Crimsonfox's questions

I'm repurposing an old SAN device for some additional non-critical storage on a VM on a 3-host S2D cluster. I can't dedicate the switches at the moment like what seems to be recommended so I need some advice in setting up the VLAN correctly so the VM can communicate with the SAN target. I've included a network diagram below.

The SAN target is connected to two switches with a SAN VLAN (50) set up, ports are untagged and jumbo frames enabled.

I think I need to put in another link between the core and the SAN switch but I'm not sure how to tag the ports on either end to achieve the connection.

I've got a Windows RemoteApps setup to access a few applications from home but having some issues connecting from MacOS devices using the Microsoft Remote Desktop app. I initially thought it coincided with a certificate renewal but there's no issues from Windows devices and I'm fairly certain all aspects of the setup (Gateway, Connection broker, session servers) are all using the correct wildcard certificate.

When I try to connect to a remote app from the Workspaces tab, I simply get Error 0x4 so I imported a single app from an RDP file to see if I got any further information. It can connect to an individual app if I uncheck Bypass for local addresses but I get the error certificate name does not match input (screenshot below). The red boxes all match each other (green boxes are the server name and subdomain) so the certificate should be fine as servername.domain.red.boxes falls within the *.red.boxes wildcard

Why won't it trust the cert by default?

Does anyone know if it is possible to change the error messages displayed to users when changing their password? Specifically the complexity requires message. If possible I would like to change it to contain a little more detail for our students. Alternatively, displaying a message on the change password screen would also work.

I'm aware of the interactive logon GP options and the ability to change the login or desktop background but they don't really satisfy what I'm looking for.

We have our AD synced to Office 365 and I want to control who can send to a particular synced distribution group (usually done through Exchange Admin Centre, Delivery Management) which I believe is done through the AuthOrig and dlMemSubmitPerms attributes.

I can add users & groups that are from our AD but I don't know how to add an external email address (added as a contact in Exchange) or an address that is cloud only, if it's possible at all.

If it is, what is the format to use as it doesn't accept email addresses.

Thanks.

We've been receiving some spam/phishing emails that are managing to get through on occasion and the majority have a MAIL fROM our domain but their ENVELOPE from is whatever spammy address.

My understanding is that SPF only checks the envelope so I was thinking, if it was possible, to set up a rule that detects messages with a MAIL FROM using our domain and a mismatched ENVELOPE FROM address.

If MAILFROM = <ourDomain> then (If MAILFROM != ENVELOPEFROM then REJECT email)

Thanks in advance.

I need to temporarily disable a users access to their Office 365 email but not their regular AD account. I don't want to delete the mailbox as emails need to stick around. Our AD is synced with O365.

If I Block sign-in via the O3655 admin centre, it's re-enabled shortly after as the AD account is not disabled. As a work around I have disabled IMAP, POP3, OWA etc in their exchange properties but was wondering if there was a better way of doing this, an AD attribute possibly?

I'm having some trouble with OSX setting odd permissions (Everyone/Deny/Delete) on users folders when they login to a Mac for the first time and I don't have enough experience with Macs to get it working properly.

Our file server and domain controller is Server 2012 R2 and we have a Mini Mac server and Mac clients connected to Active Directory in the "Golden Triangle" configuration. The home directory for users is set in AD under the home folder and points to \\fileserver\networkshare$\<username> using SMB (no AFP server). We have a couple of folder redirection GPO's for Videos/Pictures/Music/Documents that point to \\fileserver\networkshare$\username\<folder>.

What tends to happen is a user logs onto a Windows machine first and everything works fine and then the first time they log onto a Mac machine after, it creates the Library/Spotlight etcfolders in the user folder and then applies Everyone/Deny/Deleteto the user folder, not just the Library/Spotlight etc folders and then cannot map their directory because it cannot access it. User will not be able to access their drive if logged onto the Windows side at this point either.

If the user logs into a Mac machine first, the folders are created correctly and only the Library, Desktop and Downloads folder get the deny permission (which seems fine). When the user logs onto Windows for the first time after, the remaining folders are created and it works...until they log onto a Mac machine again and then all the child folders of the user folder get the deny permission (but not the user folder like before)

As far as I can tell it's normal for OSX to apply the Everyone/Deny/Delete permission to protect the user folders being accessed by other users but something is conflicting with Windows and I can't quite figure out what. Maybe there's a best practice folder structure I don't know about or a setting somewhere but I think my lack of OSX knowledge is limiting me.

So I've had to deal with renaming whole rooms of PC's before due to them being swapped out and incorrectly named or generally being moved around but I've never settled on a decent workflow.

I'll give an example of the most recent situation. (Win 7 PC's and a Win 2012 server) Approx. 30 PC's numbered from 1 to potentially anything, mostly within that 1-30 range though.

As it was a complete mess all the computer objects were removed from AD to start fresh.

In many cases I can simply change the name of the PC, restart and it will fine. If that doesn't work going through the Join a Domain or Workgroup wizard works and then finally if they don't work, changing to a workgroup, restart, re-join the domain and restart does it. Occasionally get trust relationship errors and have to re-do the last one.

As you can tell, it's messy, inefficient and potentially wrong in a few ways. I know I'm at risk of sounding vague and there's unlikely to be one single answer but it's time consuming and I'm very interested in improving my methodology and hopefully it will help some people.

Using Server 2012 on Win 7 machines, folder Redirection applied by GPO.

It's an inherited network so I'm trying to find the cause of this issue as the previous techs left very little info.

Problem:

One of our user groups has a lot of extra items in their start menu alongside the ones they're meant to have.

• These items are not found in the folder the start menu is redirected to or the machines all users start menu Folder
• They appear in new users as well as freshly imaged machines.
• No offline files being used. Items will not available if network is disconnected while logged in.
• I can see no GPO causing this after checking with gpresult
• Users have roaming profiles

Any help getting me heading in the right direction would be awesome.

The logs found in: C:\Program Files\Microsoft\Exchange Server\V15\Mailbox\Mailbox Database

Are these used to support the indexing or something important? I only ask because they take up a chunk of space and if they're just used for error/warning logging I was wondering if it was possible cut down on them through a setting I'm unaware of?

For whatever reason our Win 7 deployment hasn't been kept up to date with new updates and I've started adding them as packages. (I know I can create a new image but it's not viable at the moment). Problem is, it's throwing this error when I import the updates from 2011

http://social.technet.microsoft.com/Forums/getfile/174215

I can't see where in any of the logs it specifies package installation so I can't tell which one it's having issues with. Does it break it down in a log I'm missing or is there another way to figure out where it's getting stuck bar adding them one by one?

We have folder redirection setup for our users through GPO but I need for one PC to include a couple of shortcuts in the start menu or on the desktop. The folders are loaded from a server path. Is it possible to set that up on the machine or will I have to create separate policies for that PC/User?