Questions[server-settings](server)

I have an azure vm running windows server 2016. I applied to it a policy that checks vm configuration through a guest configuration extension. For example for the policy Windows machines should meet requirements for 'Administrative Templates - Network' the definition says:

Windows machines should have the specified Group Policy settings in the category 'Administrative Templates - Network' for guest logons, simultaneous connections, network bridge, ICS, and multicast name resolution. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol.

Unfortunately I have a problem with settings that have to be applied to satisfy this policy.

The question is: what should be set up on the vm according to this policy and is there some source of information about required settings for other policies.

Like in the title, I want to get folder on my samba server, which allow anyone (guest, user nevermind) to upload files. Than files should be invisible for any other than host. The best would be option with prohibiting users and guests from editing, viewing or deleting files, but it isn't necessarily. I tried some ways. First of them, like someone wrote somewhere I used to do like this, using masks and files permissions, it doesn't work, anybody can do anything with files on the server. Of course, we are interested in "Wgrane" folder :P .

[global]
netbios name = serwer
server string = Samba file and print server
workgroup = Workgroup
security = user
hosts allow = 127. 192.168.0.
interfaces = 127.0.0.1/8 192.168.0.0/24
bind interfaces only = yes
remote announce = 192.168.0.255
remote browse sync = 192.168.0.255
printcap name = cups
load printers = yes
cups options = raw
printing = cups
guest account = smbguest
map to guest = Bad Password
obey pam restrictions = yes
log file = /var/log/samba/samba.log
max log size = 1000
null passwords = yes
username level = 0
password level = 0
encrypt passwords = yes
unix password sync = yes
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
local master = no
domain master = no
preferred master = no
domain logons = no
os level = 33
logon drive = m:
logon home = \\%L\homes\%u
logon path = \\%L\profiles\%u
logon script = %G.bat
time server = no
name resolve order = wins lmhosts bcast
wins support = no
wins proxy = no
dns proxy = no
preserve case = no
client use spnego = no
client signing = no
client schannel = no
server signing = no
server schannel = no
nt pipe support = yes
nt status support = yes
allow trusted domains = no
obey pam restrictions = yes
enable spoolss = yes
client plaintext auth = no
disable netbios = no
follow symlinks = no
update encrypted = yes
pam password change = no
passwd chat timeout = 120
hostname lookups = no
username map = /etc/samba/smbusers
passdb backend = tdbsam
passwd program = /usr/bin/passwd '%u'
passwd chat = *New*password* %n\n *ReType*new*password* %n\n *passwd*changed*\n
add user script = /usr/sbin/useradd -d /dev/null -c 'Samba User Account' -s /dev/null '%u'
add user to group script = /usr/sbin/useradd -d /dev/null -c 'Samba User Account' -s /dev/null -g '%g' '%u'
add group script = /usr/sbin/groupadd '%g'
delete user script = /usr/sbin/userdel '%u'
delete user from group script = /usr/sbin/userdel '%u' '%g'
delete group script = /usr/sbin/groupdel '%g'
add machine script = /usr/sbin/useradd -d /dev/null -g sambamachines -c 'Samba Machine Account' -s /dev/null -M '%u'
machine password timeout = 120
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
template shell = /dev/null
winbind use default domain = yes
winbind separator = @
winbind cache time = 360
winbind trusted domains only = yes
winbind nested groups = no
winbind nss info = no
winbind refresh tickets = no
winbind offline logon = no
host msdfss = no
usershare allow guests = yes

[krzysztofonly]
path = /home/krzysztof/Publiczny/Serwer
comment = Serwer tylko dla usera krzysztof.
valid users = krzysztof
write list = krzysztof
read only = no
available = yes
browseable = yes
writable = yes
guest ok = no
public = yes
printable = no
locking = no
strict locking = no

[Do pobrania]
path = /home/krzysztof/Publiczny/Do pobrania
comment = Lokalizacja tylko do pobierania plików z serwera. 
read only = yes
available = yes
browseable = yes
writable = no
guest ok = yes
public = yes
printable = no
locking = yes
strict locking = yes

[Wgrane]
path = /home/krzysztof/Publiczny/Wgrane
comment = Lokalizacja do wgrywania plików na serwer. Nie mogą one być później edytowane.
force directory mode = 2770
create mask = 660
read only = no
available = yes
browsable = yes
guest ok = yes
public = yes
valid users = @U smbguest
force user = krzysztof

Second way I used to try was something like this.

[Wgrane]
path = /home/krzysztof/Publiczny/Wgrane
comment = Lokalizacja do wgrywania plików na serwer. Nie mogą one być później edytowane.
read only = no
available = yes
browsable = yes
guest ok = yes
public = yes
veto files = /*/
delete veto files = no

Just veto which should hide all files and everything should be fine. Or maybe I have bad understanding of this attribution? Right - files are hidden, but there is no way to upload files. There is an error: http://i.imgur.com/vWKlloO.png

Can somebody tip me how to fix error in second way or tell me why the first isn't working?

@edit I learn more and now I understand how veto files works. I need to make something like veto, but with upload allowed. Is it even possible?

I have 2 large commercial programs that work together come with fairly involved .cshrc scripts. But whether I am in a bash/tsch/csh shell at start up, my initial path on startup is in bash format. When I run the .cshrc scripts that set the paths (and variables) for the programs support files, the system ignores the paths set via the cshrc script.

Example from the echo $PATH command Note, I get same results if I start up in a bash or csh shell.

initial path /usr:/usr/bin

after cshrc /usr:/usr/bin /home/program1 /home/program2

since I can't alter their scripts, what can I do to change the path to 1 format? Either: /usr:/usr/bin:/home/program1:/home/program2 or /usr usr/bin /home/program1 /home/program2

Thanks,

When I open the DNS console in Administrative tools, I keep finding a couple of problems which keep on reappearing by themselves, and I want to stop them from happening.

One of the DNS servers has two network interfaces, and it should only be listening for requests on of them, and I get errors in the Event Log otherwise. But when right clicking one DNS server and selecting Properties, I can see on the Interfaces tab that 'All IP addresses' is selected. If I Change it to 'Only the following IP addresses:' and deleselect the WAN addess, I will find it reslected when I next check it after a couple of days.

In the other DNS server's Properties, on the Forwarders tab, there should only be two forwarder addresses. However, the address for the router keeps in appearing. This router has the DNS server as its forwarder. There shouldn't be anything using the router's DNS forwarders for DNS other than the router itself, but this surely is causing a loop.

How do I get these properties on both DNS servers to stick?

I would like to restrict external SSH logins to specific users and allow intranet logins (192.168.0.0/24) to all users. I would appreciate a complete example file for this scenario.