myron-semack's questions

I had a case where a roaming user was connected to a public WiFi and got a certificate warning. The user saw the error and called me before connecting. Turns out the WiFi was doing SSL inspection. I was able to talk the user through the issue, and nothing was compromised.

However, it is easy enough for the user to click Yes and bypass the warning. I am concerned a less-savvy user will ignore the prompt, leading to a security breach.

Is there a way to block Outlook (and other Office clients like OneDrive for Business) from connecting if there is a certificate issue? I looked in Group Policy but did not find anything. Maybe I am missing it.

Note we are using Office 365 for e-mail, but I think this would apply to on-prem Exchange as well.

Background: I have a relatively small Active Directory domain (Windows 2003 Functional level) with two domain controllers, both running DNS servers. They are the primary and secondary DNS servers for the LAN. No other local DNS. I do not have any subdomains or recursion going on.

My Question: In the DNS Manager, under server Properties, Forwarders tab. Should I have my ISP's DNS servers listed here (or the Google ones)? Or should I leave the Forwarders tab blank and rely on the Root Hints servers?

I Googled before posting. About half the advice I read said the use the ISP DNS as forwarders, and half said to just use the Root Hints. So, I have no idea which is "best" for my setup (which I imagine is pretty typical for a small shop).

Background:

I have a domain (2003 Functional Level) with a mix of Windows XP and Windows 7 clients. We have been using Group Policy to manage our workstations.

Now, I am in a situation I need to apply different GPO Policies (not Preferences) based on some complex logic. I might be able to create multiple GPOs and do security/WMI filtering, but it's going to get messy. A script would be a much cleaner approach for us (PowerShell specifically).

What I want to do:

I want to use startup scripts to enable GPO Policies. It seems that my logon scripts could edit the contents of HKEY_LOCAL_MACHINE\SOFTWARE\Policies and HKEY_CURRENT_USER\SOFTWARE\Policies. These registry entries are well documented and setting them is pretty straightforward. I have seen plenty of cases of people doing this online, but I want to make sure this is a sane idea before I do it.

The PCs will still be joined to the domain, and there will still be some GPOs present (Default Domain Policy at the very least). So, conflicts with any existing policies is a possibility. I am expecting the following will happen:

• If the policy item is "not configured" in a GPO, there is no conflict. The registry value in my the startup script will be written and the policy will take effect.
• If the policy item is set to Disabled/Enabled in the GPO, it will collide with my script. The script may "win" at startup, but during background refresh it will get overwritten.

So, is my understanding correct? Is this an OK thing to do?

We recently added some hardware to our server room, and our 12000 BTU Mitsubishi Mr. Slim isn't cutting it (was undersized to begin with). Our humidity is also too low (~30%).

To meet our needs, plus have some margin for growth, we need about 36000 BTUs more cooling.

The room is relatively small (12ft x 12ft). We only have a single enclosed server rack (APC brand), but it is pretty well-packed with blade severs and SAN drives. There are also two open racks in the room for wiring and network switches, but the power requirements are pretty low there.

So, we are looking at cooling options. One of the suggestions on the table is APC InRow cooling.

Any experience with APC InRow cooling, particularly for a server room of our size?

How would you say the efficiency of an InRow system compares to a more traditional cooling system, like a portable Movincool A/C unit, or a larger Mr. Slim?

Any other options we should be looking at?

Specifically, I am asking about screwdrivers with removable tips (something like this), but I think the answer would apply to any magnetic-tipped screwdriver.

Will the magnetic field damage anything in the server?

I Googled this before asking, and the general consensus was "it won't hurt anything". However, the answers I found were from general PC guy forums, not the server community. Around high-dollar equipment, you certainly tend to be more careful!