Fiddlehead

Solution to inability to log onto the domain

Dave — Thu, 07 Jan 2010 15:26:04 +0000

One thing we noticed on our “locked” Fiddlehead PC’s from time to time was that we would be unable to log onto the domain. Once it happened we would have to take the seat off of the domain, add it to a workgroup, and then rejoin the domain. Not hard to do but just a pain.

We couldn’t figure it out until we were visiting with one of our partners. They said they had exactly the same problem using DeepFreeze. Turns out that there was something in the AD implementation called autoenrollment that would revoke and reissue certificates for security purposes. Well, if the system was locked down, the machine would be kicked off the domain. The solution is fairly simple if you want to use lock workstation. Here is the Microsoft solution…do it in reverse:

The Active Directory (AD) implementation used with Windows Server 2003 has a feature called, autoenrollment that you can configure to automatically revoke and delete user certificates on the Certificate Authority (CA).

To set up the autoenrollment feature, follow these steps:

   1. Go to the Group Policy Objects (GPO) settings, and select Properties for the object, then click Edit and drill down until you get to “Object Type.”

   2. Right click on “Autoenrollment Settings” and go to “Properties.”

   3. Check “Enroll Certificates Automatically” and once the box appears, select the two checkboxes underneath it.

   4. Click OK and you’re done.

Visit the Microsoft Web site for a more in depth explanation (http://microsoft.com).

The autoenrollment feature should add a little bit of extra system access security. If you choose not to use it, you have to delete all user accounts from the system manually. Also, remember that loose certificates sitting on compromised machines, stolen laptops or other errant equipment, can be exploited by users whose accounts may be gone, but whose ghosts aren’t.

Using Fiddlehead as an easy cloning tool

Dave — Wed, 06 Jan 2010 20:12:57 +0000

I spend a lot of time at customer sites and I love to hear about the features they would like for us to add. One of the most prolific requests has been a single head version of the product.

“Why do you want a single head version of the product,” I would ask.
They all respond with the same thing. “Because I can use Fiddlehead’s cloning tool whether I am cloning from a Dell or an HP or a Gateway. It makes no difference what the hardware is…my Fiddlehead image is the same”
So, that got me thinking. We have added Teacher Control software because the teachers asked for it. We added Lock Workstation because they asked for it. We added virtual CD’s because they asked for it. We have added and added lot’s of teacher friendly features, so I thought that this would be a great IT friendly feature. Turns out it is a product unto itself.
We are going to call it COSMOS. It will be a simple control kernel installation installed on the hard drive. It’s so small it could update BIOS. Once done, you load your copy of Windows or whatever and your image is now hardware agnostic when copied from one COSMOS machine to another, or to a Fiddlehead cluster. It makes no difference what the hardware is. We are testing it right now. I’ll keep you up-to-date.

Speed up network login

lmilesw — Mon, 07 Dec 2009 23:33:36 +0000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
“SynchronousMachineGroupPolicy”=dword:00000000
“SynchronousUserGroupPolicy”=dword:00000000

Network Permission Issues

lmilesw — Mon, 07 Dec 2009 15:03:40 +0000

Problem

Many computers will not automatically authenticate on network shares even if permissions are set properly so everyone has access thus you cannot fix network permission issues.

Solution/Procedure

Navigate to the network share from explorer after a fresh log in to be sure you don’t have a previous session open and already authenticated.
If the computer is having issues properly authenticating it will prompt you for a username and password in the username box type “Everyone” in the password field leave it blank, and were it says remember password check the box.
You should now be able to see the files located on the network drive. If you cannot and it re-prompts you for a username and password the user “everyone” does not have permissions set.
If you cannot see the files on the network drive change the file permissions on your domain for that network share to allow everyone to properly access it.
If it does let you see the files properly restart the station and try to navigate to the same place again, this time it should not prompt you for a username and password. It should just display the files.

You now have properly set up the computer to verify as the “everyone” user before asking for a password instead of always prompting for credentials.

Enabling Belkin network USB hub (part # F5L009) in a virtual machine

lmilesw — Mon, 07 Dec 2009 14:49:55 +0000

Symptoms

Belkin software running in the virtual machine connects to the hub Drivers do not show up in the attached devices list.
Resolution Device manager shows missing driver for USB mass storage device.

Solution

The USB driver needs to be manually copied. Since ESX Server does not provide direct support for USB, USB drivers are not installed in the guest operating system by default. USB-over-IP devices depend on the USB core files to install properly.

Procedure

To enable the rest of the installation, copy and rename the required file from the original operating system CD:
- Source: usbd.sy_ in the \i386 directory of the CD
- Destination: usbd.sys in the \system32\drivers directory of the guest operating system.
After copying this file, reboot your machine.
You can then continue with the Belkin software installation.
ONLY Windows XP is effected by this

Ease of use

lmilesw — Wed, 18 Nov 2009 20:20:58 +0000

We plan to automate much of the setup

One of the "25 Hot Products For Education"

lmilesw — Fri, 24 Jul 2009 13:27:13 +0000

Fiddlehead was listed as one of the hot products for education recently by ChannelWeb. They picked 25 of the “more interesting education products” in the NECC exhibit hall in Washington DC this year out of “hundreds of IT vendors”.

Duplicate Computer Name Confusion

Josh — Wed, 08 Apr 2009 17:26:53 +0000

A newly installed Windows station on a Fiddlehead cluster will often display the warning “A duplicate name exists on the network,” even if it’s the only machine on the network at the time.

The reason for this is that Fiddlehead present two virtual network interface cards (NICs) to each station. One NIC is connected directly to your network to provide the station with access to your network resources (and vice-versa). The other NIC is an internal connection between the station and the Linux host operating system. This second connection ensures that things like the virtual CD library, Search to Teach, and the station # in the corner still work if your network goes down.

The problem arises when Windows sees an “echo” of itself on the network. Fortunately, the fix is simple, and you only need to do it on your master image, since the setting will persist when you clone your stations.

Open up the “Network Connections” page of the Control Panel and in the Advanced menu at the top, select Advanced Settings. In the dialog that opens up, select Local Area Connection 2 and move it to the second item in the list using the arrow buttons to the right of list. Then uncheck all the boxes in the lower list for Local Area Connection 2. Hit “Ok” to apply the changes and you’re all set.