Matthias Güntert's questions

We have a bunch of Windows 7 and Windows Vista clients that belong to domain contoso.com. The clients are registered in DNS to client.contoso.com. We have changed the DNS suffix via GPO from client.contoso.com to contoso.com. This worked fine for most of the clients - servicePrincipalNames got updated automagically including the computer objects dNSHostName attribute.

However some of the clients keep failing to update the attribute, which results in the following error messages:

Log Name: System

Source: NETLOGON

Event ID: 5789

Level: Error

Computer: someClient

Attempt to update DNS Host Name of the computer object in Active Directory failed. The updated value was 'someClient.contoso.com'. The following error occured: The requested resource is in use.

So far the only solution to this problem was removing the client from the domain and put it back in, which is kind of brute force method to solve this. The AD objects seems to have to correct permissions to update the mentioned attribute.

Set-ADComputer -Identity someClient -DNSHostName someClient.contoso.com

Set-ADComputer : While processing a change to the DNS Host Name for an object, the Service Principal Name values could not be kept in sync
At line:1 char:1
+ Set-ADComputer someClient -DNSHostName someClient.contoso.com
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (someClient:ADComputer) [Set-ADComputer], ADException
    + FullyQualifiedErrorId : While processing a change to the DNS Host Name for an object, the Service Principal Name values could not be kept in sync,Micros
   oft.ActiveDirectory.Management.Commands.SetADComputer

get-adcomputer someCliemt

DistinguishedName : [...]
DNSHostName       : someClient.client.contoso.com
Enabled           : True
Name              : someClient
ObjectClass       : computer
ObjectGUID        : fdddd6ec-44f3-5b63-xxxx-55229cexxxxx
SamAccountName    : comeClient$
SID               : S-1-5-21-1815460242-1203374957-4236298635-xxxxxx
UserPrincipalName :

Things I have tried so far:

• Running gpupdate /force several times... rebooting of course
• Verified the client receives the correct DNS suffix settings from the GPO
• Verified the built-in object SELF has the Validated write to DNS host Name and the Validated write to Service principal Name permissions

Any ideas on how to solve this, without having to rejoin the computers?

Background:

Currently we are managing around 300 sites each hosting one 2012 R2 machine having the DNS server role installed.

All site-local clients are pointing to their respective site-local DNS servers. This servers, in turn, are configured as forwarders pointing to 2 out of 10 DCs (2012 R2 machines as well), which are hosted in a datacenter. We have only one single domain.

Problem:

DNS utilization is not equally distributed/load balanced across DNS servers in the datacenter.

Question:

If I configure each site-local DNS forwarder to contain all DCs IP addresses (and not only two of them), will the site-local DNS forwarder load balance (in a round robin fassion) the queries towards the DCs? What other recommendations can you give to optimize DNS queries/WAN traffic in this situation? I hope you get my question.

I need to troubleshoot some WMI crashes we are suffering from. Unfortunately the event log doesn't show any details as the descriptions are missing. This is what the log says:

The description for Event ID 5612 from source **Microsoft-Windows-WMI** cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

HandleCount
4116
4096
10508

I have already worked through Microsoft's knowledgebase article on how to troubleshoot the "event message not found" problem (https://support.microsoft.com/en-us/kb/166902) without any luck.

The registry key EventMessageFile under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\**WMI.NET Provider Extension** points to C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EventLogMessages.dll which is existent.

Comparing the registry keys to a system where this specific event id gets shown correctly doesn't reveal any differences. Also the EventLogMessages.dll has the same version and checksum.

Am I looking at the right registry key?

The path HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\WinMgmt only contains a key called ProviderGuid. But that seems to be fine, as the descriptions are getting displayed on a system having the same (and only this) key.

[EDIT]

I indeed was looking at the wrong registry keys. The right one to look for is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Microsoft-Windows-WMI which was completely missing. Also a key called Enabled and the ChannelReferences subkeys where missing within the provider configuration which can be found at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{1edeee53-0afe-4609-b846-d8c0b2075b1f}.

Adding those keys made the WMI events to get displayed correctly. However it did only last till a reboot of the system. Now the registry keys are there as they should be, but still no proper display of the events... any ideas?

This are my exact registry settings that I have exported from a working system:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Microsoft-Windows-WMI]
"ProviderGuid"="{1edeee53-0afe-4609-b846-d8c0b2075b1f}"
"EventMessageFile"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,\
  00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,\
  5c,00,77,00,62,00,65,00,6d,00,5c,00,57,00,69,00,6e,00,4d,00,67,00,6d,00,74,\
  00,52,00,2e,00,64,00,6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{1edeee53-0afe-4609-b846-d8c0b2075b1f}]
@="Microsoft-Windows-WMI"
"ResourceFileName"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,\
  00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,\
  5c,00,77,00,62,00,65,00,6d,00,5c,00,57,00,69,00,6e,00,4d,00,67,00,6d,00,74,\
  00,52,00,2e,00,64,00,6c,00,6c,00,00,00
"MessageFileName"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
  6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
  00,77,00,62,00,65,00,6d,00,5c,00,57,00,69,00,6e,00,4d,00,67,00,6d,00,74,00,\
  52,00,2e,00,64,00,6c,00,6c,00,00,00
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{1edeee53-0afe-4609-b846-d8c0b2075b1f}\ChannelReferences]
"Count"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{1edeee53-0afe-4609-b846-d8c0b2075b1f}\ChannelReferences\0]
@="Application"
"Id"=dword:00000009
"Flags"=dword:00000001

I have created a GPO to apply several registry keys to a Windows Server 2008 R2 machine in my lab. The relevant keys are within HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Internet and I have therefor used the Computer Configurationpart of the GPO.

Unfortunately it won't apply. The machine complains with:

I have tried both actions Create and Update within the GPP, but it does not make a difference.

The Windows Server 2008 R2 machine is a plain vanilla installation without any Windows updates installed. Unfortunately I have no easy Access to Windows Update as I am forced to work in a very restricted Environment. Is anyone are of a KB article addressing this? I just don't see what I am doing wrong here.

We have several GPOs containing many settings that have accumluated over time. I have spot-checked some of them and stumbled over settings that only apply to Windows XP (we exclusively run Vista and Win7 clients). As we are having serious performance issues caused by overloaded GPOs I need to get rid of this settings.

How can I filter/show all settings within a GPO that only applies to Windows XP?

I am aware of the GPMC filtering function, however it does not fulfill my requirement.

When adding a computer object to an AD group, at which point in time does the group membership become active? Is there some kind of kerberos refresh interval (similar to group policy refresh)?

I know it becomes active for sure when the computer reboots, also I am aware of the klist -lh 0 -li 0x3e7 purge trick.

How can I retrieve a specific property exclusively?

I am aware of the select-object cmdlet which seems to be dowdy in that respect:

PS C:\> Get-ADOrganizationalUnit -SearchBase 'OU=Houston,DC=contoso,DC=net' -Filter 'Name -like "SomeOU"' -Properties * | Select-Object Description,Streetaddress,State,postalcode | format-list

An optimized version would be:

PS C:\> Get-ADOrganizationalUnit -SearchBase 'OU=Houston,DC=contoso,DC=net' -Filter 'Name -like "SomeOU"' -Properties Description,Streetaddress,State,postalcode

Why is the -property switch not solely returning the entered propteries?

I have a strange issue on a Windows Server 2012 R2 here that just does not make any sense to me at all.

I've got a PowerShell script that basically has the following structure:

Function Something-Different
{
    [...]
}

Function Start-Some-Batch
{
    Start-Process "K:\Path\To\Batch.cmd" 
}

Function Something-Else
{
    [...]
}

Something-Different
Start-Some-Batch
Something-Else

However the batch file K:\Path\To\Batch.cmd never ever gets executed!

Some more information and facts:

• All actions are performed with the same domain user
• PowerShell version is 4.0
• The batch file can be executed without any issues when double-clicking it within Windows Explorer
• The PowerShell script does not provide any error output
• Executing Start-Process "K:\Path\To\Batch.cmd"directly from a PowerShell console does also not provide any output nor does it kick of the batch script
• $error[0] is empty after the execution
• The function Something-Else is executing just fine (which means Start-Some-Batch is not preventing the PS-script from finishing its execution)
• Running the PowerShell script elevated does not change a thing
• Calling the batch script from a cmd.exe prompt does also not start it (elevated or not)
• I am suspecting any of the hundred Security Settings that come via group-policy

What could cause such a strange behaviour? I am running out of ideas here.

I am currently evaluating the Microsoft PowerShell Desired State Configuration feature.

Unfortunately, my company is still running more then 5000+ Vista clients (and W2003 servers), which seems like a big show stopper when it comes to WMF 4.0.

I am wondering if there is any way around it - some tricks, hacks, black magic - anything to get DSC running on Vista?

Why does Get-Computers -OperatingSystem "Windows VistaT Business" not return anything? It works perfectly for all the other OS types.

Function Get-Computers
{
    Param($OperatingSystem)

    Get-AdComputer -Filter 'OperatingSystem -eq ${OperatingSystem}' -SearchBase "OU=Departement,DC=contoso,DC=com"
}

#Get-Computers -OperatingSystem "Windows Server 2012 R2 Standard"
#Get-Computers -OperatingSystem "Windows Server 2008 R2 Standard"
#Get-Computers -OperatingSystem "Windows 7 Professional"
Get-Computers -OperatingSystem "Windows VistaT Business"

I definitly do have Vista clients and the string to look for is Windows VistaT Business.

PS C:\> (get-adcomputer ClientA -Properties *).OperatingSystem
Windows 7 Professional
PS C:\> (get-adcomputer ClientB -Properties *).OperatingSystem
Windows VistaT Business

When I am logged in via remote desktop on a Windows Server 2012 R2 Core machine I can trigger the windows update by running sconfig.cmd. This however fails when its getting called within a PS remote session:

Enter-PSSession -ComputerName server2

This is what sconfig complains about. It basically says that it can't find a specific registry value. A funny thing to note is that Microsoft choose VBScript over PowerShell to program this CLI interface...

[server2]: PS C:\> sconfig

C:\>echo off
sconfig : FEHLER: Der angegebene Registrierungsschl?ssel bzw. Wert wurde nicht gefunden.
    + CategoryInfo          : NotSpecified: (FEHLER: Der ang...nicht gefunden.:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError

Microsoft (R) Windows Script Host, Version 5.8
Copyright (C) Microsoft Corporation. Alle Rechte vorbehalten.

System wird ?berpr?ft...

[...]

14) Server herunterfahren
15) Zur Befehlszeile wechseln

C:\Windows\System32\de-DE\sconfig.vbs(326, 1) Laufzeitfehler in Microsoft VBScript: Eingabe hinter Dateiende.

How should/can I initiate a Windows Update when being logged in via PS remote session?

I am currently building a lab environment to get a feeling on what DSC can accomplish and where the limits are.

We have a requirement to push out one-shot configurations to group of nodes based on criterias like operating system, AD group membership and OUs containing the targets.

So I developed the following exemplary script:

# Pulls computer objects from Active Directory
Function Get-Nodes
{
    Param($OperatingSystem)

    Get-AdComputer -Filter 'OperatingSystem -eq ${OperatingSystem}' -SearchBase "OU=SomeThing,DC=contoso,DC=com"
}

# Defines the configuration to apply
Configuration ConfigureHostsPush 
{
    Node $Allnodes.NodeName
    {
        # This resource is not able to delete a key, only values 
        Registry ConfigureRegistry
        {
            Ensure = "Present"
            Key = "HKEY_LOCAL_MACHINE\SOFTWARE\"
            ValueName = "MachineType"
            ValueData = "Hyper-V"
        }

        # This logs the defined message at the _destination_ host
        # within Microsoft->Windows->DesiredStateConfiguration->Analytic
        # requires showing and enabling the log first!
        Log LogSuccessfulRegistry
        {
            Message = "Successfully configued the defined registry value"
            DependsOn = "[Registry]ConfigureRegistry"
        }
    }
}

$nodes = Get-Nodes -OperatingSystem "Windows Server 2012 R2 Standard"
# $nodes = Get-Nodes -OperatingSystem "Windows Server 2008 R2 Standard"
# $nodes = Get-Nodes -OperatingSystem "Windows 7 Professional"

# Pulls a list of nodes into a hash table
$ConfigData = @{
    AllNodes = @(
        foreach ($node in $nodes)
        {
            @{NodeName = $node.Name}
        }
    )
}

# Generate the MOFs based on the configuration and hosts pulled from AD
ConfigureHostsPush -ConfigurationData $ConfigData

# Actually push out the configuration to the nodes
Start-DscConfiguration -wait -Path D:\DATA\DSC\ConfigureHostsPush

However some of the nodes are not always reachable and are offline in my case. How should I do the error handling and logging? So I can later on control which nodes got successfully configured or needs reconfiguration.

I know I can use the DSC log resource, but that seems to be pretty limited and only generates logs on the LCM/target node side.

I know I can ensure the presens of a specific registry value by using the following scriptblock:

    Registry ConfigureRegistry
    {
        Ensure    = 'Present'
        Key       = 'HKEY_LOCAL_MACHINE\SOFTWARE\SomeKey'
        ValueName = 'MachineType'
        ValueData = 'Hyper-V'
    }

But how can I delete the registry key SomeKey? If I only change the keyword Ensure = "Present" to Ensure = "Absent" it will leave the key SomeKey...

I am aware of the "AGDLP" rule of thumb when it comes to group nesting inside an AD strcture. But now I am wondering if there are any best practises when it comes to adding Active Directory groups to "computer"-local groups.

Let's assume i got a server named HOST_A which is running the Remote Desktop Server role. And I would like to manage the group of people having access to it via an AD group.

I would therefor create a domain-local group let's say "P_RemoteDesktopUsers_Host_A" and make it a member of the computer-local group called "Remote Desktop Users".

Or should i choose a global group scope? If so, why?

I am currently building a lab to get familiar with Microsoft's new "Work Folder" feature. I am looking for a way to abandon folder redirection and offline files.

So far I have one Windows 7 client connected to my servers sync-share (had to install an additional package). This work folder show's up under Desktop => User => Work Folders, beneath Documents, etc. So far so good.

Now I am wondering how one would move all the user folders (Documents, Downloads, Favorites, ...) to this Work Folder. Is there any best-pracice or real life experience out there?

I am kind a confused here... can someone shed some light on this? Thanks in advance

[Addendum]

What worked pretty well in my lab environment is applying a GPO that redirects Documents, Downloads, ... to C:\Users\%username%\Work Folders\Documents. I even got a boost in performance as IOPS occur local only and do not have to travel over the network.

I do not think that there is a way around folder redirection in this situation.

I have configured several avanced audit policy settings under:

Computer Configuration => Policies => Windows Settings => Security Settings => 
Advanced Audit policy Configuration => Audit Policies => ...

Also the following setting is set to "Enabled":

Computer Configuration => Policies => Windows Settings => Security Settings =>
Local Policies => Security Options => Audit: Force audit policy subcategory settings
(Windows Vista or later) to override audit policy category settings.

However none of the advanced audit settings is getting applied. Running

auditpol /get /category:* 

shows all options set to "No Auditing". Also there are none of the deprecated audit policies set.

What surprises me, is that neither gpresult nor rsop.msc show up the "Advanced audit policy" category. What am I doing wrong here? I am running out of ideas. Thanks in advance for your input!

[1. Addendum]

1. Other settings configured in the same group-policy object are getting applied. So the common pitfalls can be ruled out.

2. The originally GPO contains MSS settings

3. Creating a new, empty GPO and only setting the advanced audit configuration items, make them appear on the target server (checked with auditpol). So there must be something wrong with the GPO itself.

[2. Addendum]

4. Comparing both {GUID}\Machine\Microsoft\Windows NT\Audit\Audit.csv files with each other reveals the following difference. Note the double occurence of "audit".

Non working version of audit.csv:

,System,Audit Policy Change,{0CCE922F-69AE-11D9-BED3-505054503030},Success and Failure,,3

Working version of audit.csv:

,System,Audit Audit Policy Change,{0cce922f-69ae-11d9-bed3-505054503030},Success and Failure,,3

Whats going on here? Any compelling reasons to not edit this file manually?

How do I define the built-in administrators group in a group policy? For example

Computer Configuration => Policies => Windows Settings => Security Options => Local Policies => User Rights Assignment => Adjust memory quotas for a process

Do I need to set the string "BUILTIN\Administrators" or just "Administrators"?

What about "LOCAL SERVICE" and "NETWORK SERVICE"?

Do I need to set "NT AUTHORITY\LOCAL SERVICE" or just "LOCAL SERVICE"?

Microsoft documentation is very misleading and incomplete in that respect. Thanks in advance!

I have applied several internet explorer settings via group policy. Especially a long list of URLs in the "site to zone assignment" setting. However it seems that one URL still falls into the "internet zone" even when assigned to the "trusted zone".

In earlier versions of internet explorer one could easily determine from the status bar into which zone an URL falls. How can this be done via IE11? Am I overlooking something obvious?

I know there is the GPO setting "Computer Configuration => Admin. Templates => System => Scripts => Run logon scripts synchronously". This, however, ensures that logon scripts run before Windows Explorer starts loading (when enabled).

I need the opposite thing. I want to ensure that the explorer.exe has loaded successfully and execute the PowerShell logon script afterwards. This is due to some weired dependencies of an application I need to trigger.

I tried disabling the setting which according to the description should allow running file explorer and the script simultaneously. Unfortunately, it does not (yes, I did reboots and gpupdates...)

So I tried to add a function called wait-for-explorer() to my PowerShell logon script. It sleeps in a while loop until explorer.exe is running. However, this seems not to work right.

What is the best and cleanest way to solve this? Is there a GPO setting I am overlooking?

This is what the code looks like:

Function Wait-For-Explorer
{   
    $process = 'explorer.exe'
    $waitTime = 1

    While ($owner.User -ne $env:USERNAME) 
    {   
        try 
        {     
            $owner = (Get-WmiObject -class win32_process | where { $_.ProcessName -eq $process }).GetOwner() | Select -Property User
        }
        catch
        {
            Write-Host "Zzzzz...."
            Start-Sleep -Seconds $waitTime
        }
    }

    Write-Host "Process ${process} is running..."
}

Update

I found the answer to my question and why there is no such option provided by Microsoft. The reason is that according to the Technet article How Core Group Policy Works, the processing of Group Policy is synchronous, which means that computer Group Policy is completed before the logon dialog box is presented, and user Group Policy is completed before the shell is active and available for the user to interact with it. This in turn means there is no (direct) possibility for the group policy engine to start a process after the user shell has been loaded...

When trying to share an existing printer i receive the following error message:

printer settings could not be saved. operation could not be completed (error 0x00000001)

I have already tried restarting the spooler and server service (including several reboots). I can access existing shares & printer but i am not able to create new ones.

When trying to share a folder i receive

an error occurred while trying to share <...>. Incorrect function. The shared resource was not created at this time.

the event viewer shows up the following:

source: printService, eventid: 315

The print spooler failed to share printer PXYZ with shared resource name PXYZ. Error 1. The printer cannot be used by others on the network.

The windows firewall is on for all profiles and the service is running - all connections are allowed. File and printer sharing is enabled under Control Panel\All Control Panel Items\Network and Sharing Center\Advanced sharing settings for all profiles...

I have also completely deinstalled the running antivirus solution for testing purpose. However that did not make a difference.

In addition the following can be found in the log. I am not sure if this is of any relevance....

source: security-kerberos
eventi: 3

A Kerberos Error Message was received:
 on logon session 
 Client Time: 
 Server Time: 10:36:23.0000 2/18/2014 Z
 Error Code: 0xd KDC_ERR_BADOPTION
 Extended Error: 0xc00000bb KLIN(0)
 Client Realm: 
 Client Name: 
 Server Realm: TESTAD.DOMAIN.TLD
 Server Name: [email protected]
 Target Name: [email protected]@TESTAD.DOMAIN.TLD
 Error Text: 
 File: 9
 Line: f09
 Error Data is in record data.

source: security-kerberos
eventi: 3

A Kerberos Error Message was received:
 on logon session 
 Client Time: 
 Server Time: 10:38:20.0000 2/18/2014 Z
 Error Code: 0x7  KDC_ERR_S_PRINCIPAL_UNKNOWN
 Extended Error: 
 Client Realm: 
 Client Name: 
 Server Realm: TESTAD.DOMAIN.TLD
 Server Name: HTTP/SOME_OTHER_SERVER.AD.DOMAIN.TLD
 Target Name: HTTP/[email protected]
 Error Text: 
 File: 9
 Line: f09
 Error Data is in record data.

I am running out of ideas here. Any help on this would be greatly appreciated.