curropar's questions

I would like the client machines in my organization to update the Root Certificates from a centralized location INSIDE the organization. This used to work with WSUS, but Microsoft left this way aside by 2014, I think.

The point of this is the clients do not have direct access to the internet but through a proxy with an authentication portal, as in an hotel. This proxy, which belongs to a third/parent organization, automatically logs out the clients after 8 hours. So when the clients try to update the certificates from Microsoft site, with the client not having access to internet, it logs an error event.

This itself it's not a big deal. But as we've the clients forwarding the error events to an event collector, this server get flooded with these errors.

Dismissing these errors is not a (desired) option, as we may dismiss clients which are really not updating the certificates, even with access to internet.

Any ideas?

I was doing a PowerShell script for a quicker way of closing locked files on a big Windows Server 2008 R2 file server (more than 2500 files opened at this moment, and the peak hour was like 3-4 hours ago), and I'd to choose between net files or openfiles. So I went with openfiles as is newer and it can give the full path of the file (net files can do that too, but you've to query every single ID).

I was having problems with it: some files won't close. I checked with net files, and all was ok... So I've started to take a closer look, and this is (an excerpt of) what I've found:

C:\> net files

ID         Path                                    User name            # Locks

-------------------------------------------------------------------------------
3221368833 G:\Users\...                            SomeUser              3
2550215683 G:\Users\...                            SomeUser              3
3422797829 G:\Users\...                            SomeUser              0
805310474  F:\Recursos\...                         SomeUser              3
335585292  G:\Users\SomeUser\My Documents          SomeUser              0
4026636306 G:\Users\SomeUser\Desktop               SomeUser              0
2684396568 G:\Users\...                            SomeUser              0
2952839192 G:\Users\...\EXCEL\SomeFolder2016       SomeUser              0
4160993304 G:\Users\...                            SomeUser              0
1610613364 F:\Recursos\Suministros                 SomeUser              0
The command completed successfully.

C:\> openfiles /query /v

Files opened remotely via local share points:
---------------------------------------------

Hostname        ID       Accessed By          Type       #Locks     Open Mode       Open File (Path\executable)

=============== ======== ==================== ========== ========== =============== ============================================================================
MyServer        32213688 SomeUser             Windows    3          Write + Read    G:\Users\SomeUser\My Documents\[SomePath].XLS
MyServer        25502156 SomeUser             Windows    3          Write + Read    G:\Users\SomeUser\My Documents\[SomePath].xls
MyServer        34227978 SomeUser             Windows    0          Write + Read    G:\Users\SomeUser\My Documents\[SomePath].xls
MyServer        80531047 SomeUser             Windows    3          Write + Read    F:\Recursos\Suministros\[SomePath].xls
MyServer        33558529 SomeUser             Windows    0          Read            G:\Users\SomeUser\My Documents
MyServer        40266363 SomeUser             Windows    0          Read            G:\Users\SomeUser\Desktop
MyServer        26843965 SomeUser             Windows    0          Write + Read    G:\Users\SomeUser\My Documents\[SomePath].XLS
MyServer        29528391 SomeUser             Windows    0          Read            G:\Users\SomeUser\My Documents\EXCEL\SomeFolder2016
MyServer        41609933 SomeUser             Windows    0          Write + Read    G:\Users\SomeUser\My Documents\[SomePath].XLS
MyServer        16106133 SomeUser             Windows    0          Read            F:\Recursos\Suministros

Wait, the IDs are different... Hell, no, the openfiles IDs are truncated!!

So obviously for the script itself, I'm for the moment going for net files, get the IDs, query each single ID so I get the full path, and from there I can reuse the rest of the script.

But for the sake of my sanity: is this a bug? A feature? Windows Server 2008 R2 is not new, and I was not able to find any reference to this, not to talk about a hotfix!

As a result of a new company policy, I've to apply File Screening for audio and video files on the corporate NAS, specifically on the profiles of the users . I've made some tests, and it works perfectly, except for the users not being able to delete their old files, as the new policy asks them for.

I guess this a "it's a feature, not a bug" thing, and there's no solution to it; but I'm trying to get at least a workaround. Any ideas?

I was trying to find a way to set "Apply policy" to "Deny" for a certain group in several GPOs (about 50), so I was looking for a way to do it automatically, when I came across this post at an (aparently) abandoned blog with the following script:

$strGroup = "my group" 
$strGPO = "my GPO"

$GroupObject = Get-ADGroup $strGroup 
$GroupSid = new-object System.Security.Principal.SecurityIdentifier $GroupObject.SID 
$GPOObject = Get-GPO $strGPO

$GPOPath = $GPOObject.path 
$GPOADObject = [ADSI]"LDAP://$GPOPath" 
$GPOObjSec = $GPOADObject.psbase.ObjectSecurity 
$GPOACLList = $GPOObjSec.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier])

$extRight = [system.guid]"edacfd8f-ffb3-11d1-b41d-00a0c968f939" 
$ace1 = new-object System.DirectoryServices.ActiveDirectoryAccessRule $GroupSid,"ReadProperty, GenericExecute","Deny","None" 
$ace2 = new-object System.DirectoryServices.ActiveDirectoryAccessRule $GroupSid,"ExtendedRight","Deny",$extRight,"All" 
$GPOADObject.psbase.get_objectSecurity().AddAccessRule($ace1) 
$GPOADObject.psbase.get_objectSecurity().AddAccessRule($ace2) 
$GPOADObject.psbase.CommitChanges()

$GPOGPTstr = "\\"+$GPOObject.DomainName+"\SYSVOL\"+$GPOObject.DomainName+"\Policies\{"+$GPOObject.Id+"}" 
$acl = Get-ACL $GPOGPTstr

$acl.SetAccessRuleProtection($True, $False) 
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($strGroup,"ReadAndExecute", "ContainerInherit, ObjectInherit", "None", "Deny") 
$acl.AddAccessRule($rule) 
Set-Acl $GPOGPTstr $acl

I've added it a foreach loop, to get my groups from a text file. It works, except for line 14:

$ace1 = new-object System.DirectoryServices.ActiveDirectoryAccessRule $GroupSid,"ReadProperty, GenericExecute","Deny","None" 

That throws the following error:

new-object : Multiple ambiguous overloads found for "ActiveDirectoryAccessRule" and the argument count: "4".
At .\denyApplyGPOtoGroup.ps1:16 char:10
+     $ace1 = new-object System.DirectoryServices.ActiveDirectoryAccessRule $GroupSid ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [New-Object], MethodException
    + FullyQualifiedErrorId : ConstructorInvokedThrowException,Microsoft.PowerShell.Commands.NewObjectCommand

Of course, line 16 fails, as $ace1 is $null. Nevertheless, the script kind of works: basically, permissions are applied correctly to the GPC, but not to the GPT, which makes sense with the code and the error thrown. So when I went to the GPMC, clicked on the GPO, and I got a message saying:

“The permissions for this GPO in the SYSVOL folder are inconsistent with those in Active Directory. It is recommended that these permissions be consistent. To change the permissions in SYSVOL to those in Active Directory, click OK.”

Clicking OK fixes the mess, but still looking for a solution to this workaround, though… Any ideas?