soMuch2Learn's questions

I'm having an issue with server 2012 and setting default file type for a subset of users. I currently have a file type association XML file placed into my Domain Controller's sysvol, and it's called by a computer GPO to open PDFs with Adobe Acrobat DC (Computer Configuration\Administrative Templates\Windows Components\File Explorer\Set a default associations configuration file).

The catch is, I need to limit access to Adobe Acrobat DC to a small number of users and have Adobe Reader be the default for the rest of the company. This was much easier to handle with server 2008 GPOs, but I do not see a way to scope this computer GPO to a subset of users.

I imagine this being a common issue with server 2012 and wondering how other admins are handling such a situation?

Currently have a client that has poor eyesight and needs everything on his screen larger than standard. The issue is when running a Citrix application [Xenapp], the mouse is not scaling properly.

His local PC is set for 150% scaling with the mouse pointer set to extra large.
The Citrix application server is set for 125% scaling, mouse set to extra large.

The mouse shrinks significantly when I move from local to a hosted session.

When I increase the scaling to 150% on the server, then the mouse size is fine [stays same local and hosted], however, all the fonts in his applications are now too large to work with.

I've tried different combinations of local, hosted, but the mouse just wont scale properly. So my thought was to edit the mouse pack, just increase the size by 30%, but this doesn't seems as easy as it sounds.
Open to nudges in the right direction.

Current setup: 3 app servers (2008 r2, terminal services XenApp 6.5), 2 file servers (2008 r2).

Situation: user1 opens up an excel file that is on server1 and starts to work. user2 goes to open that same file, and does NOT get a message that the file is 'locked for editing' message. So they go in, make their changes, save out and close the file. Their work is never saved to the file. A open file session is never created for user2 on the file server, but they see and work as though all is normal.

The app server doesn't seem to come into the equation, but file server 2 does not exhibit the same issues as file server 1. And with that, those issues are not happening 100% of the time on file server 1. There are times where user1 will access a file [also happening with random excel files, not limited to just 1], and user2 will wait a few minutes, go in and they do not see an lock message. User2 closes excel, then user3 goes in and gets the lock message.

The common piece to the randomness is file server 1 and why its not registering the excel session as an open session, which will then alert another user that it's already open.

Open to any suggestions.

I have a client that needs to install Citrix XenApp 6.5 on a server 2008 32bit, non-r2 VM. When attempting the install, it states I need .Net 3.5, but crashes after the install attempt.

I attempt a windows update figuring that will work, but even though I have not run any updates on this VM, it states they are up to date. Can't even load IE 9 onto it without the install crashing.

Wondering if dealing with win 2008 32bit non-r2 is THAT difficult to work with? Any suggestions on getting XenApp 6.5 on it is appreciated.

Had an application server reboot this morning, after which, instead of pointing to the proper IP address for the license server [which is set through our computer unfiltered policy], it it looking at the farm's primary STA/XML broker's IP. So it is now sitting in it's grace period.

No other server in the farm is having this issue. The server can ping out to the license server, there are no custom load evaluators or other Citrix policies that are preceding my comp unfiltered.

I have been researching on where this value is stored [Citrix 6.0, server 2008 r2] but anything I come across, I just do not see where the license server info is kept.

And nudge in the right direction is appreciated.

I have a service account that has full control of a sub folder deep into a share. Access based enumeration is enabled at the root of the share and this service account has 0 rights at the root. An application that utilizes this service account is throwing access denied errors when trying to move/write files to the sub folders of the share.

Do I need to give permissions for this service account at the root to have them inherit down? Or, should permissions of subfolders suffice? Just wondering how the access based enumeration ties into the rights.

Often times in our environment, C drives run into space issues and the C:\WINDOWS\SoftwareDistribution\Download folder gets relatively large, upwards of 3.5Gb in size. Server 2008, R2 enterprise.

Per this forum, it seems ok to delete. I have no had issues doing so either, however, I am now wondering, if we have WSUS set up for servers to pull updates from, will deleting these automatic updates have any adverse affects. Also, why does this folder get so large at times? Just a windows "feature", or is something possibly misconfiged that I can look at?

Currently have a client stating that the 5 users on a 2cpu, 4gb mem app server are experiencing slowness and often, locking up for moments at a clip.

Framework is a VM running in vSphere 5.5 [intel based host, was recently migrated from an AMD host], Server 2008 r2, Citrix 6.5, local machine using Receiver 4.2.

I've upped CPU, which only increased cpu ready and made perf worse. Increased memory to 8Gb, but the VM currently sits at a 3.8Gb mem used plateau throughtout the day, so that didnt help any.

Updated citrix to rollup 5, windows updates, poured through event logs and I have hit a wall as where to go.

Currently working on a performance monitor set that Ill turn into a data collect set and was wondering what would be "must have" counters included for a typical "citrix slowness" investigation.

Counters:
Citrix MetaFrame Pesentation Server - Cumulative Server Load
ICA Session - Latency - Session average
Memory - Pages/Sec
Paging File - % Usage

What else would anyone suggest I place into this set that could leave me to anything that I could hang my hat on and move forward with?

Thanks.

Currently having an issue with a client that is getting the following error when loading a certain website:

I have added the site to trusted sites and enabled 'display mixed content' through GPO. Popup messages still appears and still have to hit show content for it to continue to the site.

System clock settings are correct and I really do not think its wise to uncheck 'warn of sites with mismatch certs' to bypass this warning.

Any other ideas I can try?

Was tasked with finding a way to redirect a user's recent items to \[network share]\recent.

Server 2008 GPME: User Configuration-Windows Settings-Folder Redirection doesn't have recent items as an option.

1. Can this be done?
2. Assuming only through scripting?

Thank you.

Wondering if anyone can shed some light on some SID confusion.

Currently having an issue with some policy applying to a few machines that were all based off the same image. One of our admins, ran psgetsid \[PC] on a few of those machines and returned all the same SID. However, when I run get-adcomputer [PC], powershell returns a different SID attribute for the same machines.

Confused as to why these are different.

Trying to run a script to clean exchange databases. When i run the clean-mailboxdatabase cmd-let I'm getting the following error:

Exchange is unable to clean the database that you specified...Unable to sync mailboxes with DS.

This is through my network account [elevated privileges in exchange] and with a script that had a SVC account with Exchange Organization Admin rights.

The way we currently handle account name changes is quite cumbersome and wondering if there is an easier way to go about things. Name change request comes through and we create a new AD account, mirroring the old one, then once a week we link the old mailbox to the new account, copy over their old personal network drive (roaming profiles), create the new accounts in specific soar they have access to (some Ldap, some not) disable the old account, enable the new, wait for user to call saying they can't get in.
The process leaves lots of room for error or skipped steps. Is there any downside to just outright changing given, samaccount name, display name on the original object instead of creating an entirely new account? How did your company handle name changes?
Thanks.

I am currently working on scripting some of our access at work and would love an easy way to enter and retrieve the last 4 of a user's social sec number. It's the primary way we identify people that call. Currently we have to log in and search through our HR application which is pretty cumbersome to use and adds time to a call. Chances of me getting management/senior engineers to approve of and extend the schema are almost nil. I was thinking of writing this number to the employeeNumber attribute but unsure if there are any unseen consequences in doing so. Apparently someone at our old helpdesk started entering this info into the 'telephones' tab in AD which can be seen through Outlook-global catalogue...managmeent was not too happy.

Is this a decent idea with what I have to work with? or?...

We recently moved a bunch of end users over to Office 2010 on Windows 7 from Office 2007 on Windows XP and I am having an issue getting their nk2 files to prepopulate their Outlook caches.

I moved the nk2 files from their PC and put them onto the file server where their roaming profiles are saved.

The VMs that the users are connecting to [through thin clients] are locked down by GPO, so I cannot simply run an Outlook/importnk2 and have it merge with the Outlook 2010 autocomplete cache.

Any ideas on how I can accomplish do this for a number of users with these constraints?

I am currently trying to get a windows thin client to log directly into VMWare. Essentially want to take These directions which are for Win XP and use them on a Win 7 machine. There is no winlogon folder in the registry and the wswc.exe no longer seems to exist in VMWare View 5.1.

Any push in the right directions would be appreciated. Thank you,

This may take a few lines to setup, so bear with me. My company runs vmware, mix of win xp and win 7 VMs. My tech group have admin rights throughout the domain. We're having some scanning issues and I am trying to get into the logs of our Win XP workstations when they lock up, however, I cannot access the event viewer through computer management.

Here is the breakdown. When I try to access event viewer from a Win 7 VM, I get: Access Denied (5) error. When I try to access event viewer from a Win xp VM, I get: Network path not found.

The odd thing is, if I try to access the logs of a win 7 vm, it works without issue.

I have tried to pull the logs from the vm by backdooring, \vm#\c\windows\system32\config. However when I try to open them, I get Error: The Data is invalid.

I do not have access to group policy, but I am being told it is open for my tech group. Any idea what I could look into to see what is blocking this on the xp desktops?

Thanks.