? data.stackexchange.com/serverfault/q/122251

@Iain Yes, and it's totally different than the queries I was trying and failing miserably at. Thanks!

Iain

@WesleyDavid s/writing/righting/

WesleyDavid

@Iain Beat ya'. =P

Zoredache

@WesleyDavid not all accepted answers are good.

Kenny Rasschaert

8:34 PM

@WesleyDavid Best. Initiative. Ever.

no but ours are, totally

WesleyDavid

@Zoredache But at least many are... in my experience anyway.

Kenny Rasschaert

and it hurts

There's many like this too:

3

Q: Why can I ssh to my server but cannot sftp into it?

I've got a VPS running Ubuntu 9.10 and I cannot sftp to the server with a regular account. I can ssh with a regular account and I can also ssh and sftp with root. Is there an option that I need to turn on so that regular users can use sftp? Thanks in advance, J.

someone with a very very specific problem who fixes it himself

noone will every benefit from that answer, but it was the right answer

Zoredache

Close as too localized?

MDMarra

@WesleyDavid OR, you can dedicate your time to hitting 10k so that you can cast delete votes on old crap with me, @voretaq7 and @Iain

Zoredache

@WesleyDavid So are you planning on posting any kind of summary for your 10k challenge soon?

WesleyDavid

8:39 PM

@MDMarra Working on it.

@Zoredache And yes, it's on my to-do list.

Iain

@MDMarra I've already run out of delete votes and I managed to delete some too

MDMarra

Are you doing a new 10k challenge for the new year

@Iain Yeah, I do it in the morning from my ipad while having my morning coffee

Iain

Yeah I do it during my wake upo coffee too

WesleyDavid

@MDMarra I'm working with a Ruby developer to make a site that will manage future Stack Exchange-based reputation challenges.

Not sure if it will ever see the light of day though. =)

Anyone here who likes Ruby and wants to pitch in... holla!

Zoredache

Can't people just go look at the /users?page=1&tab=reputation&filter=year tab?

pauska

8:44 PM

@jscott hrrrm.. why doesnt it work for me..

WesleyDavid

@Zoredache Yep, but the SE challenge concept would have some more fun to it.

Jeff Ferland

7k rep in a quarter is a pretty good clip ^.^

WesleyDavid

Just bought Portal and Portal 2 for $8.74 on Steam.

Huzzah.

I'm hoping to get 5K this year, but sadly not sure I'll make it. I'll need about 800 more rep in ten days.

Kenny Rasschaert

I've still got a copy of Portal in my gift list, if anyone somehow managed not to own it yet.

TylerShads

@WesleyDavid you should pick up Terraria as well, only 4.99 =3

Kenny Rasschaert

8:51 PM

Got it for free with my Portal 2 duo pack preorder

Iain

@WesleyDavid I didn't expect to get 10k this yeah but I'm only 650 short of 20k atm

WesleyDavid

@Iain What's your secret?

MDMarra

I got 12k for the year and I have no idea how

I'm way dumber than all of you.

WesleyDavid

Steam's search feature is completely useless.

Kenny Rasschaert

has been since day one

Iain

8:52 PM

@WesleyDavid jump on the easy ones when @ShaneMadden and @Quanta are away

pauska

remote desktop has suddenly changed name to terminal services in my administrative tools folder on a 2008 r2 server... hm

WesleyDavid

@Iain Quanta is treacherous to compete with.

Maybe I need to put my thinking cat on?

I'm really looking for a good co-op game. I really liked Alien Swarm for that reason, but they're not making additions to the story. No new official maps.

84104

@WesleyDavid Some of my friends recently got Borderlands, so I've been replaying it a bit. However, can't think of anything newish that has good co-op.

WesleyDavid

@84104 I also really like RTS stuff. I think RTS is my favorite genre.

Kenny Rasschaert

Ever played the Company of Heroes games?

84104

9:01 PM

@WesleyDavid I'm mostly just doing to AC:R multiplayer right now. It's fun stabbing things.

Kenny Rasschaert

There's this coop mode called Stonewall. Really challenging.

MDMarra

What's the threshold for editing tag wikis without needing approval?

84104

Right, I'm supposed to join some Steam group or something. I should also probably set an image on steam.

growse

Quick question for all: Any decent home-server iLO-like OOB management solutions?

Have got an unresponsive NAS that's 200 miles away and frustrated that there's no simple way I can find out what's going on :(

MDMarra

@growse Avocent makes some KVM-over-IP modules

We use the 24/48 port models, but I'm pretty sure that they make 1-of models too

growse

9:03 PM

@MDMarra can they do rebooting etc? as well?

WesleyDavid

@growse Lantronix Spider.

MDMarra

@growse Not usually

WesleyDavid

It's my go-to KVMoIP solution. Even has serial on it.

Kenny Rasschaert

@MDMarra We've got a couple of single-box Avocent KVM's

WesleyDavid

@growse You'll need to plug it into a managed power outlet thingy for that.

growse

9:03 PM

@WesleyDavid thanks for the tip

MDMarra

They have a Power Management license module for Dell, but that's because DRACs are just rebadged Avocent KVMs

I don't think they can do power management for just anything

growse

Thing is I don't know if it's a kernel panic, or something else

WesleyDavid

@KennyRasschaert Nope, never did. Not a massive fan of FPS games where the goal is total annihilation of all opponents, unless it's TF2.

growse

That said, most software failures I should be able to fix with a CTRL-ALT-DEL

WesleyDavid

I'm thinking about getting Dead Space. Looks like a frickin' awesome game.

Iain

9:04 PM

@MDMarra 20k

growse

@MDMarra I've heard avocent mentioned in the same sentences as a company called Amulet - any experience of them?

MDMarra

@growse If it's commodity hardware and you want power management, you'll have to get somelthing like @WesleyDavid

Never heard of Amulet

Kenny Rasschaert

@WesleyDavid It's an RTS

growse

Fair enough

WesleyDavid

@KennyRasschaert DERPDERPDERP

As you can tell, I'm not a huge gamer.

growse

9:06 PM

Eeek, SecureLinx spider is £208...

That said, I never really had a budget in midn

pauska

@jscott do they have any other gpo's that get applied before that one?

WesleyDavid

I'm still playing through NetRogue

@growse Oh, yes, it's about $200USD, so there's that. =)

growse

Bummer

WesleyDavid

I've never seen a single unit KVMoIP device for less that was worth it.

growse

Well, no point spending money on something rubbish

This is what CREDIT CARDS ARE FOR!!!!

\o/

Kenny Rasschaert

9:08 PM

@WesleyDavid Magicka is probably worth looking in to if you like coop.

pauska

We're using raritan IP-KVM switches.. work great

Kenny Rasschaert

Although you'll probably end up resenting your friends for life...

84104

@KennyRasschaert Is it still buggier than an ant colony?

pauska

virtual usb cd/dvd etc

Iain

where are all the spammers when you want them - 9 flags required to get back to 750

Kenny Rasschaert

9:09 PM

@84104 Couldn't tell you. I had some major issues with it at some point, then I got a kickass new pc and now it runs fine.

84104

@KennyRasschaert My machine was fine, but all of us kept falling though the floor in multiplayer.

jscott

@pauska Yes, there are other links "above" and "below" the one in the screenshot. As you approach our domain's root, the GPOs use larger groups in the Security Filtering -- Building students, All Students, All users. GPOs linked in the domain root (Default Domain policy, Password policy) are "Authenticated Users".

pauska

@jscott grr.. why wont it work for me

jscott

@pauska Did you try rsop.msc to model it?

MDMarra

@jscott Seems like a lot of work. I'm assuming you are applying user policies but want them to apply in specific geographic locations?

Any reason not to use Group Policy Loopback mode?

pauska

9:11 PM

@MDMarra no, its like the 9th wonder of gpo's

MDMarra

What is?

pauska

(when it comes to terminal servers)

Loopback?

loopback mode

Ah

9:12 PM

and other shared computers

MDMarra

We don't have TS here

We use it extensively in our labs though which are all shared heavily

pauska

shared computers then

:)

MDMarra

Not sure what you mean by 9th wonder?

It's good, bad, elusive, doesn't exist?

pauska

or to be more correct, "special" computers that users log on in addition to their own desktop.. thats when it shines

MDMarra

@pauska yeah

Loopback mode is that cat's meow...I'm looking at you @WesleyDavid

WesleyDavid

9:13 PM

@MDMarra hiss

growse

@WesleyDavid sorry, one more thing on the securelinx's - what's the virtual cd support like? Especially booting off the virtual media?

pauska

@MDMarra one of the worlds greatest wonders

are you really this slow?

MDMarra

Got ya

pauska

:(

jscott

@MDMarra Each school/building has an over "engineered" OU layout. Here's one school, the High School.

MDMarra

9:15 PM

Yeah, I prefer loopback mode to the great wall and hanging gardens, for example

jscott

MDMarra

That looks reasonable to me

The grades for each student might be a bit much

but thats how I have our labs/classrooms laid out in AD at the collegiate level

WesleyDavid

@growse You can boot from virtual media that's either in the PC that you're access the Spider with or from a central NAS repo.

I like to have ISOs on a server, and then use the Spider to access that ISO share using credentials.

jscott

@MDMarra I agree on a "bit much" but any staff users can request "settings" for their students/computers. So it gets hair with using just Security Filtering close to the root.

WesleyDavid

BEcause many times I'm accessing the Spider from my laptop, over a VPN connection. No way I'm streaming an ISO over that. I keep local ISO repos at clients .

growse

9:16 PM

@WesleyDavid Brilliant, thanks. I don't have a CD drive in the NAS, so when I do need to boot a rescure disk, it can be a right pita.

pauska

@jscott gpresult /r (same deal, RSOP session)

jscott

By large the staff/student user and group objects are automated[1]. So most problem creep in from manual-technician-manipulation.

@MDMarra We could probably get away with "authenticated users" most places, as we link in the most specific OU possible. Some of the stuff like "SRP Resticted users" needs the filtering, but it's not that many policies total.

MDMarra

@jscott I see. I don't understand all of the security filtering that you were describing before though. Seems like it could be simplified with loopback mode (but I don't fully understand what all the filtering is for)

WesleyDavid

This one goes out to @ScottPack

MDMarra

@jscott ah, I see

I thought you were using it to apply user policies to all users logging into specific groups of computers

WesleyDavid

9:20 PM

Wonder if my ISP is going to flag me. I installed Steam on a new PC and am downloading my games. Up to about 15 gigs now. Possibly 50 by the time I'm satisfied with the library.

jscott

@MDMarra By large, our loopback needs are printers for labs/libraries of computers.

MDMarra

yep, same here

Various logon (not startup) scripts and other options based on computer instead of user are useful to us too

pauska

GAAAAAAARRRRRRRRRRRHHHHHHHHHHH

%¤%%¤!&!¤&/%¤"/!¤"#§"#!¤

2

I dun get it.. hulk sniff boo

jscott

I'm hoping someday to go back through everything, consolidate settings, eliminate places where settings go on, off, on, not-configured as they fall through. And better document :)

MDMarra

@jscott We recently collapsed our two forests (academic, administrative) into one

We scheduled a weekend of downtime during a break

one day was conversion

jscott

9:26 PM

@MDMarra Was it fun? One day!?! Dang.

MDMarra

the other day was me fixing everything that's bothered me for the last two years

@jscott I did a lot of prep

and users/groups were migrated in advance

So 12 hours was two servers converting workstations and their local profiles in all of our labs and classrooms

jscott

@MDMarra Sounds like you did the right prep too. Hoping I'll get a day, someday...

MDMarra

Yeah, it was 3-4 weeks of testing

including setting up a scaled down copy of our environment at least 4 times

84104

@WesleyDavid I mostly use the backup/restore to transfer those sorts of things.

MDMarra

Quitting time. Later!

jscott

9:29 PM

Laters.

pauska

@jscott Hmm.. I added authenticated users again, only this time without allowing the group to apply the policy, and everything automagically works

I'm starting to think that the terminal server it self can't read the gpo

@jscott: can you check the delegation page and see if you have any custom entries there for reading the gpo?

gah he left in a hurry

WesleyDavid

@MDMarra Quitter.

Jacob

9:43 PM

My server room just hit 87 degrees :(

Chris S

Temp 1: Ambient Zone Ok 16C

@Jacob Could be worse. Our alarm doesn't trip until 102ºF.

Jacob

@ChrisS Thats true, luckily someone was here, I no internet to setuo alarms yet

pauska

9:59 PM

modern servers can tolerate 30C just fine Jacob, they just make a hell alot of noise

Zoredache

If the room temp is 87, that may mean the equipment is warmer though. It does take some time to warm the air up.

AdrianK

You HVAC condenser freeze up?

Jacob

@AdrianK No a three-way valve locked open and when the Fan runs, we get warm air. Our boiler is over powering our AC.

pauska

your.. boiler? I must be inexperienced in A/C stuff

anyways, been at work for 13 hours

time to go home

LATERS

AdrianK

@Jacob Ouch. You have good Facilities staff, I hope?

That's one of the few great things we have around here.

Chris S

10:06 PM

If it was built to be a server room there should be a manual shutoff/maintenance valve inline with the the 3-way somewhere so you can shut it off.

Holocryptic

'sup snowflakes

84104

@Holocryptic Z>0

Holocryptic

what's that jibberish you be talking at me?

84104

@Holocryptic The comments I make are to show that I'm listening, any humor is incidental.

Holocryptic

Well, your significant other should be pleased that you're such a good listener :)

AdrianK

10:17 PM

@ChrisS But you're assuming competence on the part of the management that actually makes the decisions.

Jacob

@AdrianK I work for my fathers HVAC Company. It's a good staff :)

84104

@AdrianK Does you "server room" have carpet in it?

Holocryptic

I hear that's all the rage these days

AdrianK

@84104 No, but it does have a "flood pan" since the retail space above the room was a restaurant kitchen at one point. Too bad the flood pan wasn't leveled properly and wouldn't have ever worked right.

84104

@Holocryptic It causes a lot of rage these days.

Fixed that for you.

Holocryptic

10:19 PM

ha

AdrianK

@Jacob There's always the adage about the cobbler's children or the mechanic's car though.

Holocryptic

In other news, I'm getting ready to play the new Star Wars MMO. I'm excited

AdrianK

@Holocryptic How's the percocet treating you?

Jacob

@ChrisS The're working on finishing my zone now, so it's not in yet.

Holocryptic

@AdrianK Like a gentle lover

AdrianK

10:21 PM

Hey, which one of you hooligans is jscott on Twitter?

Holocryptic

that would be @jscott

AdrianK

@Holocryptic Yeah, I'm old and stuff. I forget things.

84104

@Holocryptic Too obvious. It's probably Jacob.

Holocryptic

@AdrianK It's ok. It happens to the oldest of us

AdrianK

@Holocryptic Getting old stinks. Makes recovering from hangovers a lot tougher.

Holocryptic

10:25 PM

mmm. Hear that.

The only downside to the percocet is that my mind tends to wander. I have a hard time focusing on anything...

AdrianK

@Holocryptic I'm impressed you have any ability to concentrate at all. I was a mess on Oxy when I busted my arm. Still amazes me I didn't blow up my customer's entire Mediation install.

Holocryptic

haha. I just try to take it slow is all.

WesleyDavid

10:41 PM

@Iain So this is how you made 20K this year: serverfault.com/a/342948/9770

Tee hee. =P

Iain

@WesleyDavid like I said jump on the easy ones

@WesleyDavid and I'm still 5-600 short

@WesleyDavid and that's gone to SU so that's 45 more now :(

WesleyDavid

@Iain At least I have more rep than you on SuperUser. Wait... that's not a good thing... =(

Iain

@WesleyDavid most of my rep on SU is from migrations

Mark Henderson

10:56 PM

@Iain Only after the next rep recalc ;)

Iain

@MarkHenderson I keep my rep up-to-date. I remembered a particularly bad beer brand too tooheys

Jacob

11:11 PM

@MarkHenderson Nuking from Orbit appears to have work as far as permissions go. Thanks for your help!

AdrianK

bit annoying when I try to upvote really good helpful answers on SO and remember that I don't have the points for that.

Shane Madden

@AdrianK You don't? Doesnt upvote need <100 rep?

AdrianK

@ShaneMadden I don't even have a real account over there. Just a 1 rep extension of my general stackexchange account.

Shane Madden

@AdrianK Ahh - link an account and it gives a free +100

AdrianK

thx. will have to figure that out later

Mark Henderson

11:51 PM

@Iain haha still having this discussion? Tooheys isn't too bad, but it is a cheap beer

There are many that are much better

@Jacob No worries. Its a sad part of windows sysadmin life that when building new servers, nuke from orbit if you haven't gone too far

Holocryptic

I just shot a dad in front of his kid, then told the kid that he'd thank me for this one day. Ah, the joys of being a Sith

MDMarra

JimB is wrong in the comments to this answer, right?

0

A: Assign log on as local admin to domain account

great how-to here: http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

Shane Madden

@Holocryptic How does that even.. happen? I'm not exactly 100% on Star Wars lore, but I think I remember Yoda saying there couldn't be more than 2.

@MDMarra Yeah.

Holocryptic

@ShaneMadden That was after Darth Bane started enforcing the Rule of Two. This is prior to that /nerd

Shane Madden

@Holocryptic "Lore modified to suit whims," got it.

Holocryptic

11:57 PM

@MDMarra I'm pretty sure there's a meta post on it somewhere. I'm busy shooting dads to look it up though

Shane Madden

Crap, I'm out of stars until 2 minutes from now.

Holocryptic

@ShaneMadden It's a crap ton better than Star Trek's "Conflicting stories? There's an alternate reality for that!"

3

Shane Madden

@Holocryptic Hah, fair enough

Transcript for