MadBoy's questions

Is there a way to get gpresult to work without never logging in to computer as an actual user?

Lets say UserA is logging in to computer XYZ. You login via TeamViewer to it or are there locally as AdminA, you right click Run As Administrator, type in your administative credentials you type in the famous gpresult /R command to get computer GPO's and it's simply not there.

gpresult /R
INFO: The user adm.test does not have RSoP data.

You try to do it remotely and it fails as well...

gpresult /S DDD9D5 /SCOPE COMPUTER /R
INFO: The user does not have RSoP data.

How to force it so you can actually get that data as Domain Admin or Administrator on that computer (but not a user) and a user that has never actually logged in to that computer?

For years I thought this was just "working" but it seems I've always been logged in to the computer via RDP or other means and it always worked. Now it doesn't... and I need a way to debug this properly.

Is my only option actually to login as standard user and then do the commands?

I've huge problems with backup of Hyper-V on handful of HOSTS. During backup done by the software some machines become unavailable, host starts dying etc. We tracked this to not the software itself but file copying. Just doing file copy from drive D to C of size 30GB will kill off the HOST during file transfer. The ram usage before file copy is 48gb used out of 64GB. When you start the transfer of 30GB file the usage of ram changes and in 1 minute it's 64 out of 64 server starts crawling and even RDP, physical access stops working until the file copying is done. So during backup it can take hours for the servers to be avaialble.

This is a DELL Server R515 with RAID controller in mode Write-back. I've noticed this on other Windows 2012 servers. I tried using some old solutions to disable cache from 2003 but none are working. I've tested it on both IBM and Dell servers and behaviour was very similar. Ram usage going up. First it's starts with 700MB/s speed copy and then after ram is used it's going slowly. So the question is how to disable file caching or limit it to normal values.

Please don't give suggestions to use robocopy, or other "copying" tools because while it may solve the problem with copying by using external software my problem is actually about backups taken by 3rd party software which i have no influence on. I would like "Explorer" to behave normally :-)

I've a server with 2 IP's.

• 10.10.1.50 (255.255.255.0)
• 10.10.2.50 (255.255.255.0)

I've also a DC which has it's IP on 10.10.1.30 and has no way to reach 10.10.2.50.

When I ping the server from DC it responds with 10.10.2.50. So I went with the obvious way to deal with it and disabled Round Robin, kept Netmask ordering enabled

    dwLogLevel               = 00000000
    dwDebugLevel             = 00000000
    dwRpcProtocol            = 00000005
    dwNameCheckFlag          = 00000002
    cAddressAnswerLimit      = 0
    dwRecursionRetry         = 3
    dwRecursionTimeout       = 8
    dwDsPollingInterval      = 180
 Configuration Flags:
    fBootMethod                  = 3
    fAdminConfigured             = 1
    fAllowUpdate                 = 1
    fDsAvailable                 = 1
    fAutoReverseZones            = 1
    fAutoCacheUpdate             = 0
    fSlave                       = 0
    fNoRecursion                 = 0
    fRoundRobin                  = 0
    fStrictFileParsing           = 0
    fLooseWildcarding            = 0
    fBindSecondaries             = 0
    fWriteAuthorityNs            = 0
    fLocalNetPriority            = 1
  Aging Configuration:
    ScavengingInterval           = 0
    DefaultAgingState            = 0
    DefaultRefreshInterval       = 168
    DefaultNoRefreshInterval     = 168

But even after Round Robin is disabled and Netmask ordering seems to be correct the wrong result is returned.

LocalNetPriorityNetMask is set to 0x000000ff (255) so it seems to be set correctly for class C. So why it doesn't work as it should? What am I missing? Both records of the server have same date/time in DNS. I know I could fix it by disabling netmask ordering and changing the times a bit but this will break it for servers that relay on accessing the server via 10.10.2.50 IP address.

Server was rebooted multiple times. Usually after reboot the servers do respond properly with 10.10.1.50. After a while 10.10.2.50 comes into play so DC can't connect to the server.

In Active Directory you can set and enforce rules where users have to use strong password, can't use last 5+ passwords they already had, enforce password complexity. Is there a way to enforce such settings so that if a service account (password reset web service) tries to set new password for user it's checked against the policy and is either accepted or denied?

It seems that since the service account is forcing password change user can type in the same password via web interface and keep on using same password over and over again. Since it's a service account changing the password for him it is not checked against last known passwords hence the rules of password are not enforced

While programmer could code a complexity check the last passwords used check can't be checked on web interface because the webservice doesn't have the knowledge of last passwords.

Is it possible to force it so that such change of the password by service account is also restricted like normal user password change would be ?

I have 2 machines with Hyper-V 2012 (free, console version) that I manage from Windows 8. Whenever I want to move any machines from there's always this error. I have enabled Kerberos, I setup delegation on both hosts (all delegations, not just the necessary ones), I have disabled firewall's and I am even logged in as Domain Admin to both machines. I have re logged multiple times but it still fails. I've read that it's best to move machines from the HOST that is the source but since it's Hyper-V 2012 free version (core) there's no GUI there so I can't do it directly. So I'm using Windows 8 Pro.

As additional information using powershell command (on the SOURCE host) works just fine (had to adjust some settings in the VM as the other host has less RAM but using following command makes the move:

PS C:\> move-vm -Name WEB -DestinationHost HOSTHV4 -DestinationStoragePath 'C:\VM-4\WEB'

We had a distribution group on Exchange 2010 which didn't had any members for long time (nobody noticed). What happens to the emails that come to such group? There was no return messages or anything.

We're introducing WSUS inside our network in one bigger location but our company have mutliple small offices. Our people move a lot so I would like them to use WSUS when inside main location and in other places where WSUS will be available and Windows Updates from Microsoft directly when they are roaming in our small satellite sites.

I found out that if I would like clients to use WSUS based on location they are in you have to use more or less following steps:

1. Enable Round Robin and Netmask Ordering in the properties of your DNS server.
2. Choose a DNS name for WSUS. For instance, wsus.example.com
3. Create an A record in DNS for each WSUS server. Call them all wsus.example.com or whatever you have chosen as the DNS name. Give each new A record an IP address of each WSUS server.
4. Use the DNS name you have created, wsus.example.com or equivalent, to configure group policy or otherwise distribute the WSUS server setting to the clients.
5. Clients will now use the round robin in DNS to resolve the nearest WSUS server.

Could I use this methodology and add a new DNS record (wsus.example.com) in our small offices where WSUS is not available and point it to http://windowsupdate.microsoft.com? Will clients wanting WSUS server recognize it as Remote WSUS and get updates from Microsoft thinking it's their WSUS server? Or will it simple fail? (hope that's not too confusing).

Is there any other solution I could use for this?

Edit. We came up with another idea. If we point updates.microsoft.com in our DNS to WSUS will clients use WSUS when being locally or clients will not treat wsus as Windows Updates from Microsoft? This would actually be nice solution if it works..

Is it possible to get Administrative Tools on Windows 7 (not joined to domain) to administer servers that are domain joined (since they don't ask you to provide domain/login/pass)? If yes how can I force consoles to behave like I want to?

We have 2 servers which have 6 SATA 7200 disks inside (each). We want to configure both servers so that they will have Window Server 2008 R2 Enterprise installed and on top of it Exchange 2010 x2 (for 300 people) as one virtual machine and AD x2 as another virtual machine and maybe some additional VM's (but not that much.

Now we are asking ourselves if it's better to create 3 RAID groups RAID 1 or (RAID 1 and RAID 10 scenario). We're looking for performance and protection. Of course SATA drives were choose because of costs and there's no real option to choose something else.

Idea 1:

• Raid A -> 2 x 1TB (RAID 1) -> C partition for system + D partition for Exchange logs
• Raid B -> 2 x 1TB (RAID 1) -> E partition - all virtual machines
• RAID C -> 2 x 1TB (RAID 1) -> F partition - exchange database

Idea 2:

• Raid A -> 2 x 1TB (RAID 1) -> C system partition + exchange logs
• Raid B -> 4 x 1TB (RAID 10) -> all virtual machines, exchange db

Idea 3:

• Raid A -> 6 x 1TB (RAID10) -> system, all vm's, exchange db, exchange logs

Idea 4:

• ?

Which of the option is the best? Will having RAID 10 on 4 drives mitigate the problem of putting multiple stuff on one big drive so access speed may be slower if all things at once hit the same target?

I'm looking for a way to find all users who don't have SEND AS SELF flag set in Exchange 2010. Without that flag users aren't able to send emails thru SMTP and it seems some users are missing this flag (especially users who used to be Domains Admins etc)

I guess this would have to be similar to query below although this should show users (well not quite as it hides the username) who have Send-as and I'm looking for users who don't.

[PS] C:\Windows\system32>Get-Mailbox | Get-ADPermission | where {($_.ExtendedRights -like "*Send-As*")}

Identity             User                 Deny  Inherited
--------             ----                 ----  ---------
LGBSPL.LGBS/LGBS/... NT AUTHORITY\SELF    False False
LGBSPL.LGBS/LGBS/... NT AUTHORITY\SELF    False False

I would like to Delegate User to be able to cleanup AD by allowing him to move users between couple of OU's (and doing only that). How can I achieve that?

I want to extend user permission that I've given using this method Grant permission in Active Directory to add users / modify / changed password / add them to group them but not delete them

I would like to add delegate user ability to:

• add new users to container
• change password
• modify group membership
• modify users properties (such as email / name etc)
• move users between OU's

Basically user will be able to do most things with account besides deleting it. I tried using Delegation of Control Wizard but the common tasks are too wide (usually including Delete part) so I need to go into custom task to delegate.

This are the options that I selected:

• Only the following objects in the folder (User objects)

But the last permissions page is very wide and I wouldn't like to give user too much power. Can anyone share which options are necessary for the specified question? And as an extension to this write what each option means and what power it assigns?

How to create entry in DNS to catch-all queries (wildcard)? For example domain.local with IP 192.168.1.1 and any subdomain to that will respond with same ip (bbbaasa.domain.local, aaa.domain.local - 192.168.1.1)?

We want to implement Exchange 2010 in our organization which is spread over couple of locations. Right now we're using POP3/SMTP at hosting and all people are using Outlook 2007 and 2010. Mail for our company (and many more) is crucial form of communication with clients and internally.

Normally I would want to do it all in one day (and still I prefer that way) doing more or less this:

• setting up Exchange to work for company.com domain
• setup all the accounts mailboxes
• do any other related tasks (some testing etc.)
• switch MX records from old server to new server
• tell users (prepare instructions) to setup Outlook 2007/2010 with one of the following:
  • by modifying in Control Panel / Mail / New Account in same profile and leave the old mailbox for a few days and then remove the old mail server and just leave .PST files from it (or ask user to move the emails from PST to Exchange).
  • whatever option they wish :-)
• the list is just example for the sake of information

But the thing is our management would like to do it over couple of days/weeks since there will be problems with some people being offline, some people computers not working as they should, pick any other problem here (as we had experience with domain rename taking over 2 months for all people to finally switch to new domain).

So this starts tricky as after MX records change there will be no new emails in old mailboxes and people who will be offsite and will have problems with setting up Outlook to use Exchange will be out of order. Also with more then 200 people and few IT staff (most located in one location) this could cause some havoc with people who didn't read emails informing about change, who didn't proceed with instructions, who are offsite etc etc (we have all seen that during our domain rename instructions where last guys were migrated 2 months after rename).

So my plan would be (a bit complicated):

• inform users 1 month/1 week/1day prior to implementation
• make accounts/domains configured on Exchange and tell people even 1-2 weeks before change to add Exchange to their Outlooks.
• let exchange be able to send emails as company.com for the whole time before the final switch (so the emails would keep on coming to old mailbox but would let users to send emails from both just in case they make some mistake)
• make the final switch and tell users to only use Exchange and help them to migrate emails/remove old mailboxes.

Or

• inform users 1 month/1 week/1day prior to implementation
• make accounts/domains configured on Exchange and tell people even 1-2 weeks before change to add Exchange to their Outlooks.
• let exchange be able to send emails as company.com for the whole time before the final switch (so the emails would keep on coming to old mailbox but would let users to send emails from both just in case they make some mistake)
• go thru rooms of people / per project / etc and switch them one by one over days/weeks by implementing for each account on hosting Redirect to a separate domain company.com.pl which would be already set up and working so that all emails that come to people within room/project which have been migrated emails flowing to their mailboxes in hosting will be forwarded automatically to Exchange (by using 2nd domain).
• until all people are done that way MX would stay pointing to old server
• after all people are migrated switch MX and after a while switch redirection off

Additional option would be to use pop3 connector for everyone but this brings other problems:

• people's emails will be vanishing from their hosting Inbox and may cause some confusion
• there may be some race condition for Outlook's which download and delete emails after download (like mine)
• we would need to know all people's passwords for mailboxes

What do you think? Maybe there's other, better way? Or you have some nice idea how to better mitigate problems with migration.

I have client which has multiple sites all over the world. They have 2 domain controllers in main location and every other location connects thru to main site with vpn tunnel. Currently the network is more or less disaster so I'm trying to fix it. One thing in common for the secondary sites is that their routers in network settings have ISP local DNS servers so their DHCP based computers get "wrong" DNS servers. It's been like that for ages and they use IP address to connect to servers.

So I would like to fix it with proper DNS servers etc. So I was planning to use RODC and DNS server on the only server (with Terminal Services and couple of programs like Visual Studio that people use to work) that is located in the location. The other option was to enter DNS servers from main location but if the tunnel goes down employees will be confused and won't be able to access internet (as they would need to change router settings) so this doesn't seem as reliable solution.

My questions are as follows:

1. If VPN Tunnel goes down can people use DNS without problems (they can access internet) and they can authenticate to local servers/workstations?
2. Is it safe and recommended (??) or in contrary not advised to put RODC/DNS server on the very same server with users and other programs?
3. Any other advices regarding this setup ?

Is it possible to restore Hyper-V virtual machine (just one of 4) using Windows Server Backup (if it was backed up first)? Or is there no way to do individual and every time one machines goes bad full recovery of Hyper-V is required? I've read http://support.microsoft.com/kb/958662/en-us but I do hope that at least some of those things are possible to workaround.

There's an ongoing "panic" all over the news for some time now about IPv4 running out and IPv6 being the savior. All the big companies are preparing and showing how it should be done (last actions from Google, FaceBook). I do understand the problem and I do think people should slowly starting to move but is it also a big deal for small companies?

I've clients which are usually very small companies with 5 to 50 employees using Windows XP/Windows 7 for their clients and Windows 2003/Windows 2008R2 for their servers. Nothing complicated with 1 up to 5 switches (some managed and some unmanaged but nothing too complicated - Linksys/D-Link). On top of it there's usually modem provided by ISP and small home router (D-Link, Draytek, Linksys) or if the client is a bit bigger something like FortiGate FW50B.

How should they prepare? Is there anything each company should do? Like buy new routers? I'm looking for general advice on how to approach this from my clients perspective. Should we wait for ISP to come to us first and then try to fix things later or there's nothing we should be worried about and just do what we do and there's nothing to be done ?

What would be best topology considering that:

1. 6 x Exchange 2010 Standard Licenses
2. 2 x Separate locations that are supposed to support redundancy in case of link problems
3. 4 x Forefront TMG 2010 with Forefront Security and Forefront Protection/Security

Multiple locations worldwide using those Exchange. Most locations will be connected with VPN Tunnel (the ones hosting Exchange for sure).

I was thinking something like this:

Location MAIN (about 70-100 people):

1. 2x TMG 2010 in NLB
2. 1x Exchange 2010 CAS/HUB Role
3. 2x Exchange 2010 Mailbox Role (Active + Passive)

Location SUPPORT (about 20 people):

1. 2x TMG 2010 in NLB
2. 1x Exchange 2010 CAS/HUB Role
3. 2x Exchange 2010 Mailbox Role (Active + Passive)

Management wants to make sure that in case of problems in main location (power failure, link loss etc) second location can support all traffic from around the world and vice-versa. We have 6-7 locations and more comming up (not big ones but like 10+ people per each location).

I do know that CAS/HUB is single point of failure (and no NLB), but i simply lack more licenses to do some redundancy on that.

What do you think about this approach? What would be better approach according to you?

I have a german Windows 2008 R2 with English Multilanguage Pack installed. It has only german, english keyboard defined. It works fine.

I use Windows 7 with PL version and PL keyboard settings. And my customer who logs in to that Windows 2008 R2 uses german Windows 7, Windows XP.

When I login to Windows 2008 R2 it automatically switches keyboard on server to PL (and I can choose between 3 keyboard, however there's no way to remove that PL keyboard). This wouldn't be a big problem but my customer using german windows also see this PL keyboard and it sets itself as default for him too...

Is there a way to make sure only keyboards defined on server works and not those pushed thru RDP?

How to configure non-admin users to allow them to install updates for Java and Adobe Acrobat Reader (or any other application which may need such privileges) without needing for administrator password on Windows 7. Updates for Microsoft products install without problems.

This can be Active Directory (Windows 2003) solution, or computer based (employable through GPO or login script).

Edit: Just to add some information. I know Secunia offers Secunia CSI that integrates with WSUS and allows other software updates deployed thru it. But it's pay software which is something I would like to avoid.

Also giving an admin/power-user rights is not something i want to have since then it opens up additional security holes.