HopelessN00b's questions

I have an application server, running Windows 2012 R2, which generates a high volume of log files, to the point that it runs the application volume out of free space on a semi-regular basis. Due to restrictions from the application itself, I can't move or rename the log files or enable NTFS data-deduplication, and due to it not being ten years ago anymore, I don't want to use a batch or vbscript to do this for me.

The log files are all in various subfolders of the application install directory, with different extensions (one component adds the date as the log file extension), and the application install directory has a space in it, because the application developers are malevolent. The subfolders where the logs are written are exclusively used for the purpose of writing logs, at least. This is also a heavily CPU-bound application, so I don't want to compress the log folders themselves and incur the CPU penalty associated with writing compressed files for the logs.

How can I use PowerShell to enable NTFS compression, in-place, on log files older than x days?

I'm trying to deploy some Windows 10 machines at work, and need to remove or disable the pre-installed apps.

For some reason, management feels that the Xbox app and Candy Crush Soda Saga (etc.) shouldn't be installed on a corporate workstation.

We've tried uninstalling them after the fact, but they show up again for any new users logging in, which isn't acceptable. How do we really get rid of these apps from our corporate Windows 10 image?

My new employer has folder redirection setup for its hundreds of users, and the person who set it up didn't really know what he was doing. As a result, the best practices for permissions on redirected folders/home directories was not followed.

The solution to let people access their redirected folder locations was to instead apply Full Control permissions (NTFS permissions, not "share" permissions, of course) to Everyone at the root directory ("Home") and propagate that down to all subfolders and files below the root.

What could possibly go wrong, right? It's not like the CEO has confidential information in his My Documents folder, or anyone's going to get infected with CryptoWall and encrypt everyone else's files. Right?

So, anyway, now that the CryptoWall infection has been removed and backups have been restored, a number of people would like us to replace the current permissions with something less horrible, and I would like to not have to click around the permissions dialogues in several hundred folders.

How can PowerShell solve this problem for me, and make life worth living again?

My basic question is, as the title asks: are there any notable advantages (or disadvantages) to using EFI firmware and GPT boot disks in an ESXi environment? By "notable," I mean anything other than the well-known 2 TB limit for MBR disks, and the restriction that BIOS boot firmware must use MBR disks to boot from.

The specific VM option is in the screenshot below.

In case it makes a difference, some background and specifics on my particular environment are below, though I'm interested in the general case as well as anything that would relate specifically or only to a Windows environment.

As a result of some recent projects, where I have succeeded in dragging my corporate overlords at $[day_job] into the current decade, I'll be replacing a lot of our home office systems. These systems, as well as what they're to be replaced by, are primarily Windows Server OSes virtualized on ESX 5.5 (update 1 now, soon to be update 2, and VMFS5, so large volume support). The VMs, as well as all the storage they access, are on a SAN (EMC VNX 5400), which is presented to the ESXi hosts over NFS shares. Everything is thin-provisioned.

For the most part, I'll simply be upgrading a bunch of large, complicated, PITA systems to newer platforms - for example, our multi-TB file servers that currently run on Server 2003 R2 and do not use DFS will be upgraded to Server 2012 R2, be put into DFS namespaces, make use of DFS replication, and start using Server 2012 Data Deduplication. Our SharePoint system, which currently runs on Server 2003 R2 and SQL Server 2005 will be upgraded to SharePoint 2013, running Server 2012 R2, and put on a SQL Server engine of 2008 R2 or above. And so on.

In looking into the file servers, and how to deal with the amount of data on them (each one of our home office file servers has data in excess of 2 TB), I looked into, and settled on, the Data Deduplication feature in Server 2012. Since that works on a per-volume basis, it works best if all the data is one volume, instead of split across multiple volumes, like our current mess. This brought up the issue of GPT disks being best for our data volumes, and brought me to the question of EFI vs BIOS firmware. Our servers all have OS [virtual] disks of 50 GB that are separate from any data volumes, and at least at present, I'm planning on keeping it that way - being able to attach a data volume to a new VM is pretty useful.

So, with that in mind, I can't envision a scenario where we'd ever need or want a VM to boot from a volume that needs to be GPT for being over the 2 TB MBR disk limit. The fact that the environment is purely virtual does seem to negate the recoverability advantages of GPT disks, so I can't come up with any compelling reason start building our new VMs with EFI boot firmware and/or GPT boot volumes. Of course, I also can't come up with any compelling reasons to stick with BIOS boot firmware and MBR disks, and hence, my question:

Are there any notable advantages (or disadvantages) to using EFI firmware and GPT boot disks in an ESXi environment? (By "notable," I mean anything other than the well-known 2 TB limit for MBR disks, and the restriction that BIOS boot firmware must use MBR disks to boot from.)

As the result of a recent penetration test, in which we did not fare well, it has been brought to my attention that our internet facing, all-roles-in-one, Exchange 2010 SP3 server has no firewall in place, and is therefore completely exposed to the internet. I verified the results myself, and it is indeed pretty bad. SMB, LDAP, remote registry, RDP, and every other default service you'd find in a Windows Active Directory environment are exposed to the internet through our Exchange server.

Naturally, I'd like to fix this, and plan to do so with Windows Firewall, but in Googling about, all I've been able to find on point from official sources are port references which seem to apply to internal Exchange traffic, and a Technet blog posting saying not to use those references to configure your firewalls, because the only supported configuration between Exchange servers is the equivalent of an ANY:ANY allow rule. :/

Given that we use Active Sync, OWA, IMAP, calendar/address book sharing, autodiscover and Outlook client access, does anyone know what firewall rules are required for an all-roles-in-one Exchange server that's internet facing? (Bonus points in the form of a small bounty to anyone who has an official MS source, too.)

Off the top of my head, with a bunch of experience as an accidental Exchange admin and accidental IT security guy, I've come up with the list below (which seems both too long and too short to me), but before I go and potentially break email for a thousand whiny users, I'd really like some verification of what I'm planning to do.

TCP:25 for SMTP
TCP:465 for SMTPS
TCP:587 for SMTP
TCP:80 for OWA http to https redirect
TCP:443 for https/OWA/Active Sync/EWS/Autodiscover
TCP:143 for Endpoint Mapper/IMAP4 Client Access
TCP:993 for IMAP4 Client Access (also)
TCP:110 for POP3 (because some technological dinosaur of a VIP probably uses POP3 at his beach house/ski cabin/where ever)
TCP:995 for POP3 (because some technological dinosaur of a VIP probably uses POP3 at his beach house/ski cabin/where ever)

Related to this previous question of mine about why it's a bad idea to use the root domain name as your Active Directory forest's name...

I have an employer, whom I will refer to as ITcluelessinc, for the purposes of simplicity (and honesty). This employer has an externally hosted website, www.ITcluelessinc.com, and a few Active Directory domains. Being clueless about IT, many years ago, they set themselves up on an Active Directory forest named ITcluelessinc.prv, and performed unspeakable atrocities against it. These unspeakable atrocities eventually caught up with them, and with everything collapsing around them, they decided to pay someone a huge chunk of money to "fix it ," which included migrating off the horribly broken ITcluelessinc.prv forest.

And of course, being clueless about IT, they didn't know good advice when they heard it, accepted the recommendation to name their new AD forest ITcluelessinc.com, instead of the sane advice they also got, and started putting stuff on it. Fast forward to a few hours ago, and we have a company with most of its stuff joined to and using the old ITcluelessinc.prv Active Directory forest, with a fair amount of newer stuff joined to and/or using the ITcluelessinc.com forest. To make this work together relatively seamlessly, I've used conditional forwarders in DNS to send the ITcluelessinc.com traffic over to ITcluelessinc.prv, and vice-versa.

(The corp.ITcluelessinc.com and eval.ITcluelessinc.com domains are properly named domains I came in and set up later, and are not relevant just yet.)

Back to a few hours ago, and a non-technical employee of ITcluelessinc has noticed that she can't browse to www.ITcluelessinc.com from her workstation (inside the ITcluelessinc corporate network) and decided that this is a problem, so she contacts VIP employee of ITcluelessinc, who decides this must be resolved most Ricky-tick. Typically, not a huge deal, add an A record for www under the DNS zone for ITcluelessinc.com, and you can browse the site, so long as you don't try the naked link.

So, it seems like it's all setup properly. Forwarders, www host entry in DNS, and yet, clients using the ITcluelessinc.prv domain controller as DNS servers get a connection timeout when trying to browse to www.ITcluelessinc.com, instead of the webpage that I get from my home network.

Does anyone have any thoughts as to how I can allow internal clients of the ITcluelessinc.prv domain to browse www.ITcluelessinc.com, given the presence of the ITcluelessinc.com Active Directory forest and the conditional forwarders it needs? Or, alternately, is anyone [else] convinced that the only way to make it work is to get rid of the ITcluelessinc.com Active Directory forest?

It does seem like the setup I have now should work, but it's clearly not, and I have no idea where I'd procure a testing environment this messed up to experiment with. And for what it's worth, I've somewhat politely suggested that the only way to fix this is migrate to the properly-named forests I set up, and when that's not a good enough answer, plan to host a mirror of the website on all our ITcluelessinc.com domain controllers until that breaks everything.

Due to the workload generated by recent ransomware outbreaks (Cryptolocker/Cryptowall/etc.), I was recently tasked with implementing Software Restriction policies to block program execution from temporary directories. This is generally working well enough, but we have a problem when we need to install software, in that these Software Restriction policies prevent installers from accessing the machine temporary directories.

Our Active Directory hierarchy is basically organized along the lines of our physical sites, and our AD objects inherit about a couple dozen GPOs each from the domain root and their specific site OUs. As such, I don't have the option of either creating a blocked policy OU off the domain root (as not inheriting the site-specific Group Policy settings causes big problems with the machines, and the remote users are not skilled enough to resolve them), or relinking Group Policy Objects closer to the child OUs (as that would involve several hundred delinking and relinking operations, which I'm not willing to do), or creating a child OU at each with inheritance blocked (because I'd have several hundred linking operations to do in that case).

That said, I do need a way to temporarily stop the Software Restriction policy GPO from applying, so that we can install software from time to time. I tried to solve this initially by creating a child OU at each site, and linking an inverse Software Restriction policy, thinking that the higher precedence of the inverse policy would override the inherited one, but that didn't work at all - an RSOP showed that computers were getting complimentary disallow and unrestricted rules, and the disallow rules win in that scenario.

So, with all that in mind (can't relink all our GPOs, can't create a simple inheritance blocked OU, and a GPO with higher precedence doesn't seem to solve my problem), what can I do to [temporarily] block the application of inherited Software Restriction GPOs? Assume Windows 7 clients on a Server 2008 R2 FL domain/forest.

I need to issue a CLI command (cmd.exe or PowerShell) to all of the thousands of computers on my domain. For obvious reasons, this is not going to involve doing the task manually, or physically visiting each machine.

How should this be done?

Long story short(ish), we're on the tail-end of our XP to Windows 7 migration project, and finally got some VIP's machine in to be migrated. Since the machine is almost as old as the OS on it, this particular user was "blessed" with new hardware, in addition to a new OS.

Problem is that we had the intern do this particular migration, and he kind of messed it up. Seriously. In short, the general process for a user state migration is to create an association between the old and new computers in SCCM, run a capture task sequence on the old computer, and then do a restore sequence onto the new computer. In this case, the capture task sequence was run before the computers were associated, so SCCM is refusing to do the restore, and the old machine was reformatted... for some reason... before this was discovered.

Now, when we try to migrate the user's by "restoring" the USMT.mig that was captured and uploaded to the SCCM server, we get the error below, following the Request State Store action.

 Task Sequence: USMT - Restore State has failed with the error code  (0x00004005). 
 For more information, contact your system administrator or helpdesk operator.

The relevant log entries from the smsts[date-time].log seem to be:

<![LOG[Requesting SMP Root share config information from http://[Our SCCM server]:0]LOG]!><time="15:45:28.823+240" date="06-13-2014" component="OSDSMPClient" context="" type="1" thread="5136" file="smpclient.cpp:2348">
<![LOG[Received 4027 byte response.]LOG]!><time="15:45:28.892+240" date="06-13-2014" component="OSDSMPClient" context="" type="0" thread="5136" file="smpclient.cpp:2363">
<![LOG[Adding \\[Our SCCM server]\SMPSTORED_378B856C$ to list ]LOG]!><time="15:45:28.912+240" date="06-13-2014" component="OSDSMPClient" context="" type="1" thread="5136" file="smpclient.cpp:2403">
<![LOG[Successfully connected to "\\[Our SCCM server]\SMPSTORED_378B856C$"]LOG]!><time="15:45:28.919+240" date="06-13-2014" component="OSDSMPClient" context="" type="1" thread="5136" file="tsconnection.cpp:287">
<![LOG[Sending SMP request to http://[Our SCCM server]:0.]LOG]!><time="15:45:28.950+240" date="06-13-2014" component="OSDSMPClient" context="" type="1" thread="5136" file="smpclient.cpp:1854">
<![LOG[Received 4899 byte response.]LOG]!><time="15:45:29.045+240" date="06-13-2014" component="OSDSMPClient" context="" type="0" thread="5136" file="smpclient.cpp:1861">
<![LOG[SMP request to "http://[Our SCCM server]" failed with error: E_SMPERROR_MIGRATIONID_NOT_FOUND (204)]LOG]!><time="15:45:29.065+240" date="06-13-2014" component="OSDSMPClient" context="" type="2" thread="5136" file="smpclient.cpp:135">
<![LOG[Request to SMP 'http://[Our SCCM server]' failed with error (Code 0x80004005). Trying next SMP.]LOG]!><time="15:45:29.065+240" date="06-13-2014" component="OSDSMPClient" context="" type="2" thread="5136" file="smpclient.cpp:1601">
<![LOG[Failed to find an SMP that can serve request after trying 4 attempts.]LOG]!><time="15:45:29.065+240" date="06-13-2014" component="OSDSMPClient" context="" type="3" thread="5136" file="smpclient.cpp:1644">
<![LOG[ExecuteRestoreRequestToSMP failed (0x80004005).]LOG]!><time="15:45:29.065+240" date="06-13-2014" component="OSDSMPClient" context="" type="3" thread="5136" file="smpclient.cpp:2862">
<![LOG[ExecuteRestoreRequest failed (0x80004005).]LOG]!><time="15:45:29.065+240" date="06-13-2014" component="OSDSMPClient" context="" type="3" thread="5136" file="smpclient.cpp:2926">
<![LOG[OSDSMPClient finished: 0x00004005]LOG]!><time="15:45:29.065+240" date="06-13-2014" component="OSDSMPClient" context="" type="1" thread="5136" file="main.cpp:124">
<![LOG[Process completed with exit code 16389]LOG]!><time="15:45:29.077+240" date="06-13-2014" component="TSManager" context="" type="1" thread="5744" file="commandline.cpp:1123">
<![LOG[!--------------------------------------------------------------------------------------------!]LOG]!><time="15:45:29.078+240" date="06-13-2014" component="TSManager" context="" type="1" thread="5744" file="instruction.cxx:804">
<![LOG[Failed to run the action: Request State Store. 
Unknown error (Error: 00004005; Source: Unknown)]LOG]!><time="15:45:29.082+240" date="06-13-2014" component="TSManager" context="" type="3" thread="5744" file="instruction.cxx:895">
<![LOG[Set authenticator in transport]LOG]!><time="15:45:29.088+240" date="06-13-2014" component="TSManager" context="" type="0" thread="5744" file="libsmsmessaging.cpp:7734">
<![LOG[Set a global environment variable _SMSTSLastActionRetCode=16389]LOG]!><time="15:45:29.350+240" date="06-13-2014" component="TSManager" context="" type="0" thread="5744" file="executionenv.cxx:668">
<![LOG[Set a global environment variable _SMSTSLastActionSucceeded=false]LOG]!><time="15:45:29.352+240" date="06-13-2014" component="TSManager" context="" type="0" thread="5744" file="executionenv.cxx:668">
<![LOG[Clear local default environment]LOG]!><time="15:45:29.353+240" date="06-13-2014" component="TSManager" context="" type="0" thread="5744" file="executionenv.cxx:807">
<![LOG[Failed to run the action: Request State Store. Execution has been aborted]LOG]!><time="15:45:29.365+240" date="06-13-2014" component="TSManager" context="" type="3" thread="5744" file="instruction.cxx:983">
<![LOG[Set authenticator in transport]LOG]!><time="15:45:29.373+240" date="06-13-2014" component="TSManager" context="" type="0" thread="5744" file="libsmsmessaging.cpp:7734">
<![LOG[Failed to run the last action: Request State Store. Execution of task sequence failed.
Unknown error (Error: 00004005; Source: Unknown)]LOG]!><time="15:45:29.700+240" date="06-13-2014" component="TSManager" context="" type="3" thread="5744" file="engine.cxx:213">
<![LOG[Set authenticator in transport]LOG]!><time="15:45:29.708+240" date="06-13-2014" component="TSManager" context="" type="0" thread="5744" file="libsmsmessaging.cpp:7734">
<![LOG[Task Sequence Engine failed! Code: enExecutionFail]LOG]!><time="15:45:33.323+240" date="06-13-2014" component="TSManager" context="" type="3" thread="5744" file="tsmanager.cpp:923">

Attempts to decrypt the USMT.mig file with the recovery key found in the Computer Association -> Recovery Information obviously don't work, and with the original computer being reformatted, I'm quickly getting that feeling that any trace of the key needed to decrypt this file might be gone.

So now we have a lovely USMT.mig file up on our SCCM server, and no way to restore it, or decrypt it manually (at least as far as I can tell).

Since it's come up, this was done via a GUI, so we can't go back and look at the CLI command to recover from there, and I'm pretty sure this .mig file is encrypted - MigViewer warns that it's encrypted, and attempts to extract the files anyway result in 0 byte files with (corrupt) appended to the filename.

Are we out of luck, or does someone know of a way to get us out of our bind?

I'm working from a Windows 7 workstation, with PowerShell v2.0, and trying to delete a particular (orphaned?) object from the LostAndFound container in a 2008 R2 FL forest and domain with the Active Directory Recycle Bin enabled, and having no luck with anything.

Importantly, I need to delete this object, and this object only (rather than deleting every object with the IsDeleted property, which seems to be all I can find help on).

I need to delete it, because in order to resolve a broken trust relationship, the computer was disjoined from the domain (presumably causing the object to go to the Recycle Bin, and then to the LostAndFound container), and we'd like to give it its original name back (which is based on the asset tag number on the PC). Attempts to rejoin the computer to the domain with the correct name failed with the below error message (The specified account does not exist)

and attempting to rename it to the correct name once it's already on the domain fails with the below error message (The account already exists)

so the actual PC is currently sitting there with an incorrect name, which I need to rectify.

However, attempting to delete this AD object yields the error: The specified account does not exist. The distinguished name of the object has a \ (backslash) character in it, which I assume is due to it being in the LostAndFound container, and I'm wondering if that's the problem... and how to fix it. I'm running my shell as a domain admin, verified that domain admins group has full control and ownership of the object in question, and just can't seem to figure this one out.

The object in question (somewhat redacted):

Get-ADObject "CN=SomeComputer\0ADEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6,CN=LostAndFound,DC=MyEmployer,DC=prv" -IncludeDeletedObjects -Properties *

accountExpires                  : 9223372036854775807
CanonicalName                   : MyEmployer.prv/LostAndFound/SomeComputer
                                  DEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6
CN                              : SomeComputer
                                  DEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6
codePage                        : 0
countryCode                     : 0
Created                         : 12/7/2012 9:25:30 PM
createTimeStamp                 : 12/7/2012 9:25:30 PM
Deleted                         :
Description                     : HP6300
DisplayName                     :
DistinguishedName               : CN=SomeComputer\0ADEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6,CN=LostAndFound,DC=MyEmployer,DC=
                                  prv
dNSHostName                     : SomeComputer.MyEmployer.prv
dSCorePropagationData           : {5/21/2014 1:40:31 PM, 12/31/1600 7:00:00 PM}
instanceType                    : 4
isCriticalSystemObject          : False
isDeleted                       :
LastKnownParent                 : OU=Workstations,OU=Computers,OU=One of Our Sites,DC=MyEmployer,DC=prv
lastLogonTimestamp              : 130451668084269817
localPolicyFlags                : 0
memberOf                        : {CN=PCMilerComputers,DC=MyEmployer,DC=prv}
Modified                        : 5/21/2014 1:40:54 PM
modifyTimeStamp                 : 5/21/2014 1:40:54 PM
msDS-LastKnownRDN               : SomeComputer
Name                            : SomeComputer
                                  DEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6
nTSecurityDescriptor            : System.DirectoryServices.ActiveDirectorySecurity
ObjectCategory                  :
ObjectClass                     : computer
ObjectGUID                      : 90a13eaa-c7b0-4258-bebb-87b7aed39ec6
objectSid                       : S-1-5-21-1708945318-605057401-313073093-5882480
operatingSystem                 : Windows 7 Enterprise
operatingSystemServicePack      : Service Pack 1
operatingSystemVersion          : 6.1 (7601)
primaryGroupID                  : 515
ProtectedFromAccidentalDeletion : False
pwdLastSet                      : 130451667147545072
sAMAccountName                  : SomeComputer$
sDRightsEffective               : 15
servicePrincipalName            : {HOST/SomeComputer, HOST/SomeComputer.MyEmployer.prv}
userAccountControl              : 4096
userCertificate                 : [Not included]
uSNChanged                      : 54007434
uSNCreated                      : 5004556
whenChanged                     : 5/21/2014 1:40:44 PM
whenCreated                     : 12/7/2012 9:25:30 PM

Nothing I've tried seems to work, and I've tried a lot. On that note, what I've tried, below.

First, with a plain, one line PowerShell cmdlet:

Get-ADObject "CN=SomeComputer\0ADEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6,CN=LostAndFound,DC=MyEmployer,DC=prv" -IncludeDeletedObjects | Remove-ADObject

Confirm
Are you sure you want to perform this action?
Performing operation "Remove" on Target
"CN=SomeComputer\0ADEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6,CN=LostAndFound,DC=MyEmployer,DC=prv".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): y
Remove-ADObject : The specified account does not exist
At line:1 char:145
+ Get-ADObject "CN=SomeComputer\0ADEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6,CN=LostAndFound,DC=MyEmployer,DC=prv" -IncludeDeletedObjects | Remove-ADObject <<<<
    + CategoryInfo          : NotSpecified: (CN=SomeComputer\0ADE...MyEmployer,DC=prv:ADObject) [Remove-ADObject], ADException
    + FullyQualifiedErrorId : The specified account does not exist,Microsoft.ActiveDirectory.Management.Commands.RemoveADObject

Then, the same thing, referencing the GUID instead.

Get-ADObject "90a13eaa-c7b0-4258-bebb-87b7aed39ec6"  -IncludeDeletdObjects | Remove-ADObject

Confirm
Are you sure you want to perform this action?
Performing operation "Remove" on Target
"CN=SomeComputer\0ADEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6,CN=LostAndFound,DC=MyEmployer,DC=prv".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): y
Remove-ADObject : The specified account does not exist
At line:1 char:94
+ Get-ADObject "90a13eaa-c7b0-4258-bebb-87b7aed39ec6"  -IncludeDeletedObjects | Remove-ADObject <<<<
    + CategoryInfo          : NotSpecified: (CN=SomeComputer\0ADE...MyEmployer,DC=prv:ADObject) [Remove-ADObject], ADException
    + FullyQualifiedErrorId : The specified account does not exist,Microsoft.ActiveDirectory.Management.Commands.RemoveADObject

Then, reading the value into a variable first. (Tried with both GUID and DN, only showing one, as they yield the same error).

$blah = "90a13eaa-c7b0-4258-bebb-87b7aed39ec6"
Get-ADObject $blah -IncludeDeletedObjects | Remove-ADObject

Confirm
Are you sure you want to perform this action?
Performing operation "Remove" on Target
"CN=SomeComputer\0ADEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6,CN=LostAndFound,DC=MyEmployer,DC=prv".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): y
Remove-ADObject : The specified account does not exist
At line:1 char:60
+ Get-ADObject $blah -IncludeDeletedObjects | Remove-ADObject <<<<
    + CategoryInfo          : NotSpecified: (CN=SomeComputer\0ADE...MyEmployer,DC=prv:ADObject) [Remove-ADObject], ADException
    + FullyQualifiedErrorId : The specified account does not exist,Microsoft.ActiveDirectory.Management.Commands.RemoveADObject

Then I figured I could live with having to call DSRM instead of doing it natively.

dsrm "CN=SomeComputer\0ADEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6,CN=Lost
AndFound,DC=MyEmployer,DC=prv"

Are you sure you wish to delete CN=SomeComputer\0ADEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6,CN=LostAndFound,DC=MyEmployer,DC=prv
 (Y/N)? y
dsrm failed:CN=SomeComputer\0ADEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6,CN=LostAndFound,DC=MyEmployer,DC=prv:The specified account does not exist.

Then I said to hell with making it automatable, I'll just right-click and delete it through ADSIedit.

So, finally, I'm swallowing my pride and asking here. How the hell do I get rid of this damn object? It clearly exists, and its existence is causing problems, yet all my attempts to delete it from Active Directory are met with lies, damned lies and error messages.

Update:

Other things that haven't worked, based on comments, suggestions and discussions with ServerFaulters:

Escaping the 0, as if the \0 represents a null byte.

Get-ADObject "CN=SomeComputer`0ADEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6,CN=LostAndFound,DC=MyEmployer,DC=prv" -IncludeDeletedObjects | Remove-ADObject

Get-ADObject : No superior reference has been configured for the directory service. The directory service is therefore unable to issue referrals to objects outside this forest
At line:1 char:13
+ Get-ADObject <<<<  "CN=SomeComputer`0ADEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6,CN=LostAndFound,DC=MyEmployer,DC=prv" -Includ
eDeletedObjects | Remove-ADObject
    + CategoryInfo          : NotSpecified: (CN=SomeComputer ADEL...MyEmployer,DC=prv:ADObject) [Get-ADObject], ADException
    + FullyQualifiedErrorId : No superior reference has been configured for the directory service. The directory service is therefore unable to issue referrals to objects outside this forest,Microsoft.ActiveDirectory.Management.Commands.GetADObject

Escaping the whole \0A, as if it was a carriage return or new line, as in DOS (tried with `n, `r, `n`r and `r`n). All returned the same error, so only shown once.

Get-ADObject "SomeComputer`n`rDEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6,CN=LostAndFound,DC=MyEmployer,DC=prv" -IncludeDeletedObjects | Remove-ADObject

Get-ADObject : The object name has bad syntax
At line:1 char:13
+ Get-ADObject <<<<  "CN=SomeComputer`n`rDEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6,CN=LostAndFound,DC=MyEmployer,DC=prv" -IncludeDeletedObjects | Remove-ADObject
    + CategoryInfo          : NotSpecified: (CN=SomeComputer
DEL...MyEmployer,DC=prv:ADObject) [Get-ADObject], ADException
    + FullyQualifiedErrorId : The object name has bad syntax,Microsoft.ActiveDirectory.Management.Commands.GetADObject

Escaping the \0A as a form feed (yeah, getting a bit desperate).

Get-ADObject "CN=SomeComputer`fDEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6,CN=LostAndFound,DC=MyEmployer,DC=prv" -IncludeDeletedObjects | Remove-ADObject

Get-ADObject : Directory object not found
At line:1 char:13
+ Get-ADObject <<<<  "CN=SomeComputer`fDEL:90a13eaa-c7b0-4258-bebb-87b7aed39ec6,CN=LostAndFound,DC=MyEmployer,DC=prv" -IncludeDeletedObjects | Remove-ADObject
    + CategoryInfo          : ObjectNotFound: (CN=SomeComputer♀DEL:...MyEmployer,DC=prv:ADObject) [Get-ADObject], ADIdentityNotFoundException
    + FullyQualifiedErrorId : Directory object not found,Microsoft.ActiveDirectory.Management.Commands.GetADObject

Then I figured I should determine if the \0A character was even the problem, so I picked a different object I didn't care about in the AD Recycle Bin with the \0A string in it and tried to blow it away. It worked.

Get-ADObject -Filter { Name -Like '*DEL:*' } -IncludeDeletedObjects | Remove-ADObject

Confirm
Are you sure you want to perform this action?
Performing operation "Remove" on Target "CN=SomeServer-SomeJackass HP LaserJet 1320
PS\0ADEL:eddb23e7-b8d8-4d00-801f-22d82c169d66,CN=Deleted Objects,DC=MyEmployer,DC=prv".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): y

Confirm
Are you sure you want to perform this action?
Performing operation "Remove" on Target "CN=SomeServer-SomeJackass HP LaserJet 1320 PCL
5e\0ADEL:6e72e78f-f110-492c-ad50-91107f6fbd6a,CN=Deleted Objects,DC=MyEmployer,DC=prv".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): y

I am looking for a way to disable WSD on Server 2012 and Server 2012 R2. Basically, a number of our printers on a number of our print server have decided that using this bloody service is better than using the TCP/IP ports they were assigned, and they are changing themselves over to WSD ports which results in users being unable to print to these printers.

On Windows 2008 R2 server, I can prevent this behavior by stopping and disabling the PnP-X IP Bus Enumerator service, however, that service doesn't seem to be present in Server 2012.

The only suggestions I've come across for stopping this behavior are all sub-optimal.

1. Turn off Network Discovery (which WDS relies on to function)
2. Block WDS at the Firewall
3. Disable the WDS functionality on the printers.

I'd like a way to disable this service (and only this service) at the print server, because any of the other options involve a lot more work than I'd like (2, 3) or have undesirable side-effects (1). Does anyone know of a way to do this?

For reasons beyond my control, I've been tasked with setting up GPO/GPPs to deploy our 100+ printers to our 1000+ clients.

The good news is that we have over a dozen sites, and for the most part, I'm allowed to push out all printers at site X to all client PCs at site X.

The bad news is that the two ways I know how to do it ("Deploy with Group Policy...", from the print server" and using GPP/Group Policy Preferences) involve vastly more manual work than I'm willing to for this many printers. I can't even seem to select all the printers on a print server and use the Deploy with Group Policy... option, for example - it expects me to do that one by one, which isn't going to happen. The GPPs are even worse, as it expects me to select a printer's path from the print server and then manually punch in a bunch of information (such as printer IP) that it should be able to get from the printer connection.

My Google-Fu for a script to add all printers on a print server to a GPO/GPP came up empty, and I can't seem to see another way to do this in even a semi-automated fashion, but I'm sticking with the belief that I'm missing something, because there's no way any sane person would chose to manually add hundreds of printers into GPOs.

Ideally, I'd want to find a programmatic way to use the GPPs, but under the circumstances, any solution that doesn't involve dozens of hours manually adding printers would be just great.

Does anyone have a way to do this, or am I going to need to build a PowerShell script and/or trick a subordinate into doing this?

Does anyone know of a way to [effectively] have a user or group in one forest acquire the privileges of the Domain Admin group in another forest?

The obvious approach of adding Domain Admins@OneForest into Domain Admins@OtherForest isn't an option, because the Domain Admins group is a Global group (and thus, can't have members from other forests, due to the scope of Global groups).

You can add the Domain Admins@OneForest into a domain-local group in OtherForest, but then you can't add a domain-local group as a member of a Global (or Universal) group, which seems to result in something of dead-end using this approach to the problem.

I came across something of a partial workaround (that having typed out, I'll put as an answer to unclutter the question), the problem being that it provides Administrative rights on domain computers, but not the domain itself - for example, it doesn't allow the cross-forest account to edit GPOs.

The other approach I've considered, and had basically no luck in researching is to replicate/clone/duplicate the Domain Admins group (but as a domain-local group, so it can accept members from another domain), but I can't seem to locate a resource on what permissions this cloned group would need, and to what resources. Seeing as how it's not a trivial task to determine what permissions a given Active Directory group has, I was hoping there would be some Microsoft documentation on what permissions the built in and default groups have, but all I can find is the descriptions of their permissions, which do me no good in trying to configure another group to match.

Long question short, does anyone know how to apply domain admin privileges in one forest to an account from another forest?

Background/Environment Architecture:

My current environment for $corp_overlords$ is set up in a hub-and-spoke model with a technologically well-endowed home office hub (SAN, bladecenter/bladesystem ESXi cluster, fiber internet connection, etc.) connected to a number of remote site spokes that are not so well off, and typically contain single ESXi host server and connect to the home office hub via a T1. All traffic originating at any remote site routes back to the home office over a "MPLS network" (which is really just a T1 connecting the remote site to the home office).

At the home office, on the SAN, we have a number of VM templates that I have created to deploy VMs from. They are stored in an NFS volume, that is a vSphere datastore, attached to the home office datacenter object within vSphere.

Each remote site has a corresponding vSphere datacenter object, containing a datastore object that's connected to the locally-attached storage on the ESXi host server physically located at the remote site.

As these VM templates exist on the NFS volume, they occupy ~ 40 GiB (thin-provisioning). As files on NTFS (or a Linux FS), they occupy ~100 GiB.

Question:

How should I copy this 40 GiB of thin-provisioned data (that occupies 100 GiB of filesystem space) between my sites?

I am under the constraints that I have approximately 5 days to do so, and cannot interfere (noticeably) with "normal network traffic."

Hopefully, we all know what the recommendations for naming an Active Directory forest are, and they're pretty simple. Namely, it can be summed up in a single sentence.

Use a subdomain of an existing, registered domain name, and pick one that's not going to be used externally. For example, if I were to incorporate and register the hopelessn00b.com domain, my internal AD forest should be named internal.hopelessn00b.com or ad.hopelessn00b.com or corp.hopelessn00b.com.

There are overwhelmingly compelling reasons to avoid using "fake" tlds or single-label domain names, but I'm having a hard time finding similarly compelling reasons to avoid using the root domain (hopelessn00b.com) as my domain name and use a subdomain such as corp.hopelessn00b.com instead. Really, the only justification I can seem to find is that accessing the external website from internal requires an A name DNS record and typing www. in front of the website name in a browser, which is pretty "meh" as far as problems go.

So, what am I missing? Why is it so much better to use ad.hopelessn00b.com as my Active Directory forest name over hopelessn00b.com?

Just for the record, it's really my employer that needs convincing - the boss man is back-peddling, and after giving me the go ahead to create a new AD forest named corp.hopelessn00b'semployer.com for our internal network, he's wanting to stick with an AD forest named hopelessn00b'semployer.com (the same as our externally registered domain). I'm hoping that I can get some compelling reason or reasons that the best practice is the better option, so I can convince him of that... because it seems easier than rage quitting and/or finding a new job, at least for the moment. Right now, "Microsoft best practices" and internally accessing the public website for our company don't seem to be cutting it, and I'm really, really, really hoping someone here has something more convincing.

Question for which I'm having trouble finding an answer on Google or Technet...

Does granting the SYSTEM user permissions to DFS-shared files and folders have any effect on DFS replication? (And while we're at it, is there any good reason not to let SYSTEM have permissions to DFS-shared files?)

It comes up because I have a collection of DFS namespaces and folders that I'm not able to make someone else's problem, and while troubleshooting a problem where one DFS replica just wasn't replicating with another for no discernible reason, I observed that the SYSTEM account didn't have any permissions granted to any of the files or folders in the folder in question.

So I set SYSTEM to have full control and propagated it down, and our DFS health diagnostic reports went from showing a backlog of ~80 files to a backlog of ~100,000... and things started replicating, including a number of files that had been missing on one server or the other (so more than just the permissions changes started replicating).

Naturally, this made me curious as to whether or not DFS needs the SYSTEM account to have permissions to do its work, or if perhaps it was just any change to folder tree in question that prompted DFS to jump into action. If it matters, our DFS namespaces were set up under 2000/2003, and I have just recently finished upgrading all the servers to 2008 R2 or 2012 (with UAC enabled, blech), but have not yet gotten around to raising the DFS namespace functional levels to Server 2008.

(And bonus points if anyone has an official Microsoft article on NTFS file permissions and the SYSTEM account as it pertains to DFS or network files.)

I guess the title just about says it all. And yes, .\, not that obsolete \. thing.

For those who don't know, .\ is a shorthand way of saying "this computer"^{*see "footnote"} in Windows at a logon screen, which comes in very handy when you don't know or care about the local computer name but need to authenticate against it anyway, such as through RDP or scripting against a set of shared local users and passwords or even locally, if you're unlucky enough to have to physically go to a machine.

Does this have an actual name, and if so, what is it? I feel kind of stupid saying the dot-slash thing, which is how I've been referring to this.

^{*Footnote: As pointed out by @OliverSalzburg , the . is actually the shorthand for "this machine" and the \ serves as a separator between hostname and username when using the [host]\[user] style of authentication against a Windows machine.}

Especially with the option to install Server Core in Server 2008 and above, connecting to Windows servers over a CLI is increasingly useful ability, if not one that's very widespread amongst Windows administrators.

Practically every Windows GUI management tool has an option to connect to a remote computer, but there is no such option present in the built-in Windows CLI (cmd.exe), which gives the initial impression that this might not be possible.

Is it possible to remotely management or administer a Windows Server using a CLI? And if so, what options are there to achieve this?

The basic problem I'm having is that I have >100,000 useless machine certificates cluttering up my CA, and I'd like to delete them, without deleting all certs, or time jumping the server ahead, and invalidating some of the useful certs on there.

This came about as a result of accepting a couple defaults with our Enterprise Root CA (2008 R2) and using a GPO to auto-enroll client machines for certificates to allow 802.1x authentication to our corporate wireless network.

Turns out that the default Computer (Machine) Certificate Template will happily allow machines to re-enroll instead of directing them to use the certificate they already have. This is creating a number of problems for the guy (me) who was hoping to use the Certificate Authority as more than a log of every time a workstation's been rebooted.

(The scroll bar on the side is lying, if you drag it to the bottom, the screen pauses and loads the next few dozen certs.)

Does anyone know how to DELETE 100,000 or so time-valid, existing certificates from a Windows Server 2008R2 CA?

When I go to delete a certificate now, now, I get an error that it cannot be delete because it's still valid. So, ideally, some way to temporarily bypass that error, as Mark Henderson's provided a way to delete the certificates with a script once that hurdle is cleared.

(Revoking them is not an option, as that just moves them to Revoked Certificates, which we need to be able to view, and they can't be deleted from the revoked "folder" either.)

Update:

I tried the site @MarkHenderson linked, which is promising, and offers much better certificate manageability, buts still doesn't quite get there. The rub in my case seems to be that the certificates are still "time-valid," (not yet expired) so the CA doesn't want to let them be deleted from existence, and this applies to revoked certs as well, so revoking them all and then deleting them won't work either.

I've also found this technet blog with my Google-Fu, but unfortunately, they seemed to only have to delete a very large number of certificate requests, not actual certificates.

Finally, for now, time jumping the CA forward so the certificates I want to get rid of expire, and therefore can be deleted with the tools at the site Mark linked is not a great option, as would expire a number of valid certificates we use that have to be manually issued. So it's a better option than rebuilding the CA, but not a great one.

I'm thinking that there's absolutely no reason or justification for this, but before I open my mouth and get some admin in deep kimchi, I thought I should ask.

Is there any circumstance in which an MX record should point to a loopback address? To me, this says any mail server that tries to send to this domain will instead send to themselves, and fail, but I'm not a mail guru, so maybe I'm missing something.

I came across the below when troubleshooting a why-aren't-we-getting-email?? issue for a client, and I'm having trouble wrapping my head around it. Maybe I'm overthinking things, though.