LPChip's questions

Introduction
For one of my clients, the following problem occured.

We have a distribution group setup in Active Directory that contains all members and is automatically added when we create a new user.

The distribution group is synced to Office365 and the client uses it to send emails to all users. The client wants to prevent people from outside of the company to email this distribution group. In Office365, the distribution group is set to allow both local and external emails, but the setting cannot be changed because the group is managed from AD through sync.

I did my research and the Attribute msExchRequireAuthToSendTo needs to be set to TRUE in Active Directory, then synched to Office365 to alter the setting in Office365.

I went to the distribution list in Active Directory, went to the attribute editor (tried ADSI too) but the setting was missing. Research lead me that a basic Exchange installation is required. My boss did not want to perform an exchange install, but manually added the files required to get the exchange attributes in ADSI.

He used the method described in this link, 2nd solution, but skipped the exchange install part, and did the manual part as described further in that article.

The Problem
I have the settings now in Active Directory, and I altered it as it should work, but Azure AD Connect does not sync these specific properties. It does not throw me any error either.

If I open the Azure AD Connect settings tool, I see that the settings are indeed checked to be synchronized. I have refreshed the directory scheme too, but no avail.

ldap shows that the setting is indeed set to TRUE, so everything indicates that the attributes are really there.

When I go to the Azure AD Synchronization Service, and I go to the Multiverse Search, and I open the distribution list, I can see exactly what it syncs, but the msExchRequireAuthToSendTo is not listed here.

I tried it with msExchHideFromAddressList but that doesn't work either.

I created a new distribution list with no members in it, set the msExchRequireAuthToSendTo to TRUE and synchronized, and in the Metaverse Search, the object is synchronised but again, without the msExchRequireAuthToSendTo setting.

This image is from the original group

I tried IdFix, but that only lists members, not distribution lists.

What am I missing here? Any tips of what I can try?

I'm building a Group Policy that will run on several terminal servers, but because installing the software through GPO needs a reboot before the software is installed and I need to have it working before a reboot is possible, I need to install the software manually.

If I install the software manually, will a GPO install cause problems, and is there anything I should keep in mind if it works?

The software is .net 4.7.2 and Zivver outlook plugin.

I have a weird issue. On a serverfarm I manage, User Profile Disks randomly stop working, causing users who login to loose access to their desktop, including the administrator user.

Server configuration
All servers are virtualized using Proxmox in a clustered setup. The following servers are present:

• DC: This server primarily functions as a domain controller and fileserver.
• S: This is an app server that functions as a terminal server, but used specifically for certain apps. This server is not utilized much.
• TS (6x): 6 different Terminal Servers that are configured identical, running the same software and having the same Group Policies applied. Office and Teams are both installed, and users have E3 licenses and single-sign-on is setup with ADSync.
• WEB: Broker server that also is being used to start an RDP connection by visiting a web page.

All virtual servers run Windows Server 2016 and are up-to-date when it comes to Windows Update.

Added security: 2FA using DUO mobile for both RDP Web and RDP Gateway sign-in.

The UserProfileDisks are stored on the DC.

The problem
Users login, the broker assigns a server based on least usage and the servers get filled with members. At a random moment, usually in the morning, A server can decide to stop working correctly. The next user that logs in does not get their userprofiledisk loaded, and gets a black screen with only a recycle bin on it and the start menu does not work. We can log out a user from the DC and if the user logs in again, if they get send back to the same problematic server, it happens again. If they get sent to another server, they get lucky and they login normally.

Currently, whenever this happens, we disable login for this TS from the broker server and schedule a reboot. A reboot always fixes the issue, but given that users are able to login before the problem starts happening, we can't just reboot the server at that moment. That said, I want to fix the issue so it does not come back.

When it happens and I log into as Administrator, I get an error message that location C:\Users\Administrator\Desktop is not available. As administrator, I can access the task manager but the start menu does not work. I can press CTRL-ALT-END to log off too.

If I go to C:\Users\ I see shortcuts (symlinks). The one for Administrator does not work anymore at that point. I can delete it manually, or it sometimes gets deleted when I log out, but once deleted, it does not come back. I also see lots of temporary profiles at this point. When things do work, the symlinks are created and I can double click them to access the folder.

I can't find anything useful in the EventLog, but then again, I don't know what I'm looking for, so I may have missed something obvious. I did check all errors though, and did not find anything that could explain what is happening.

EDIT: I have now found an eventID that may be the root cause, but I have no idea why this is happening.

EventID: 158 Disk 14 has the same disk identifiers as one or more disks connected to the system. Go to Microsoft's support website (http://support.microsoft.com) and search for KB2983588 to resolve the issue.

I've looked through all GUID's of the profile disks, but they are unique.

In the past, before the NTFS filesystem, creating shares was the only way to set permissions on shared data. But with NTFS being there, you can basically have all the data on a server be in one shared folder, and use NTFS permissions on the folders inside the shared folder to control access.

This even works with network drive mappings.

So you can map S: to \\server1\shares\MyShare, given that Server1 is the name of the server, shares is the only share, and MyShare is one of the many folders below that has NTFS permissions setup.

My question is this. Is there a reason why one would use multiple shares over one share, given that all the data will be stored in the same place anyway?

So instead of sharing only shares, I would then share MyShare, give it full control and use NTFS to set access?

Is there a performance consideration to choose one over the other?

My situation is as follows:

• I have 1 Windows Server 2016 as Domain Controller which provides policies (DC1).
• I have 1 Windows Server 2016 as Terminal server (RD1).
• I have multiple PC's

All are joined to the domain.

I have set network share access using policies with the Replace option.

My problem is: Every 90 or so minutes, Background policies are executed, and as such the share policy refreshes the share, which means, remove share, recreate.

Any program using a file on the share suddenly can't find the file for a brief moment. For example VLC Media player will crash, Visual Studio will say the project was modified from the outside and asks if I want to reload it.

I know I can change the replace to update or another method, but I want to be able to remove the share simply by removing a user from the usergroup attached to that share.

In order to combat this, I changed the group policy to not do background sync of policies, which is a computer policy and requires a restart. But after a restart, it still syncs every 90 minutes. I then changed the sync interval to the maximum of 31 days (yes, it used to be 45), restarted, still syncing every 90 minutes. There's even a policy I found that doesn't refresh policies unless the policy object itself has changed. Again, this has no effect.

I did a gpresult /v and saw that the policies mentioned above are not even listed.

I have added the computer to the policy and gave it read permissions, similar to how other groups are listed, but that yielded no result either.

I suppose I could setup this using local group policies, but before I go this route, I'd like to make it possible to setup this through domain group policies.

Anyone an idea why this isn't working, and how to fix it?

I am considering to migrate my server to Windows Server 2016 Hyper-V. Currently I use Windows 10 with Oracle VirtualBox as HyperVisor. In order to test out Windows Server 2016 Hyper-V, I decided to create a new Virtual Machine and installed Windows Server 2016 Hyper-V.

All went well, and the installation completed. It starts, I get the command window showing that it is starting, then says that the password for the Administrator user needs to be changed. I can press ok and type the new password, but it does not understand the enter key, so I cannot confirm the password and continue.

Lets say I have the following DNS active for domain example.com (leaving out priority and ttl)

   example.com A    123.45.67.89
mx.example.com A    123.45.67.89
   example.com MX   mx.example.com

Now, this is a valid DNS record. If I were to add the following mx record, would that cause any problems?

mx.example.com MX   mx.example.com

I have tested this, and it seems to work, but I want to be sure.

The reason is, I always used [email protected] to email without this last mx record added. But some services fail because they're not using the main domain, but rather check for the subdomain if that mx record is present. Adding the mx record seems to allwo the services to work, but I now am worried it may cause problems for actually sending/receiving email.

Also, I have set the priority for the new mx record to be lower to the original one, so in theory that should make it always choose the first one, but I'm curious it would even work if the priorities were reversed.