Force Flow's questions

In a server 2008 R2 and Windows 7 environment, I have a GPO that specifies screen saver settings in the user settings policy for the entire domain. However, for specific computers, this is not ideal.

I created a separate GPO with higher precedence, enabled loopback with the replace setting, and specified the screensaver rules. In the security filter, there is only the specific computers the GPO should be applied to. However, as-is, this policy is never applied--gpresult /z indicates this under user settings for the GPO: "Filtering: Denied (Security)".

If I add the "domain users" to the security filter, then the GPO is applied to all users in the domain, regardless of which computer they are using.

How can I apply the GPO to any user who logs into only specific computers?

Applying the GPO to OUs are not an option, unfortunately, since the computers are already sorted into various OUs for other things.

[edit]: In the security filter, I tried:

• adding only the computer to the security filter; results in GPO denied under user settings.
• adding the computer to the security filter, and adding "domain users" to the security filter; results in the loopback GPO being applied to all users, regardless of which computer is used.
• adding the computer to a security group, adding that security group to the security filter; results in GPO denied under user settings.
• adding the computer and "domain users" to the same security group, and adding that security group to the security filter; results in the loopback GPO being applied to all users, regardless of which computer is used.
• adding the computer to a security group, adding that security group to the security filter, and adding "domain users" to the security filter; results in the loopback GPO being applied to all users, regardless of which computer is used.

What other options are there left to try?

Is there a way to specify whether the items in the security filter can be combined using "and" rather than "or"?

I have a Windows Server 2008 R2 Server (Server A) running as a domain controller with Active Directory, Group Policy, and DNS services.

I set up a second Windows Server 2008 R2 server (Server B), added it to the domain, and installed the Active Directory, Group Policy, and DNS Roles.

If I take Server A offline, then Active Directory and Group policy services are no longer available on Server B.

What would I need to do in order keep AD & GPO services operating while one server or the other is offline?

[edit]: Would I possibly need to do something involving dcpromo.exe on Server B? If so, what might that be?

How can I get an application's GUID from an MSI file without installing it and searching for it in the registry? Is the GUID located in the MSI's properties? Or, can I retrieve it using Orca?

I update flash using MSI files installed by group policy. However, with every update, about a third of the workstations fail to update (Windows Vista and Windows 7 32/64-bit editions). In the event logs, this message appears:

"Adobe Flash Player 11 ActiveX -- Error 1714.The older version of Adobe Flash Player 11 ActiveX cannot be removed. Contact your technical support group. System Error 1612."

The only way I've been able to address the issue is to use the Microsoft Fit It tool. However, it's a very time consuming process, which takes about 15 minutes to mannually perform for each workstation, so it effectively kills a whole day every time a flash update comes out.

I came across this script which includes MSIZAP to remove failed uninstallations of flash. So, my question is: is the MSIZAP utility the best approach for removing flash programmatically, or is it obsolete at this point? The reason I ask is that most of the written materials that I've found on the subject are from 2009 or 2010.

@echo off
SET MSIZAP=\\my.domain.com\netlogon\bin\msizap.exe
SET DFSPATH=\\my.domain.com\dfsroot\Packages\Adobe

SET UNINSTALL=%DFSPATH%\uninstall_flash_player_x86.exe
SET INSTALL=%DFSPATH%\install_flash_player_11.4.402.278_active_x.exe 

rem Detect 64-bit Windows
IF NOT "%ProgramFiles(x86)%"=="" SET WOW6432NODE=WOW6432NODE\

SET VER_FLAG_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\%WOW6432NODE%Macromedia\FlashPlayer
SET VER_FLAG_VALUE=11,4,402,278

REG QUERY "%VER_FLAG_KEY%" /v CurrentVersion | find /i "%VER_FLAG_VALUE%" > NUL 2>NUL
if errorlevel 1 goto do_install
goto :EOF

:do_install
rem Uninstall all old versions of Flash.
start /wait /min "" "%UNINSTALL%" -uninstall activex

rem MSIZAP all old versions
start /wait /min "" "%MSIZAP%" TW! {2BD2FA21-B51D-4F01-94A7-AC16737B2163}
start /wait /min "" "%MSIZAP%" TW! {B7B3E9B3-FB14-4927-894B-E9124509AF5A}
start /wait /min "" "%MSIZAP%" TW! {FA1D6742-0515-4A94-AD5D-F0484026E4A2}

rem Run new installer
start /wait /min "" "%INSTALL%" -install activex

rem Block future automatic updates
SET DEST="%windir%\system32\Macromed\Flash\mms.cfg"

rem Detect 64-bit Windows
IF NOT "%ProgramFiles(x86)%"=="" SET DEST="%windir%\SysWOW64\Macromed\Flash\mms.cfg"

rem I'm using "sort" here because the redirect is being interpreted as "1>" and
rem doing "1 >" causes a space to be stored in the file, which "breaks" the file.
echo AutoUpdateDisable=1|sort>%DEST%

Source: I deployed Flash Player via a Software Installation policy. How to upgrade?

At one time, I had the Software Installation feature in GPO set to install the Java 7 update 11 MSI installer. Then, I removed it with the removal method "immediately uninstall the software from users and computers".

Now, I have a windows 2008 R2 server that gets stuck on "removing managed software java 7 update 11".

Normally, I would bypass this by unplugging the network connection, doing a hard reset, starting back up, then running the Microsoft Fix It tool to remove any remnants of Java. However, the Fix It tool won't run on this operating system.

If I try to reinstall Java by running the MSI file, I get the message:

User 'SYSTEM' has previously initiated an install for product "Java 7 update 11'. That user will need to run that install again before they can use that product.

Error 1704. An installation for Java 7 update 11 is currently suspended.

If I run the installer a second time, it installs, and I can uninstall it from "programs and features" in the control panel.

However, at startup, I still get stuck on the "removing managed software" message.

What can I do? Can I cancel the uninstallation somehow? Or manually remove Java? (The JavaRa tool didn't work).

[edit]: Would this be an appropriate next step?

enter regedit and find navigate to the following:

HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Appmgmt

Then find the correct key, this is easy to do by looking at each key’s “Deployment Name“. Once you have found the correct key simply delete it and reboot. The computer will boot normally now and you can then remove the offending software via Control Panel.

Source: http://philipwilmot.co.uk/blog/2009/12/remove-failed-removal-of-deployed-software/

I have two WAP4410N wireless access points powered using Power-Over-Ethernet.

They are both connected to the same LAN and broadcasting the same SSID with a WPA2 password.

One is using channel 1, while the other is using channel 11.

There is coverage overlap where the signal from both access points hover around -75db to -85db while standing in the same physical location.

DHCP is disabled, and is being provided by another network device.

Every day or so, devices can connect and authenticate to the access points, but are not granted an IP address (and subsequently are unable access to the LAN or Internet). For devices that had already retrieved an IP address prior to the issue exhibiting itself, the devices simply stop communicating with LAN and Internet.

However, I can still access each access point's web admin interface from the LAN.

If I reboot both devices, the problem vanishes and devices are once again able to get an IP address and connect to the LAN and Internet.

Are these symptoms of signal interference between the two WAPs or is this a completely different issue?

What is the proper procedure for distributing software updates using group policy's software installation feature?

For example, if I want to install Java, and Java 1.7u6 is already added as a package, should I:

A) Remove the Java 1.7u6 package (selecting the "allow users to continue to use" option), and add Java 1.7u7?

B) Add Java 1.7u7 and specify that it is an update to the existing 1.7u6 package? (Will this install the oldest version first, then install each update one after the other, or will it just install the latest package?)

Note that this question is geared toward the operation of the software installation feature of group policy, not specifically the behavior of the Java installers. This could easily apply to the installation of Adobe Flash, Adobe Reader, or any other common software applications with frequent updates.

I have a single windows 2008 server running active directory, group policy, and DNS. DHCP is running from the firewall (this is because there are multiple branch locations, and each location has its own firewall supplying DHCP. But, for this problem, the server and workstation are at the same location).

On an XP workstation, if I try to visit \\domain.local or ping domain.local, the workstation can't find it. A ping returns Ping request could not find host domain.local.

If I try to visit \\server or \\server.domain.local or ping server or server.domain.local, I'm able to connect normally.

If I ping or visit domain.local on the server, I'm able to connect normally.

A-Records are in place in the DNS service for server, domain.local, and server.domain.local. A reverse lookup zone also is enabled and PTR records are in place.

If I wait 20-30 minutes, I am eventually able to ping and visit domain.local--but, when attempting to ping, it takes 30 second to return an IP address.

I am also unable to join a new workstation to the domain during this wait period. If I try, the error message returned is "network path not found".

Is there something I'm missing?

I'm running Windows Server 2008 and Windows XP clients attached to the domain.

The local user has a background image specified, which I am trying to override with a GPO.

I attempting to set the desktop wallpaper by using a GPO to copy the image file to the local workstation in computer configuration\preferences\files

action: create

source file: \\mydomain.local\NETLOGON\wallpaper\background.bmp

destination file: c:\scripts\wallpaper\background.bmp

Then, setting the wallpaper in user configuration\administrative templates\desktop\desktop with the setting desktop wallpaper

wallpaper name: C:\scripts\wallpaper\background.bmp

wallpaper style: centered

I am able to see the default wallpaper briefly after logging in, but then it disappears and I'm left with a blank background.

The image file is available on the server, and is successfully copied to the local workstation.

The Client side extensions update is installed on the workstation and other user-based GPO settings are working.

Here are all the settings in the desktop GPO:

Am I missing something?

I'm attepting to install the adblock chrome extension using Google's Chrome ADM's.

User Configuration/Policies/Classic Administrative Templates/Google/Google Chrome/Extensions

Configure the list of force-installed extensions

On the list I have the extension's ID and update URL, which google alludes to in their documentation here and here:

gighmmpiobklfepjocnamgkkbiglidom;https://clients2.googleusercontent.com/crx/download/OAAAAMcNmg40_PduZlM3g5RwKyephtivPe8WdfQvWSRvhiHzrcK7rq-gXuF37bTwLfLPyVSTPaQkAXkHIklkQOFOqzUAxlKa5asxHnxnSbCB7xq3hVhoYHdhKQHD/extension_2_5_38.crx

I managed to get the update URL using the instructions in this question, but so far, I have been unsuccessful in that the extension is not actually getting installed.

Is there something I'm missing or doing incorrectly?

In Windows 7, if I go to control panel > user accounts > user account > manage your credentials, there are credentials saved for the local user.

Is there a way to add a generic credential using group policy on server 2008?

We use a hosted exchange service.

When users want to set up Outlook 2010 to access their account, they open Outlook and run through the configuration steps.

Autodiscover is enabled, and in the user's active directory profile, their email address is in the email field.

However, when the configuration process reaches a point where they are prompted for their email account's username and password, their active directory username is filled in by default instead of their email address. Is there a way to fix that?

Users get confused and try to enter their email password over and over again and wonder why it doesn't work (and completely miss/ignore the "use another account" button even though they have instructions right in front of them).

I'm also using the Office 2010 ADM's in group policy, but I haven't yet seen an option to specify what gets auto-populated in that windows security prompt.

I have two VLANs on my network. VLAN 100 for users in the office, and VLAN 10 for visitors/guests. Neither VLAN has access to the other, and each has its own internet connection. However, I want to set up a hyper-v server to control the public workstations on the guest network (VLAN 10).

On the physical server, I have two NICs which are teamed using BACS4.

I want to allow VLAN 100 full access to the server. I do not want VLAN 10 to see the physical server at all--just the hyper-v VM.

Currently, the switch ports are configured for link aggriation and are in access mode for VLAN 100.

I've tried all sorts of combinations and procedures, but have not had any luck getting everything working properly.

Here's what I've tried, which seems to be the closest that I've gotten:

1. Add two VLAN NICs to the team (VLAN 100 and VLAN 10)
2. Change the switch port mode to trunk and add VLAN 100 and VLAN 10)
3. In hyper-v, create a new external virtual adapter using the VLAN 10 virtual NIC.

Under these conditions, the physical server is available to the VLAN 10 network.

These is some sort of glitch in hyper-v where I can sometimes get the "enable virtual LAN identification for management operating system" option available. If I enable that and set the VLAN ID to 10, the hyperv adapter throws an error message and fails to be created.

What is the correct approach for setting this up?

I'm using a logon batch script to copy some dll files into the c:\windows\system32 folder and register them with the regsrv32 command.

However, both actions fail.

I'm applying the script here: user configuration\policies\scripts (logon/logoff)/logon

The script itself does get executed. However, it just doesn't perform anything that requires admin credentials.

How can I fix this?

I have two domain controllers set up something like this:

ServerA.mydomain.local: 10.10.10.2 (Windows Server 2008)
ServerB.mydomain.local: 10.10.10.3 (Windows server 2008 R2)

For login scripts and the like, I use the path: \\mydomain.local\netlogon

This seems to always default to ServerB. If I turn off or restart ServerB (a process which takes several minutes), attempting to visit \\mydomain.local does not flip to ServerA. If I ping mydomain.local, it always returns the IP address of ServerB, even when it has been turned off.

I thought this was supposed to be a round-robin system.

Why am I seeing this behavior, and how can I fix it?

Which is the correct place to enable windows services through GPO on Windows Server 2008? The domain has computers running XP, Vista, and 7.

Computer Configuration > Policies > Windows Settings > System Services

or

Computer Configuration > Preferences > Control Panel Settings > Services

What is the difference between the two?

When using the CLI of cisco devices, there is the "logging syncronous" command that keeps the log messages from interrupting the command prompt. Do Dell PowerConnect switches have a similar command somewhere?

I've been debating with myself about the best place for hosting a LAN's DHCP services. I have the option of either on a sonicwall firewall or a Windows 2008 server.

The two things I was looking for in addition to just handing out IP addresses were assigning a small handful static IPs through DHCP (for printers and other various network devices), and assigning three DNS servers (The server's DNS IP, and two DNS IP's from the ISP). Both the firewall and server have these features.

I reboot the server about once a month for maintenance purposes (windows updates, installing software, swapping hardware, etc). The firewall is rarely rebooted.

The number of DHCP leases doesn't generally go above 50.

What are the pros and cons of hosting DHCP services in one spot or the other?

I have a number of USB-powered external hard drives I was going to use for server backups for my Windows 2008 server.

I tested Windows Server Backup, and it seemed to back up fine. However, since I'm concerned about security and the possibility of someone else potentially having access to the drive, I wanted to encrypt it. TrueCrypt seemed a logical choice over BitLocker, since I could always have a copy of TrueCrypt available for recovering data, unlike BitLocker, which would only be available on the Windows 2008 server (I do not have Windows 7 Enterprise available).

I went ahead and encrypted the drive with TrueCrypt, and attempted to back up to the new encrypted volume, but Windows Server Backup threw an error on the last step: "An error occurred while creating diff area file on the backup destination volume. Catastrophic failure."

Is there a way to log into Windows using a USB stick? (on Windows XP/7)

I have student workers whom I would like to give admin rights for maintenance, but I would like to refrain from giving out a password for various reasons (students joining and leaving the staff, students writing them down and losing them, etc). This would also allow me to keep track of who and when a student worker is allowed admin access.