Johannes Linkels's questions

I am trying to trace back where a certain policy value was set. So I can change it. For example, when I run in the user session

 GPResult /v /r 

I get this output:

Administrative Templates
-------------------------
<snip>
 GPO: MyCompany - RDS User Policy
Folder Id: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
            Value:       1, 0, 0, 0
            State:       Enabled
<snip>

When I edit the policy "RDS User Policy" in Group Policy Management Editor, I expect to find this setting somewhere.

Most likely in the tree User Configuration -> Policies -> Admimistrative templates. Now it seems that there are a few hundred active settings, but no one remotely matches this Folder ID.

How do I match this folder ID to a policy setting which I can edit and change?

The customer has a W10 laptop. The laptop is member of MyDomain. The user has 20 network drives mapped onto his laptop. The server is W2016 Domain Controller.

The user logs in on his laptop using his LOCAL account. When he arrives at the office in the morning all his network drives are not reconnected.

He gets the error message: "Drives could not be reconnected because the user account is locked"

Indeed in the W2016 security logs there are 5 failed logon attempts. After that the account is locked for 30 minutes. When, after 30 minutes the user clicks on the mapped network drive (which has a red cross), the mapped drive reconnects without a problem.

The credentials of the user for connection the network drive are local-computer\username. It is not MyDomain\username. I have checked this in PowerShell using the gwmi command.

The latter is surprising. I did not even know it was possible to use local credentials to connect to a domain share. But other tests in a test domain verified this. Only the user name must be known in the domain.

What I don't understand is why the first attempt to connect the network drives gives an authentication failure. And later the authentication succeeds. I don't know how much later as the account remains locked for 30 minutes anyway.

It is not a matter that reconnection should be delayed until the network is UP. It is up, because the server shows authentication failures.

My next approach is to change the credentials for connecting the drive to MyDomain\user instead of local-computer\user.

That is the most elegant solution. If that doesn not help I will make the connections non-persistent and create a batch file which is executed manually. But that is not as elegant.

I am reluctant to have to user log on onto the domain. First he can be away from the office quite some time, and has to rely on cached authentication. Secondly, his current user profile is 50GB and logging on to the domain creates a different profile. It is a pita to transfer that.

Any ideas as why the first authentication attempts fail? Knowing that they succeed later?

My customer complains about low internet speeds. When measured with Speedtest.net speeds are acceptable. Periodic measured downloads are 10% to 30% of the nominal speed. I cannot explain that.

Some background. The problematic connection is on one of those sunny Caribbean islands where fast internet is not the greatest asset. Lately internet speeds became decent, up to 200 Mbps. But ping round trip to (say) Amsterdam is about 180 ms.

The customer has a 100 Mbps fiber connection. When carrying out a speedtest on a Windows machine (speedtest.net) to the ISP CO we obtain 95 Mbps. When using the same speed test to Amsterdam we reach 60-70 Mbs. Fully acceptable.

Some time ago I installed a RasPi which periodically wgets a file from one of my servers in Amsterdam. In a datacenter, which is directly connected to AMS-IX. Using this command:

wget -O /dev/null --report-speed=bits http://aserv.example.net/~myuser/links/M77232917.txt

The .txt file is 23MByte of numbers. (Actually it is the one but largest Mersenne Prime, 23e6 digits)

When I download that file on the problematic network, wget reports this:

dev/null 100%[====================================================================>]  22.81M  11.6Mb/s   in 17s    

2019-02-08 14:27:55 (11.2 Mb/s) - ‘/dev/null’ saved [23923322/23923322]

That is at the same time speedtest.net reports 60-70 Mbps.

I know that the Raspi has its limitations. But this speed varies wildly. One time the RasPi report this 11 Mbps, the next time 22 Mbps. But sometimes as low as 1.5 Mbps.

When I do this test with a really powerful laptop, top speeds are somewhat higher (up to 30 Mbps), but also show the same lows. So it indicates a RasPi limitation on the high side, but not the 10 Mbps on the low side.

I issued exactly the same command from a server in München, Germany in a datacenter. Speed 96 Mbps.

Then from a consumer 100 Mbps fiber connection in the Netherlands: 65 Mbps.

Then, at my home which has nominal 10 Mbps ADSL. Speedtest shows 10Mbps. Wget gives 8.5 Mbps. Which is equal in my book.

This precludes any limitation on the server which acts as host for the file download.

I do not expect that anyone can point out the cause of the slowness of the connection at the customer premises. But can anyone explain the discrepancy between the speedtest.net and the wget?

Is there something the speedtest ignores, or does it measure only the peaks? Or is wget seriously influenced by long ping times?

I feel that the wget test gives the real, effective speed, while speedtest is mainly to show the advertised speed.

I am running a Postfix mail server for my client. Mail is relayed through Mandrill. Mandrill requires a valid DKIM signature.

This works all right for relayed mail. That is, mail sent through Roundcube (on the same host) works fine. Mail sent from Icedove (from client's machines) works fine.

But mail sent from the local host is rejected by Mandrill. Reason: "not signed". Sending from local host means here using the mail command, or Postfix itself. The latter is dramatic, mail sent by MAILER-DAEMON is also rejected.

What I know is that the sender's email address is reflecting correctly the domain. Using the wrong domain name also has Mandrill rejecting the mail for the same reason.

So for relayed mail, my sender address is [email protected]. For locally sent mail my address is also [email protected].

What I understand is that Postfix does not have to DKIM sign the mail which is relayed through Mandrill. Mandrill itself is fetching the DKIM from my DNS server.

Nevertheless, DKIM is set up properly in Postfix. When I send directly (not using Mandrill as relay host) my DKIM is valid. Disabling DKIM completely in Postfix does not make a difference for Mandrill.

I am not running DNS on this host, it is an external DNS. The domain is administered using Virtualmin.

I don't know where to start to look, so I did not include any configuration details yet. If you indicate which information is relevant, I'll post it.