ewall's questions

This is an odd one! When users have a name change here we actually rename their user login account, not just the Display Name like many places do. Exchange 2010 is fairly new here, so this is the first time I've noticed this problem:

The user in question had her account renamed, and then went on a leave of absence for a time. While she is out, several others have full permissions to her mailbox (including send-as) so that they can make changes to appointments she made earlier.

For appointments that she made after the name change, the permitted users can make changes without any problems. But with appointments she made before the name change, the permitted users are unable to send updates. (Sorry, I can't find the exact error message.)

My first suspect was the old email address, but that is listed as a valid SMTP alias for her account, so it should be okay. Any other thoughts as to why this happens, and how to fix it?

We have Citrix XenApp 4.0/4.5/5.0 farms with hundreds of published applications which we will need to edit, preferably through a scriptable command-line tool. I've searched the Citrix Administrator's Guides and their troubleshooting tool list, but I'm returning empty-handed.

Can someone recommend any tools that can view and edit Citrix published app permissions, besides the normal GUI?

We have a Microsoft enterprise certificate authority, and I would like to start issuing a few code signing certificates.

But what I'm unsure of is this: since all our domain/forest machines trust the internal CA, when I issue code signing certificates: will all the client systems automagically trust the code signing certs for executing any code, or do I need to add the individual users' code signing certs to the clients' "Trusted People" store (like you might do with their self-signed or third-party certs)?

Particularly for servers in which IE Enhanced Security Configuration is enabled, you need to have all the Windows Update/Microsoft Update URLs in your "Trusted Sites" list in order to use the site.

(Furthermore, for domain member servers where Group Policy enforces Internet Explorer's list of "Trusted Sites", you don't have the option to edit the Trusted Sites yourself... so all the necessary URLs should be listed in the GPO.)

So, what is the full list of URLs I'll need in IE's Trusted Sites? So far I have the following:

• http(s)://*.update.microsoft.com
• http://download.windowsupdate.com
• http://windowsupdate.microsoft.com

I seem to remember there being several more...

It seems that running certutil.exe -DCInfo Verify will check the certificates for all domain controllers in the domain of the logged-in user account.

In our AD forest, we have a handful of domains. I only have a unique account in two of them, but have administrative permissions over all of them.

Is there a way I can run the command to target a different domain than the one I'm logged into, or do I really have to have an account in each one?!

Alternately, is there another way to accomplish the same goal?

Some of our users have requested the ability to flag a message as "do not forward". We do not want to use the overkill that is Microsoft RMS (Rights Management Services), but I'm curious if a transport rule could prevent forwarding based on a classification or similar? Anyone tried that?

I am in the process of retiring an old Windows-integrated CA and bringing online a new, properly-configured one (several, actually). Most of our systems are unable to use EFS thanks to Group Policy... but due to some misconfiguration, a handful of domain users were able to autoenroll for EFS certificates. So far, none of the users are aware of any files they have encrypted, and searching through their files with cipher /u /n isn't finding anything... but I can't be sure that there are no encrypted files we have missed.

I must retire this CA soon, so I'll have to revoke the EFS certificates and ensure that EFS is totally disabled for those users. I really can't migrate the old CA to a new one either, for several reasons. So what are my options for shutting off EFS for those who may have been using it without losing their data?

Lately I have been working with one of our storage guys on a project that has involved some scrutiny of big file shares that have been used by the company for years. Frequently, we run into directories or files that are inaccessible to us (with domain admin account) for one or more of the following reasons:

• corrupted ACLs
• access has been revoked or denied for the Administrators group (or SYSTEM user)
• file name + path too long (beyond MAX_PATH)

There are a handful of tools that can help in these situations, from Microsoft (e.g. TAKEOWN.EXE and ICALCS.EXE) or third parties (e.g. SETACL.EXE). Sometimes other tricks are needed such as running one of the commands under the SYSTEM account with PSEXEC.EXE. Even just figuring out what steps to do and in what order is a challenge...

For example, I would like to be able to troubleshoot it with a flow like this:

1. Is the path too long? If so, build a path with the \\?\ prefix, then test again.
2. Is the ACL corrupted? If so, re-order the ACEs properly and remove any unknowns, then test again.
3. Is the Administrators group denied access? If so, take ownership, add back permissions for the Administrators group and SYSTEM account, then test again.
4. Is it still failing? If so, delete all the ACEs and apply inherited permissions only, then check again. (This is kind of a last resort, since frequently it opens up permissions that were meant to be more restrictive.)
5. Is it a directory? If so, then the process needs to continue recursively for the files inside...

Doing the above steps manually is a pain, and unreasonable when we have hundreds of directories to fix. I have tried writing scripts to assist with these, but find that it's hard to make the script "smart" about the decisions it makes, and thus it's often easier to do a gross repair method like restoring the inherited permissions only.

Can anyone recommend other software and/or scripts that would help in this process? Or, how do you go about fixing permissions issues like these?

I am looking for options on sound cards with drivers certified for use on Windows Server 2008 x64 (required for a Nuance/Dragon product)...

Google searches reveal lots of rumors that SoundBlaster and ASUS cards might work okay with drivers from Windows Update. Others say you can get these cards to work by disabling the signed driver requirement--which is not an acceptable solution here.

The only card I find whose manufacturer says the drivers are supported on Windows Server editions is the SIIG DP SoundWave 5.1 PCIe card. Are there any others? Thanks, all!

I am looking at installing a new AD-integrated enterprise certificate authority structure, but have discovered that somebody already has created a CA (mostly used for SSL on internal websites).

I want to build the new structure according to best practices, by creating an offline root, authorizing several subordinate CAs for fault-tolerance, etc. but I don't want to mess up what's already in place. Apparently you cannot turn an existing root CA into a subordinate, so that's ruled out.

Can I simply install the new root elsewhere, not touching the existing one? (Or maybe cross-signing the existing CA with the new root's authority?)

I'm trying to delegate the rights to unlock user accounts in our Active Directory domain. This should be easy, and I've done it before... but every time the user tries to unlock an account (using the LockoutStatus tool), he gets denied with the error "You do not have the necessary permissions to unlock this account."

Here's what I've done:

• I created a domain local group and added the members who should have the rights. This was created over a week ago, so the users have logged out and in again.
• In ADUC, I've used the Delegate Rights wizard on the OU which contains our user accounts to grant permissions to Read lockoutTime and Writer lockoutTime to the group, per MSKB 279723
• I have double-checked the permissions were applied correctly in ADSIEdit.
• I have forced replication between all domain controllers to ensure the permission changes were copied over.
• The user testing it has logged out and in again to ensure he has any changes applied to his account.

...That covers all the bases I can think of. Anything else I could be missing?

On one of our MS SQL Server 2005 boxes, we have a small problem each morning when the Maintenance Plan runs. For just a few seconds, the server's C:-drive gets filled up, leaving less than 1GB free, where normally it has more than 7GB free. It is interfering with the replication program on the system, which halts when the free space dips too low but doesn't automagically start itself when its free again.

(To give you an idea of how fast it goes, here are this morning's times: At 05:08:43 Free disk space <1GB, then at 05:08:51 Free disk space >7GB. In less than 10 seconds 6gb of data was created and destroyed.)

The Maintenance Plan does the following: check databases, shrink databases, reorganize indexes, and cleanup its old log files.

Note that SQL Server is installed on the C:-drive, but all the databases and the tempdb have been moved to another larger drive. Is there some other temp directory or such that SQL Server might be using during these tasks that I need to re-point to a different drive?

If I configure a second interface on the router to connect to the same network as the other, will it cause spanning-tree to reconverge when I plug it into the switch?

E.g. existing interface is 10.1.1.1/24, and I need to configure and add 10.1.1.5/24. I don't want to wait until after-hours to avoid the network blip, but I will have to if STP is going to recalculate and reconverge.