Bit of back-story; I bought a new 2011 MacMini on release day, which was the same day Lion was launched, all I use it for is an iTunes server, and general file server at home, and since day 1 I’ve been having strange issues such as the following:

• As it runs headless in the closet, I setup the scheduled wake-up and sleep settings, which worked about 50% of the time.
• After using ScreenSharing or LogMeIn, the MacMini would completely lockup for no reason, fan’s run at full speed, and I’m unable to connect to it via AFP, SSH, VNC (ScreenSharing) or even Ping it, and the only way to get it back is to force a power off.
• I decided to upgrade the RAM from 4GB to 8GB, and after doing that, at first the machine wouldn’t boot, so I thought it was a dead stick of RAM so I swapped the “dead” RAM into my 2010 MacBook Pro, and it works fine. I put the 8GB of 3rd Party RAM that I had in my MBP, and it still failed to boot, reseated the RAM again, and finally it started to work with 8GB.

One of the schools we manage has an IT suite made up of 20 iMacs, which we chose when they told us they wanted to start teaching Media Studies and Photography at A Level.

The iMacs came in at a great price, easily cheaper than the equivalent HP or Dell PC, when you factor in the 21.5 inch screen. They are sleek, good looking, and met all the requirements for the Media Studies teachers, the issue we had was that not only did the school want to use iMacs for Media Studies and Photography, but they also wanted to use the room for regular IT and Business Studies lessons, which meant that they also needed to run Windows, and Microsoft Office and the rest of their software, and have access to their home areas, and other shared data.

Now Apple addressed the issue of people wanting to use Windows on their Apple hardware when they introduced Bootcamp back in 2006, which lets you partition up your hard disk and install Windows XP, Vista or 7 from a DVD. However nobody wants to manually setup 20 machines, join them to the domain, install updates and software, why can’t you just image them like any other managed PC, well you can…

NOTE: Apple has since dropped support for Windows XP and Windows Vista with Boot Camp Assistant 4.0.

This summer, we rebuilt the clients entire deployment structure and upgraded to Microsoft System Center Configuration Manager 2007 R3 SP2 (SCCM). We had previously been using a combination of Windows Deployment Server (WDS) and had used the Microsoft Deployment Toolkit 2010 (MDT) to image the 350 PCs onsite including the iMacs last year. We decided to update to SCCM as we felt that we could make use of the enhanced features and management, such as being able to deploy software to groups of PCs when it was needed rather than previous years where we had to build and distribute one massive 45GB image to all 350 PCs – which whilst got the job done is hardly efficient.

I’m going to assume that if you have gotten this far that you already have a working SCCM installation, as I’m not going to show how I have setup SCCM at this site, that would be a waste of both our times, but as an overview we have 1 Primary Site – which controls everything – and 3 secondary sites that are used solely as Distribution Point and PXE Service Point.

This guide also assumes that you have experience with OS X and you know how to use the Boot Camp Assistant.

Into the nitty-gritty…

Basically, deploying your image/task sequence to an iMac is the same as deploying to any other PC, apart from 2 things:

1. You need to make sure you install Windows 7 to the correct partition, so we need to be able to tell SCCM exactly where to install to.
2. You can’t PXE boot a Mac, so we need to come up with another way of booting our iMacs

So here’s how I done it, firstly you’ll need to get your first Mac up and running, with all the Out of Box Experience questions answered. Once you have done that, run the Bootcamp Utility and partition your Hard Drive up ready for you to install Windows 7. Secondly you’ll need to be sitting in front of the SCCM console as one of the first change you may need to make, is to turn on debug mode for you boot image, which secretly gives you access to a command prompt by pressing F8

To do this in the SCCM console, expand Site Database > Computer Management > Operating System Deployment > Boot Images, the right click the Boot image and choose “Properties”

NOTE: I am choosing the x64 bit Boot Image as my Task Sequence will be using this boot image to deploy a x64 bit version of Windows 7, if you intend to deploy x86 Windows 7 then I would select the x86 boot image, as that would be the boot image selected in the task sequence.

In the Properties windows go to the Windows PE tab, and check the “Enable command support (testing only)” this will enable you to bring up a command prompt when you boot this media by pressing F8, which we’re going to need to get our Disk formatting done.

Now the next thing we are going to need to do is import the drivers from Bootcamp into SCCM,  by inserting the OSX Snow Leopard DVD into a Windows PC you can copy the Windows drivers directly off the disk, to a network share and import them into SCCM.

I would recommend adding the to a Category called “Apple” (done by clicking on the Categories button) so at least you can find all of the afterwards.

Now with all the drivers imported into SCCM we need to import the correct network drivers into the Boot Image so that our iMac can see our SCCM server and download the Operating System.

Now I’m going to cheat by telling you that the previous and current generation of 21.5” iMacs use a called b57nd60a.inf (for x64) or b57nd60x.inf (for x86), this driver is used for a number of different network cards, and in SCCM it calls the driver after the first Hardware Name which is a “3Com Dual Port 1000-SX PCI-X Server NIC”

If your wondering how I found this out, I already had an SCCM CD and booted from that, I plugged in the USB key with all the drivers on that Boot Camp Assistant had created for me, and used the Debug Command Prompt (F8) and ran the drvload command to load the drivers one-by-one, after each driver I loaded I ran ipconfig to see if it managed to initialize the NIC, more information can be found here:

http://www.rm.com/Support/TechnicalArticle.asp?cref=TEC1287003&nav=0&referrer=rss

Now we need to inject these drivers into our boot image by right clicking on it in the SCCM console and again on the Windows PE tab, now click the sun icon to add a new driver.

Now the Select a driver window is not exactly the best interface for selecting you drivers, but it lists all the drivers chronologically so the most recently added drivers are at the bottom. Now as I mentioned earlier I am using the b57nd60a.inf 64-bit driver as I am using the x64 boot image, if you are using the x86 boot image, you will need to select the b57nd60x.inf 32-bit driver.

The next part in the “sequence” – pun intended – is to create and advertise a task sequence to our iMacs.

You probably already know how to add devices to a collection in SCCM and if you don’t you should probably go and find out how before you got to this point as it’s fundamental in how SCCM works.

So from the SCCM console go to Site Database > Computer Management > Operating System Deployment > Task Sequence, and create a new custom task sequence, as you can see I already have 2 for our iMacs.

Now fill in the Task Sequence steps in the usual way, Apply Operating System, Apply Windows Settings, Apply Network Settings, Apply Device Drivers etc.

Then we need to add the custom iMac settings as follows:

1.  We need to remove the “Restart in Windows PE” section from the top of the Task Sequence, as this causes the iMac to try and stage the Windows PE environment on the un-formatted hard disk, usually the Task Sequence will fail with the error 0×80070490 as it can not stage Windows PE on a FAT32 HDD

2.  Add Connect to Network Folder – insert this as the 2^nd item under Restart in Windows PE, what we need to do is map a drive to a network location so we can place some scripts to format our HDD into NTFS from the FAT32 OSX gives us.

3.  Inside this network path we need to create a DISKPART script, which is a standard txt file created in notepad, that formats the correct partition into NTFS, save it as diskpartmac.txt here’s an example:

SELECT DISK 0
SELECT PARTITION 3
FORMAT FS=NTFS LABEL=”BOOTCAMP” QUICK OVERRIDE
ACTIVE
EXIT

NOTE: This is where if you are running OSX Lion you would change PARTITION 3 to PARTITION 4

4.  Add a Run Command Line step in after the connect to Network Folder step, the command line you need to enter is: Diskpart /s “Z:\diskpartmac.txt”

5.  Add another Run Command Line section and this time add the command bootsect /nt60 C: this should add the correct boot sector values to our newly formatted hard disk, so that it appears as a bootable device in the EFI Startup Disk selector.

6.  Under the Apply Operating System step change the “Select the location where you want to apply this operating system” settings to the following, Destination = Specific disk and partition, Disk = 0, Partition = 3

NOTE: This is where if you are running OSX Lion you would change PARTITION 3 to PARTITION 4

7.  Now save the task sequence by clicking OK, and then advertise it to your collection of iMacs, by right clicking the Task Sequence and clicking Advertise, and then select the collection. Make sure that you choose the “Make avaliable to PXE clients” option so that you iMacs will be able to see it when the boot from the Task Sequence Media…

8.  Lastley (well almost) we need to create a CD to boot the iMacs from since Apple hardware does not have the ability to PXE boot (as they are designed to use NetBoot, the Apple version of PXE which let you image Apple devices with OSX from OSX Server), to do this right click on the Task Sequence again, but this time choose “Create Task Sequence Media”

1.  From the Wizard choose to create “Bootable Media

2.  Then select CD/DVD set, and choose a place to save the ISO file

3.  Choose next, and then enter a password to
secure the Boot Media, meaning that it will ask you for the password before it displays Avaliable Task Sequences to the client.

4.  Then lastly select the Boot Image and Distribution Point, I chose the x64 boot image because I am deploying Windows 7 x64, and for the Distribution Point I chose one local to the subnet that the iMacs will be residing.

8.  Now head over to your iMac and insert the CD you just created, and power it on, when you do hold down the Option Key (Alt for you Windows folk) and it should show a list of bootable devices, one being the CD, boot from that and you should get the SCCM OSD screen, from there you can choose your advertisment, and install Windows 7 on your Mac from your SCCM Server, happy face

NOTE: I have had some issues with the Boot CD wanting to “Copy Windows Preinstallation Image” to the hard disk, also known as staging the Windows PE on the local hard disk, this seems to be caused by differences between the version on the CD and the version stored on the SCCM server, as soon as the SCCM updates the boot image by Injecting drivers etc. the CD will try to copy the latest version and stage it on the PC.

Once this is done you can then proceed with selecting the task sequence, and it should go through fine and finish installing.

J&G offer the full ReadyNAS range, from 4 disk NAS devices to 12 disk 10GBe capable SANs, to see some examples of what we have done with ReadyNAS products, take a look at our Case Studies section under the About Us link at the top of this page.

There is a solution – you can increase capacity and lower running costs by virtualising your servers.

click here…

The new Apple iPad (image from Gizmodo.com)

Is this the year of the “slate” PC, has tablet technology finally matured beyond the medical IT sector?

Well it definitely seems that way, what with Apple’s rumoured “iSlate” iPad , HP’s Slate PC, Nvidia’s Tegra Table prototype.

With all this new technology becoming available this year how is this going to affect the way we do business?

With a device like this every user will be able to have the internet, full internet, flash/java/html5 internet in their pocket, as well as all kinds of media, photos, movies, music, audiobooks, ebooks. A device like this could replace every thing in a students school bag, or everything in a briefcase or kit bag.

Dont take this article as me trying to sell you the idea of tablet PCs, as I’m sure you’ll be asked to deploy them sooner or later, I just want to point out some of the issues that you might face when deploying such a device, as the say; forewarned is forarmed.

Connectivity

Well the first thing to tackle will be WiFi, as these devices will primarily only use WiFi to connect to your LAN and the web, which means the need for a site wide wireless network is a must (whats the point of having a connected device you can use anywhere and not be able to use it anywhere?)

As such managed WiFi is the only way to go as setting up 45 single Access Points is no-one’s idea of fun. There are really only 2 camps to side with, either the older, more traditional cell based systems, or the newer blanket based systems. In my opinion, as well as that of many other people, is that blanket based systems are the way forward, as they offer 2 distinct advantages over cell based systems:

1. The are no more channel collision issues, as the “Points” are actually radio antennas for the management switch that sits in your data rack. As such you can cover a greater area with less points, and achieve the same throughput.
2. Because there is no channellisation in a blanket system, there is no point or channel hopping, this allows devices to remain connected to the same “access point”, which opens us up to things like wireless VoIP handsets (without dropped calls)

*Disclosure: J&G Systems are a reseller of Extricom Wireless Equipment*

For more information about blanket wireless systems visit our partner http://www.extricom.com/

I’m not going to fight the corner for the cell based systems, as they have been around for many years and nearly everyone knows their advantages and dis-advangtes, but no matter which WiFi platform you go for, everybody needs to think about;

Security

With all these devices now roaming your network, how are you going to tell what is good and what is bad, what is allow and what is rogue?

Lets start with the basics first, wireless security, wireless has had its share of security problems recently, what with every Tom, Dick and Harry being able to break WEP keys in a matter of minutes, and WPA keys in a few hours (or 20 mins if you have access to an array of CRAY super computers) but it is still a way of keeping rogue devices off your network, especially those belonging to your average user.

HP's Slate PC

The next simplest level up would be to VLAN off an open wireless network to, shock horror, allow public devices access to the internet. Form our research in a number of sites, this would stop those slightly more determined to get on the net from attacking your WiFi just to stream video from BBC iPlayer. I think your better off accommodating free public WiFi as this is what most people are trying to get when they attack wireless networks, trust me I spent 3 weeks in New Zealand hunting for free WiFi.

Now we have calmed our attackers by giving them what they want (free internet) we can look at securing our private network more securely by using certificate based authentication, or RADIUS, we can also start looking at using Network Access Control (NAC) to check the status of known devices before letting them attach to the private network, but that is a discussion for another day.

Recovery

Now this is a bit of a grey area, since these devices have the ability to store masses of media and files, as well as run things like Office 2007/2010 this means that at some point someone is going to be carrying a very important spreadsheet containing very important data, however unlike smart phones, that have the ability for things like Remote Wipe, Lock with Pin, send alert messages even when on silent etc. etc. these devices are still PCs at their heart, as such there is no simple built in method for example, to wipe the device if it gets lost.

Encryption I hear you cry, TrueCrypt, BitLocker, but my response is that with a CULV CPU and limited battery, are you really going to encrypt everything and run your CPU at a steady 70% when all you want to do is turn it on and get to work, likely answer is no. As far as full disk encryption goes, everything is fine unless you don’t have a TPM module installed, which a lot of £700+ laptops still don’t, so it’s unlikely your going to find one in a £400+ tablet where space is a premium. Now until this has been addressed these devices can only be recommended as tools for the classroom, or very cool gadgets for the executive, not a replacement for a laptop.

To round everything off nicely, I hope this has been enlightening for you, and your eyes have been opened to the possibility of tablets, but also to the risks of tablets and similar devices. A lot of these concepts are the same when talking about laptops, however laptop is a little more conspicuous than a 6-8 inch device, with 6 hours battery, that can be running whilst sitting in a bag. As ever feel free to ReTweet this and reference it, but don’t straight up copy it as say its your own work. Also don’t forget to comment on this post, leave your feedback and thoughts etc.

via Gizmodo.com

1. Boot from the Server 2008(R2) DVD
2. Choose your language options, and in the bottom corner on the “Install Now” click “Repair Your Computer”
3. Launch command prompt
4. Go to c:\windows\system32
5. Rename Utilman.exe to Utilman.exe.bak
6. Copy cmd.exe to Utilman.exe
7. Reboot back into Windows
8. Press Windows + U at the logon screen, which at any other time would open the Accessibility Manager, but for us will open a Command Prompt
9. Now you can use the following command “net user administrator Pa55word” to reset the Administrator Password
10. Proceed to logon with the Domain Admin account and this new password
11. You can change the password to something rememberable it if need to
12. Reboot your server, and boot from them DVD again to restore the original Utilman.exe

Now you can log back into your once locked server, now although this has helped us out of a tight spot, remember that if your not the only person who has access to your server room anyone could do this, so as ever use this information wisely and use it to review your security plans, for example: use those locks on your server racks, lock doors behind you, use BIOS passwords.