Prerequisite updates for Internet Explorer 11

Prerequisite updates for Internet Explorer 11

Refresh Hosts file without rebooting

Tried this with Windows 8.1 and it is easier than you would think as it a command you should be very familiar with.

IPCONFIG /FLUSHDNS

Ensuring that group policy is applied before logon

By default group policies are applied asynchronously - Fast Logon Optimization . The upshot is that if you update a policy users may logon before the latest policy is applied and it may take a couple of logons before current settings are applied.

I am messing about with GPOs in a test environment so I don’t want to have to constantly rebooting PC or perform multiple logons attempts.

Disable Fast Logon Optimization by using the following

Create or update and existing group policy attached to the OU housing the computers and edit the following.

Computer Configuration
  Policies
    Administrative Templates
      System
        Logon

Enable: Always wait for the network at computer startup and logon

User Template increase attributes copied

When you create a user template and copy it to create a new user only a limited number of attributes are copied

Example: Copy Office From the General tab

Suppose you have a user template and want the Office value from the general tab to remain when you create a new user by copying the template.

You can use ADSI Edit to make the attribute copy.

• Open ADSI Edit
• In the left pane right click ADSI Edit and Connect To the Schema Naming Context

• Locate the attribute name in this case Office is:
  Physical-Delivery-Office-Name
• Right Click and open Properties

• Attribute Editor Tab … locate searchFlags
• Edit and add 16 to the value
• To prevent it from copying remove 16 from the value.

I have tested with Windows 2008 R2 as shown but certain it should work with previous version as I learned from a Windows 2000 KB Article.

Where do you get the attribute names … I found some here.

http://www.jigsolving.com/ad/user-account-attributes-part-3

http://www.kouti.com/tables/userattributes.htm

Ultrasound - File Replication Service

Ultrasound - Monitoring and Troubleshooting Tool for File Replication Service (FRS)

Ultrasound is a monitoring and troubleshooting tool for the File Replication Service (FRS). FRS is a legacy technology that replicates files and folders that are stored in Distributed File System (DFS) folders or in the System Volume (SYSVOL) folder on domain controllers.

Microsoft: download

Active Directory Shadow Groups

Simply: You have an OU in active directory … add any user accounts in the OU to a group … in addition you want to maintain the membership when accounts are added or removed from the OU.

The following link includes examples using the ds* commands and PowerShell to populate and maintain Shadow Groups.

Shadow Groups in Active Directory

It should be possible to expand these examples to include the user accounts from other OUs or to use Identity Attributes rather than OU.

PowerShell determine what version is installed

What version of PowerShell is installed on a machine

Open PowerShell and type Get-Host

Windows 7 – version 2.0

Windows 8 – version 3.0

http://technet.microsoft.com/en-us/library/bb978526.aspx

Update GPO templates to manage Windows 8

You’ve added some Window 8 PCs and possibly Windows Server 2012 to your existing Windows Server 2008 R2 enterprise … okay so how do you access the additional features with Group Policy?

Looking at a Group Policy setting in Windows 8 Windows 8 GPO Blocking Connection Accounts … I got to thinking … I’m doing this from Windows Server 2012 … more realistically I will be adding Windows 8 machines to a Windows Server 2008 environment.

How do I update the group policy template files?

My only caveat … I have still to do the testing … will the new templates work with the old admin tools.

Windows 7, Windows Server 2008 R2 Group Policy Central Store

Administrative Template files for Windows 8 & Windows Server 2012

Upgrading the ADMX Central Store files from Windows 7/2008R2 to Windows 8/2012

Certificate Services Installing CA

The preferred method

Microsoft best practice is to install a standalone root CA with an enterprise subordinate CA. The Standalone can then be isolated offline for enhanced security while the subordinate takes over issuing certificates.

The following videos gives a short demo of installing two CAs using server 2003 … it is a good starting point for his 2008 videos.

Microsoft CA 1 of 2 - Setup Standalone Root

Microsoft CA 2 of 2 - Enterprise Subordinate

The following video gives a short demo of CA autoenrollment using server 2003.

Microsoft CA - Autoenrollment Step-by-Step

In reality a single tier

While it is best practice to have two CAs … see above … in many instances you may only have one server at your disposal.

Single Tier PKI one CA that does all the issuing of certificates aimed at small business of up to 300.

Certificate Services 2008 R2 - Installing a Single Tier PKI

SSL in depth

Certificate Services 2008 1 of 4 - Installing a Microsoft CA

Certificate Services 2008 2 of 4 - Implementing a SSL Certificate

Certificate Services 2008 3 of 4 - Binding the SSL Certificate

Certificate Services 2008 4 of 4 - SSL Under the hood

 

Certificate Services 2008 1 of 2 - Autoenrollment (concept)

Certificate Services 2008 2 of 2 - Autoenrollment  Step By Step

Using Certificates for IPsec Authentication

In a previous post IPsec Overview there is an example of securing Telnet with IPsec. This link to a TechNet Video takes the Telnet example further by using Certificates for IPsec Authentication.

TechNet Video: Using Certificates for IPsec Authentication

TechNet: Test Lab Guides

Test Lab Guides (TLGs) allow you to get valuable hands-on experience with new products and technologies using a pre-defined and tested methodology that results in a working configuration. When you use a TLG to create a test lab, instructions define what servers to create, how to configure the operating systems and system services, and how to install and configure any additional products or technologies.

A challenge in creating useful TLGs is to enable their reusability and extensibility. Because creating a test lab can represent a significant investment of time and resources, your ability to reuse and extend the work required to create test labs is important.

TechNet: Test Lab Guides

Check firewall not blocking shared printing

Couple of quick ways to check if the firewall is blocking a shared printer.

From a remote machine open an command prompt and use

Net View \\print-server-name

This should return a list that includes the name of the shared printer generally you can now eliminate the network or firewall as an issue.

or download PortQry from Microsoft and check the required ports are open on the computer sharing the printer.

Use PortQry or PortQueryUI to check TCP ports 445 & 139

If computers are not on the same LAN segment don’t just check the print server firewall ensure their is not another firewall between the computers.

Print spooler must be running on server and client

Read something like this … “In order to print to a server based printer the print spooler must also be running on the client” … time to experiment … It is the same with a Remote Desktop session and a locally attached printer?

Did an experiment, I used Remote Desktop from a Window 7 machine to a Windows 7 VM. Remote Desktop is setup allow the remote session to use the local printer.

Succeeded in printing from notepad on the remote machine to the redirected LaserJet on my local machine.

Shut down the spooler on the remote session with

net stop spooler

and tried to print from notepad got this error and

everything disappeared the from Select Printer except Add Printer

restarted using net start spooler

all the printer came back.

Remote/Shared printing … the spooler must be running on both machines not just the box the printer is plugged into.

Search Active Directory from the Desktop

To quickly get the AD search box up on a domain joined PC create a shortcut on the desktop with item location set to.

%SystemRoot%\SYSTEM32\rundll32.exe dsquery,OpenQueryWindow

Domain joined PC only, try to do it from a workgroup you will get:

Hyper-V 2008 Core Memory Requirements

Windows 2008 core apparently needs only 3GB of disk space and less than 256MB of RAM. Add Hyper-V and my task manager says 727MB.

Rearm Windows 2011 SBS Evaluation

Something always comes up when you are trying to evaluate a product and X weeks/months later you fire up the virtual machine and the Grace Period has expired.

slmgr.vbs –dli          will tell you how long the grace period is.

slmgr.vbs –rearm     will reset it.

I have tried this on a couple of product the latest being an evaluation version of Small Business Server 2011 and the grace period was reset to 30 days.

If memory serves me then it should work for Windows 2008 evaluations.

Don’t know if it works with products like Windows 8 or Server 2012.

Performance Tuning for Windows Server 2008

Came across this guide while looking for something else may be of use if I ever get time to read it.

This guide describes important tuning parameters and settings that can result in improved performance for the Windows Server 2008 operating system. Each setting and its potential effect are described to help you make an informed judgment about its relevance to your system, workload, and performance goals.

Performance Tuning Guidelines for Windows Server 2008

Windows Firewall Learning Roadmap

If you are new to Windows Firewall with Advanced Security, this topic can help you identify what you need to learn to fully understand and use all of the features available in Windows Firewall with Advanced Security.

It includes prerequisite topics that cover a variety of networking fundamentals.

TechNet: Windows Firewall with Advanced Security Learning Roadmap

Windows 7 Firewall Documentation

Windows 7 Firewall Documentation

Here are some useful TechNet links covering the subject:

TechNet: Windows Firewall with Advanced Security and IPsec

TechNet: Networking and Access Technologies - Windows Firewall

Windows Firewall with Advanced Security Getting Started Guide

Netsh Commands for Windows Firewall with Advanced Security

From TechNet Networking Blog

Deployment: Windows Firewall and Group Policy

Network Access Protection (NAP)

Network Access Protection

Network Access Protection (NAP) is a feature in Windows Server 2008 that controls access to network resources based on a client computer’s identity and compliance with corporate governance policy. NAP allows network administrators to define granular levels of network access based on who a client is, the groups to which the client belongs, and the degree to which that client is compliant with corporate governance policy. If a client is not compliant, NAP provides a mechanism to automatically bring the client back into compliance and then dynamically increase its level of network access.

In short is your OS AV up to date if not I am going to use WSUS and and the AV server to patch your system before I allow you to access the network.

TechNet Network Access Protection