Category Archives: Labs

Posts about computer labs and classrooms at Williams College

Kiosk – Group Policy Changes

Group Policy Changes for the Kiosks/Public computers:

Disable Switch User

Computer Config – Admin Templates – System – Logon – Hide entry points for Fast User Switching ….. Set to “Enabled”

Disable Lock Computer -(done in two policies)

User Config – Admin Templates – Control Panel – Personalization – Password Protect the screen saver … Set to “Dsiabled”  (Lock button still appears but it doesn’t do anything)

User Config – Admin Templates – System – Ctrl+Alt+Del+ Options – Remove Lock Computer … Set to “Enabled”

Remove Logoff – (needs two policies as well)

User Config – Admin Templates – Start Menu and Taskbar – Remove Logoff on the Start Menu … Set to “Enabled”

User Config – Admin Templates – System – Ctrl+Alt+Del+ Options – Remove Logoff … Set to “Enabled”

Disallow Change Password –

User Config – Admin Templates – System – Ctrl+Alt+Del+ Options – Remove Change Password … Set to ‘Enabled”

Remove Task Manager —

User Config – Admin Templates – System – Ctrl+Alt+Del+ Options – Remove Task Manager … Set to “Enabled”

KeyServer – Client specific files that should not be included in cloned image

Before Capturing any master image be sure to delete these files:

(For details see: http://www.sassafras.com/hrl/7.0/clone.html )
The following is from the above link …

Windows file list

The following files and directories should NOT be copied from one computer to another:

KeyAccess Audit, which is located in one of these directories depending on OS version and KeyAccess version:
C:\ProgramData\KeyAccess\
C:\Documents and Settings\All Users\Application Data\KeyAccess\
C:\Documents and Settings\All Users\Application Data\
C:\ProgramData\
C:\WINDOWS\
C:\WINNT\
KeyAccess Offline, which is located in one of these directories depending on OS version and KeyAccess version:
C:\ProgramData\KeyAccess\
C:\Documents and Settings\All Users\Application Data\KeyAccess\
[User Profile Dir]\Local Settings\Application Data\
C:\WINDOWS\
C:\WINNT\
portable.dir, which is a directory and is located in one of these directories depending on OS version and KeyAccess version:
C:\ProgramData\KeyAccess\
C:\Documents and Settings\All Users\Application Data\KeyAccess\
[User Profile Dir]\Local Settings\Application Data\
C:\WINDOWS\
C:\WINNT\
[Any Drive]:\portable.dir\

The following registry settings should NOT be copied from one computer to another:

registry: HKEY_CURRENT_USER\SOFTWARE\Sassafras\KeyAccess\Settings\pref
registry: HKEY_CURRENT_USER\SOFTWARE\Sassafras\KeyAccess\Settings\settings
registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KeyAccess\Settings\pref
registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KeyAccess\Settings\settings

Note: The KeyAccess client install creates a keyacc.ini file in the windows directory even when you accept the default, “store settings in registry”. The line, “registry=2” in keyacc.ini tells KeyAccess to consult the registry for additional settings, so keyacc.ini must be included in the cloned image. If you have customized the client install (using the k2clientconfig utility) so it stores all settings in the keyacc.ini, then this file must be edited before cloning. Remove all lines beginning “previd” or “prevhw”.
OS X file list

The following files should NOT be copied from one computer to another:

/var/root/Library/Preferences/KeyAccess Audit
/var/root/Library/Preferences/KeyAccess Offline
/var/root/Library/Preferences/KeyAccess Prefs
/var/root/Library/Preferences/Portable Keys (don???t move)/ — nothing in this directory should be copied to another computer
/Library/Preferences/KeyAccess/KeyAccess Audit
/Library/Preferences/KeyAccess/KeyAccess Offline
/Library/Preferences/KeyAccess/KeyAccess Prefs
/Library/Preferences/KeyAccess/Portable Keys/ — nothing in this directory should be copied to another computer

If you want cloned clients to point to the same KeyServer as the computer you took the image from, you should be sure to copy the file /Library/Preferences/com.sassafras.KeyAccess.plist

Windows – Novell settings for Lab image

Novell Client Settings used on 2013 Windows Lab image (the novell client is not used on Mac OS)

set novell client login link on users desktop to a shortcut to c:\windows\system32\loginw32.exe

In Novell Client Properties …

Set Client Props –

LDAP Contextless Login Tab:

  • Enable LDAP Contexteless login
  • Enable LDAP Treeless login
  • Enable LDAP Context Search Scope
  • Trees = o=williams
    • Search Context and Subtree
      • ou=student,o=williams
      • ou=faulty,o=williams
      • ou=staff,o=williams
      • o=williams
  • Servers
    • nwldap.williams.edu
    • nds1.williams.edu
    • nds2.williams.edu

Service Location Tab:

  • Scope List
  • o=williams

 

Advanced Login Tab

  •  Use all defaults except for these:
    • Computer Only Login Default – Always
    • Forgotten Password Prompt – Off
    • Last Loged In User – Off
    • Logged In Profile List – Off
    • Novell Logon – Off
    • Show login Windows password sync – Off
    • Supress NMAS Support for Computer Only Login – On
    • Tree Box – Off
    • Use NMAS for Windows Login Default – Never

Once all this is set you need to save by clicking OK and then reboot.  Next try to log into Novel which will likely fail with can’t find the server … Then log into the computer and go back to Novelll Client Settings and set :

System Login Profiles Tab (this is not be available until after first login attempt)

  • Default – eDirectory Tab:
    • Trees = WILLIAMS
    • Contexts = williams
    • Servers = achilles

Lion – AFP – Change secutiy setting to allow connections to legacy file servers

Lion has upped the anti on AFP security. To connect to older, legacy Novell servers one needs to do the following …

sudo chmod o+w /Library/Preferences
sudo defaults write /Library/Preferences/com.apple.AppleShareClient afp_host_prefs_version -int 1
(creates the file)

Connect to an AFP server like MacSus to populate file created above

sudo defaults read /Library/Preferences/com.apple.AppleShareClient afp_disabled_uams
(to see a list of the disabled login methods)
sudo defaults write /Library/Preferences/com.apple.AppleShareClient afp_disabled_uams -array
(to remove all from disabled list)
sudo defaults write /Library/Preferences/com.apple.AppleShareClient afp_disabled_uams -array “Cleartxt Passwrd” “MS2.0”
(to keep a few disabled – I don’t know which are the problem so I undisable all of them)
sudo defaults read /Library/Preferences/com.apple.AppleShareClient afp_disabled_uams
(to confirm the change)
sudo chmod o-w /Library/Preferences
(to reset the directory prefs)

For details see:
http://support.apple.com/kb/HT4700

BootCamp – Imaging windows with winclone

Using a lab windows image on a dual boot mac —

  • Prepare a base windows image in Dell hardware and sysprep
  • Take an image with KACE/Ghost but don’t allow drive to boot after
    • With ghost you need to uncheck “Reboot” in the Misc Options before starting to take image
  • Physically remove hard drive from dell hardware and put it in a Mac Pro Tower but don’t let it boot yet
  • Use an external disk that has winclone loded on it to boot the mac
  • Take a winclone image
    • Before taking winclone image, set perferences to use the “special” format that is not mountable but is smaller and restores faster.

This image should then be restorable to any bootcamp windows partition using the external mac boot disk and winclone as above. After restore you’ll need to boot to the windows volume, letting sysprep complete and then run the bootcamp drivers disk for that mac model.

Add any additional software/settings, re-sysprep, and then take an image of the windows volume with DeployStudio.

KACE – Software installs from alternative download

Using the KACE 1000 server to install software from the “Alternative” download share … (This preserves disk space on the server for the patch feed.)

1) Create zip file of install files. (Be sure to just zip the files and not the enclosing folder. The install process is going to be looking to work with something like “.\install.exe”)

2) Copy that zip file to \\kstore\apps (Gabe needs to give your account write permission to that share.)

3) Create a dummy zip file which has only one small file but has the exact same name as the zip file you just copied to the \\kstore share (be careful not to overwrite and/or confuse these 2 zip files.)

4) Map a drive on a windows box that is running the KACE 1000 client to the \\kstore\apps share

5) Create the checksum for the zip file stored in the \\kstore\apps location with the command:
"C:\Program Files (x86)\Dell\KACE\KDeploy.exe" -hash=k:\FILENAME.ZIP

6) Log into the KACE 1000 server and go to Inventory – Software – Choose Action – Create New Item …
Enter a relevant Display Name, Select the target Operating Systems, and choose the small dummy zip file as the file to upload and associate with this software item. Save this item.

7) Next go to Distribution – Managed Installations – Choose Action – Create New Item …
Select the software item you just saved above. Leave everything blank till the “Installation Command” section. I select “Configure Manually” and enter the exact install command as in “setup.exe /S” and then check off “Run Command Only” and “Don’t Prepend msiexec”. Also check off “Use Alternative Download” which opens a couple more boxes. In the first, put your share location, mine is: \\kstore\apps, next paste in the checksum you generated earlier, be sure to carefully delete the extra crap at the beginning and end of the actual checksum. Enter the username and password for an account on the share that has read access to the share location. (Gabe is the keeper of these accounts) Enter any notes you may want, also select the target computers which should get the install and set the installation time frame and lastly for the Managed Action: select “Execute Anytime”. Then save the item.

Now – as the targeted computers check-in – they should see that they have an installation waiting and they should attempt the install. Assuming everything is correct above the installs should proceed.

Troubleshooting —

1) Be sure that the install command is absolutely correct. To do this test the install command in a command window on a test computer or VM.
2) Be sure the name of the dummy zip file and the real zip file are identical.
3) Be sure the checksum is created against the real zip file stored on the share.

Mac – Command to remove Users “Large” and “Old” files

This command finds all files larger than 10 MB AND which haven’t been accessed in over 4 weeks:
sudo find /Users -size +10M -atime +4w

This finds the same and removes them (there is no undo!):
sudo find /Users -size +10M -atime +4w -exec rm {} \;

There appear to be large cache files being created in the Fall of 2014 …. this command removes them:
sudo find /Users -size +100M -name lsm_map -atime +2w -exec rm {} \;

When booting to external drive, this finds files 100 MBs large and 4 weeks old and lists them with “ls -lah”:
sudo find "/Volumes/Macintosh HD/Users" -size +100M -atime +4w -exec ls -lah {} \;

Lists the total size of a directory structure:
sudo du -sh /Users/xxx