TheCleaner's questions

I thought I knew how to do this, but I guess not.

Even the d2 debugging in nslookup doesn't show the actual forwarder being queried.

So...let's say I set up DNS forwarders in a Windows DNS server and then query using nslookup (or something else?) that server for an external FQDN like "www.purpleflowers.com".

Can I actually see where the Windows DNS server is querying its forwarder, which forwarder it ended up using, and the response from that forwarder?

In the spirit of asking a Good subjective question I bring this forth again, in hopes that ServerFault will continue to be a preferred "go to" when searching on this topic.

OLD REFERENCE

Back in 2011 this question was asked: Reasons Why In Place Upgrades Are Bad

THE QUESTION

Is doing an in-place upgrade of Windows Server x64 (2008 R2, 2012, 2012 R2) to a newer supported Windows Server version a good practice these days or no?

THE ANSWERS

Remember from the link above: Great subjective questions tend to have long, not short, answers. The best subjective questions inspire your peers to share their actual experiences, not just post a mindless one-liner or cartoon in hopes of being rewarded with upvotes for being merely "first."

I'm not talking about EFS or Bitlocker here.

I'm asking if there's a way to prevent files from being encrypted. I'm referring to some extent to ransomware, but specifically I want the following scenario:

• Windows File server w/ shares (on the E: drive)

I want a way to tell the above server "don't allow files on the E: drive to ever be encrypted by anyone or any software/process."

I can't find any way to do this at the NTFS level, short of "read" access. Modify access allows files to be encrypted.

I've searched around online but get a bunch of EFS/bitlocker/ransomware links that have nothing to do with my question at hand.

So fellow experts. Any way to do the above in bold? I'm not asking about ways to prevent ransomware, etc. The bolded area is specifically what I'm after.

I'm a little stumped on this one so I'm hoping someone can enlighten me, since I consider myself a pretty knowledgeable GPO person.

I have a login banner GPO that changes the Interactive Logon: settings within Computer Configuration - Policies - Windows Settings - Security Settings - Local Policies / Security Options - Interactive Logon in order to display a login banner. That is the ONLY thing this GPO does.

NOW, my understanding from Technet and others online, along with my own past experiences is that you configure this in a GPO that is applied/linked to the domain level.

However, here at my current company our "LogonMessage GPO" is applied/linked to the Domain Controllers OU ONLY, and sure enough this GPO does apply to all computers in the organization.

I ran a rsop.msc for instance on my workstation and it shows it as the Source GPO for that setting, even though my workstation obviously is NOT in the Domain Controllers OU.

So what gives? Why does applying a login banner GPO to the Domain Controllers OU apply it to all computers in the domain?

We had a user run a robocopy command to copy some files but unfortunately the user accidentally messed up the syntax.

Something like:

robocopy "\\server1\share\Accounting" \\server1\share\NewAccounting" /E /X /COPYALL /TEE

Which without the proper quote on the destination directory ended up screwing up the rocobopy destination as follows:

Started : Tue May 05 12:30:00 2015

Source : \\server1\share\Accounting

Dest : \\server1\share\NewAccounting \E \X \COPYALL \TEE\

Files : *.*

This ends up creating new folders "E", "X", "COPYALL", "TEE" all without NTFS security.

The folder security tabs show "The requested security information is either unavailable or cannot be displayed." and you cannot delete the folders via Windows Explorer or normal command line.

The server in question happens to be an EMC Celerra CIFS server.

Any ideas how to clean this up and remove the invalid new destinations?

I'm in need of auditing the number of Office installs each user has installed as well as the computer names where Office Pro Plus has been installed.

I had never noticed a place to run such a report in the past, but figured there might be one. To my surprise I couldn't find anything in the admin portal.

Then I saw this blog post: Managing Office 365 ProPlus installations: activating, deactivating, and reactivating which confirms my frustrations:

Only the signed in user can see this information. Even if you are the administrator for your organization's Office 365 subscription, you can't see this information in any of your Office 365 administrative views. This also means you can't deactivate a user's installation of Office on a specific computer.

I understand well enough how Office Pro Plus activation/expiration works on Office 365:

When a user installs Office on a computer from the Office 365 Portal, and if the user hasn't already installed and activated Office on five other computers, Office is automatically activated. Once the Office installation is activated, the software page in the Office 365 Portal is updated with the name of the computer on which Office was installed.

Every day or every time you launch an Office 365 ProPlus application, it will check whether the individual installation or account has been deactivated. The computer needs to be connected to the Internet at least once every 30 days so that this check can be made. If the computer isn't connected to the Internet within 30 days, Office will end up in reduced functionality mode. In reduced functionality mode, the user will only be able to open and view existing Office files, but will not be able to use most of the other features of the application.

However, I can't seem to find any way of reporting each user's Office installs/activations short of having them show me via their portal login.

So, I'm not hoping too much on this, but maybe one of the MS Office 365 partners/vendors out there has managed to create something to gather this information?

P.S. I'll open a ticket with O365 support as well to ask them...but this seems like something that should be documented here on ServerFault for others to reference.

In Office 365 you can toggle a few settings to help with spam email filtering.

Among these is a setting to enable a "Sensitive Word List" as shown below:

The problem is...I can't find any list on Technet or elsewhere online showing what this list actually contains. It isn't editable, and isn't accessible via Exchange Online's Powershell either.

I even ventured the thought that this list was carry over from Forefront but still can't find an actual list.

So...does anyone actually know what is included in this list?

There are a few questions that I've found on ServerFault that hint around this topic, and while it may be somewhat opinion-based, I think it can fall into that "good subjective" category based on the below:

Constructive subjective questions:

* tend to have long, not short, answers
* have a constructive, fair, and impartial tone
* invite sharing experiences over opinions
* insist that opinion be backed up with facts and references
* are more than just mindless social fun

So that out of the way.

I'm helping out a fellow sysadmin that is replacing an older physical server running Windows 2003 and he's looking to not only replace the hardware but "upgrade" to 2012 R2 in the process.

In our discussions about his replacement hardware, we discussed the possibility of him installing ESXi and then making the 2012 "server" a VM and migrating the old apps/files/roles from the 2003 server to the VM instead of to a non-VM install on the new hardware.

He doesn't perceive any time in the next few years the need to move anything else to a VM or create additional VMs, so in the end this will either be new hardware running a normal install or new hardware running a single VM on ESXi.

My own experience would lean towards a VM still, there isn't a truly compelling reason to do so other than possibilities that may arise to create additional VMs. But there is the additional overhead and management aspect of the hypervisor now, albeit I have experienced better management capabilities and reporting capabilities with a VM.

So with the premise of hoping this can stay in the "good subjective" category to help others in the future, what experiences/facts/references/constructive answers do you have to help support either outcome (virtualizing or not a single "server")?

I've run chkdsk /F many times over the years...and today I had to run it on one of my 2008 R2 servers and I get the normal message:

Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts? (Y/N) y

This volume will be checked the next time the system restarts.

I've looked at the Technet doc here: http://technet.microsoft.com/en-us/library/cc730714.aspx as well as normal google searching and searching on Technet and site:microsoft.com on google, but can't find what I'm looking for...

The Question:

HOW/where does Windows schedule this on restart? It isn't in Task Scheduler or RunOnce or similar, which makes sense if it needs to run before Windows locks the volume...so where exactly does Windows set this "scheduled task" to occur so that the server knows about it even a week later during a maintenance window reboot?

Taking a spin off of this question: Do I really need MS Active Directory? in a new direction for 2014.

Taking into account a basic Windows infrastructure:

• domain controllers
• Exchange 2007/2010/2013
• Sharepoint
• SQL
• File Servers / Print Servers
• AD Integrated DNS
• AD authenticated 3rd party devices (let's say 802.1X for networking and maybe some content-filtering, etc.)
• AD/LDAP authenticated "administrative" functions on IT apps/hardware/etc.
• perhaps some KMS stuff
• throw in a CA if you'd like
• home grown apps
• 3rd party in-house apps

Now, let's rip it all out and decide we are going to the cloud. We've contracted to move Exchange/Sharepoint/File Services to Office 365. SQL will now be hosted as well on something like Azure. We've gotten away from the need for AD-DNS and simply run everything via a simple Windows DNS server. We still need 802.1X and would like SSO if possible to our various cloud apps. Home grown and 3rd party in-house apps would likely stay, but have the ability to use internal user databases instead of AD authentication

The question is...do we really need Active Directory at all?

Or more to the point, AD on-premise or even hosted via Azure or similar (ADFS) or running ADDS on a hosted VM through Azure or similar. Could/Should we look to something else like a 3rd party SSO option such as http://www.onelogin.com/partners/app-partners/office-365/ or similar that can provide SSO functionality even if it is as simple as LastPass or similar for each user?

What kind of legitimate needs does AD fulfill if everything else in the cloud?

Could a MS-centric infrastructure get away with not having AD at all if they move everything that previously relied on AD to SaaS offerings that didn't rely on AD authentication?

BACKGROUND/RESEARCH

I honestly believe that questions like this one: Using GPO in Active Directory domain to force workstations Windows Firewall to disabled - how? existed because Windows Admins in general were taught long ago that:

"the easiest thing to do when dealing with a domain computer is to just have a GPO on the domain to disable the Windows Firewall...it will cause you much less heartache in the end." - random IT instructors/mentors from years gone by

I can also say that at MOST companies I've done side work for this has been the case, where a GPO at a minimum disabled the Windows Firewall for the domain profile and at WORST disabled it also for the public profile.

Even further, some will disable it for the servers themselves: Disable firewall for all network profiles on Windows Server 2008 R2 through GPO

A Microsoft Technet Article on the WINDOWS FIREWALL recommends you DO NOT disable the Windows Firewall:

Because Windows Firewall with Advanced Security plays an important part in helping to protect your computer from security threats, we recommend that you do not disable it unless you install another firewall from a reputable vendor that provides an equivalent level of protection.

This ServerFault question asks the real question: Is it alright to turn off firewall in a LAN using Group Policy? -- and the experts here are even mixed in their view.

And understand I'm not referring to disabling/enabling the SERVICE: How can I back up my recommendation to NOT disable the Windows Firewall service? -- so as to be clear that this is about whether or not the firewall service enables the firewall or disables it.

THE QUESTION AT HAND

So I get back to the Title of this question...what can be done to properly re-enable the Windows firewall on a domain? Specifically for client workstations and their domain profile.

Before simply switching the GPO from Disabled to Enabled, what planning steps should be taken to ensure that flipping the switch doesn't cause critical client/server applications, allowable traffic, etc. to suddenly fail? Most places won't tolerate the "change it and see who calls the Helpdesk" mindset here.

Are there checklists/utilities/procedures available from Microsoft to handle such a situation? Have you been in this situation yourself and how did you deal with it?

Warning, subjective question ahead! But hopefully a good one that won't get closed.

SCENARIO:

I have a branch office that currently has no on-premise server. They access everything including a DC across a 12Mbps WAN link (MPLS). The link isn't saturated, averaging around 20% utilization. The circuit is very stable and has a high SLA and excellent uptime.

However, large file transfers (mainly reads, not writes) from the file server across the WAN can be slow. We don't currently utilize DFS.

RESEARCH DONE:

I'm aware of WAN acceleration, using either dedicated hardware (Riverbed) or a dedicated software VM (Silver Peak) for example. But the pricing is outside of our current budget and the need isn't quite there yet from our perspective (since the issue is mainly in a "pull" scenario not necessarily push/pull).

I'm mainly looking at deploying a Windows server at this branch office and either utilizing DFS-R or BranchCache. Looking at a table comparison and assuming we are looking at a "hosted branchcache server" and not simply distributed:

It would appear there are benefits to both, even if both are "hosted" on a server.

QUESTIONS I ACTUALLY HAVE:

• In what scenarios do each of these techs shine and where do you choose one over the other?
• Looking at a hosted Branchcache server, can you set "pre-fetching" of certain folders/files on the central file server so that they are immediately accessible locally at the branch? Do you have to do this on a schedule (if it is possible)?
• Looking at DFS-R my concern (and apparently solved with 3rd party apps) is file locking and making sure the file gets updated properly during a write operation (ie, making sure if both copies are accessed and both are written to, which file takes precedence and what happens to the changes?). Ideal it would seem would be to lock any alternate replicas of the data, but is it really that big of an issue?
• Does Branchcache lock the central file for editing?
• Does branchcache only transmit the deltas back to the central file of what has changed?
• Would either technology be ill advised if the branch office server was going to be utilized as a domain controller as well?

SCENARIO

To simplify this down to it's easiest example:

I have a Windows 2008 R2 standard DC with the DHCP server role. It hands out IPs via various IPv4 scopes, no problem there.

WHAT I'D LIKE

I would like a way to create a notification/eventlog entry/similar whenever a device gets a DHCP address lease and that device IS NOT a domain joined computer in Active Directory. It doesn't matter to me whether it is custom Powershell, etc.

Bottom line = I'd like a way to know when non-domain devices are on the network without using 802.1X at the moment. I know this won't account for static IP devices. I do have monitoring software that will scan the network and find devices, but it isn't quite this granular in detail.

RESEARCH DONE/OPTIONS CONSIDERED

I don't see any such possibilities with the built in logging.

Yes, I'm aware of 802.1X and have the ability to implement it long-term at this location but we are some time away from a project like that, and while that would solve network authentication issues, this is still helpful to me outside of 802.1X goals.

I've looked around for some script bits, etc. that might prove useful but the things I'm finding lead me to believe that my google-fu is failing me at the moment.

I believe the below logic is sound (assuming there isn't some existing solution):

1. Device receives DHCP address
2. Event log entry is recorded (event ID 10 in the DHCP audit log should work (since a new lease is what I'd be most interested in, not renewals): http://technet.microsoft.com/en-us/library/dd759178.aspx)
3. At this point a script of some kind would probably have to take over for the remaining "STEPS" below.
4. Somehow query this DHCP log for these event ID 10's (I would love push, but I'm guessing pull is the only recourse here)
5. Parse the query for the name of the device being assigned the new lease
6. Query AD for the device's name
7. IF not found in AD, send a notification email

If anyone has any ideas on how to properly do this, I'd really appreciate it. I'm not looking for a "gimme the codez" but would love to know if there are alternatives to the above list or if I'm not thinking clear and another method exists for gathering this information. If you have code snippets/PS commands you'd like to share to help accomplish this, all the better.

OK, before you get all "OFF TO SUPERUSER WITH YOUR ISSUE!", they specifically state in their Help pages: "NOT about issues specific to corporate IT support and networks", and since this is a corporate network I'm dealing with and I'm the IT manager/sr.admin, well there you go...and yes I feel silly being unable to figure this out myself, but like TLC I ain't too proud to beg. Disclaimer done.

ISSUE

I've been getting this message lately "could not reconnect all network drives" upon a reboot of my Win 8 Pro laptop (example image below):

TROUBLESHOOTING

Yet, when I check both the Explorer GUI (clicking the "click here to check the status of your network drives") and the cmd line "net use" commands, the proper drive mappings are there.

I've also checked the registry under HKEY\CURRENT USER\Network and find the correct mappings.

I see no events in the application, security, or system event logs to correspond to the "error" message.

It appears to me that nothing is wrong.

NOTE: I do know that the same message will appear when I'm "off the corp network", for instance when I'm booting up my laptop at home. I get that...but this is when I'm hardwired into the network and have network connectivity (proven via one of the servers able to ping my laptop and run mgmt tools on it before I log in).

QUESTIONS

So I guess the real questions are:

1. Is this error message valid at some point? Maybe it is displaying it a split second prior to the drives getting connected for some reason? Is there a way to troubleshoot it and figure out what it is really squawking about?
2. Barring #1 even being possible, can I simply suppress the message period? I don't really care about it to be honest, so not seeing it won't cause me any grief.

This has bothered me over the years and I'm dealing with it again now. I've never quite understood the full black magic that is Shadow Copies/VSS. I get it to the extent of what it does and how to initially set it up and set the schedules on the volumes. I also understand its role in backups.

Scenario

To simplify it, I'll stick with a single volume in my environment. I have the following schedules enabled:

1 - M-F 7am starting on 4/14/13
2 - M-F 12pm starting on 4/14/13
3 - 1st day of the month at 9am starting on 6/11/13

The Use limit for that volume's shadow copies is 25,599MB (25GB).

The volume is 250GB and has 44GB of free space.

Going backwards from today I show all the correct times/schedules for shadow copies back until 7/29/13. It doesn't go back further, and there isn't a 7/1/13 monthly copy.

I'm pretty sure I remember reading there is a 64 copy limit before the oldest gets overwritten. This makes sense since I count exactly 64 copies currently in the list.

My Questions

1. Is there a way to change this 64 copy limitation?
2. Can I prevent monthly copies from being overwritten somehow and let it overwrite just the "dailies" instead?
3. Does MS or others provide a way to manage shadow copies in a more granular fashion than the basic scheduling on the volume, etc. that I've already done above? ie. the ability to tell it "keep only the previous 4 weeks of this schedule" or similar.

My goal is to get to a point where i can have 12 "monthlies" and the previous month twice "dailies" (for a total roughly of 72 copies it would seem).

I have "real backups" using Commvault Simpana but it's so much easier to deal with a restore from shadow copies for simple file shares.

TL:DR? Fine...here:

Short of hiring or outsourcing to a Tech Writer, are there basic standards/conventions/practices that Technical Writers employ in their trade that can be learned from in order to create proper IT documentation and maintain that documentation over time?

While writing various documentation for both internal IT usage and external use by our employees, it has become clear that our employees all have their own style when it comes to the documentation.

Pulling from our Quality documents and controlled documentation, IT has utilized various templates for SOPs, WI's, and various forms used for IT quality docs. These docs, while not necessarily that useful for day to day operations within IT do help employees and the company with IT HR issues, compliance, etc. and are typically well written, well defined, and follow at least the Quality dept.'s templates and documentation standards (like versioning, ECNs, etc.)

But our actual IT document writing is still lacking a true convention/standard. Some will use 3rd party tools like ScreenSteps, others simply use Word and create a simple outline like:

1. Open app
2. Click on `Start Global Thermonuclear War"
3. ...
4. Profit

Internal IT documentation is actually worse, based on whatever the employee or consultant felt was sufficient at the time to either jog their own memories or was based in their editor of choice (vi, word, excel, powerpoint, napkin, internal wiki). The problem comes when an employee leaves or is on vacation and a scramble is made to figure out even basic information. At times only the file date is an indicator of whether the data is still relevant or not.

While a simple outline, actual screenshots, or even full on HD video are all well and good, we don't have an actual IT Technical writer on staff and can't help but think we are lacking in this area.

Could we make up our own standards for our documentation along with approved templates? Yes, but why re-invent the wheel? If such standards and conventions already exist within the Technical Writer's "guild" we would be better served to follow those conventions so that our documentation is clear, concise, and professional.

To avoid being told "Google It", I did look at sites that showed some formatting practices and while this SF Q: IT Documentation Platforms helps with finding platforms and software to handle the writing, it doesn't discuss if there truly are standards within the industry.

So, short of hiring or outsourcing to a Tech Writer, are there basic standards/conventions/practices that Technical Writers employ in their trade that can be learned from in order to create proper IT documentation and maintain that documentation over time?

TL;DR

Is there a way via script, powershell, reg delete, via telekinesis, whatever to reset Outlook 2013 as if no profiles ever existed and it was running for the first time ever?

Still working through this one but hoping others have insight.

SCENARIO

Lots of users here have existing Outlook profiles connecting to an on-premise Exchange server. We are in the middle of our migration to Office 365. In order to migrate the user's Outlook you have to either create a new profile in Outlook or delete the old profile completely and then "start fresh".

We want our users to start fresh and have the default profile name of "Outlook" for their mail profile (instead of something custom or a 2nd profile like "O365"). This is because our ERP system looks for this profile to send email while in the ERP software.

PROBLEM

The problem is "starting fresh" isn't really starting fresh.

If I manually remove the default profile "Outlook" from the Mail control panel settings, then Outlook starts up without a profile but prompts for a profile name:

If I type Outlook as the new Profile name now I get:

If I go into REGEDIT and look in:

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

I still see "Outlook" as a profile.

I tried doing a Reg DELETE of this key and all sub-keys and while it says "successfully deleted" it doesn't.

If I manually delete this profile key I can then start Outlook again and when it prompts for a new Profile name I can put in Outlook and it will take it and let me continue as if it is a new setup of Outlook:

It doesn't appear from the command line switches for Outlook 2013 (found here) that the /cleanprofile is still around.

BOTTOM LINE QUESTION

Is there a way via script, powershell, reg delete, via telekinesis, whatever to reset Outlook 2013 as if no profiles ever existed and it was running for the first time ever?

Beyond the work done "inside" equipment (administration, programming, network config) there exists physical equipment and rooms. This physical room equipment needs care and feeding as well on a routine basis.

So, the question is, for a generic data center (insert server room, comm closet, etc.) with servers, racks, networking equipment, etc., what routine maintenance should be done in regards to the room itself?

I found the list here:

http://www.sflow.org/products/collectors.php

But was wondering if there are open source projects like Zenoss or others that can do SFlow collection and reporting for more than a 24 hour time period?

I did see that Zenoss has partnered with someone for a free one and will test that one out but wondered if there were any others out there that had some decent graphical views and maps and weren't impossible to setup.

Yeah, I can fire up a VM or remote into something and try the password...I know...but is there a tool or script that will simulate a login just enough to confirm or deny that the password is correct?

Scenario:

A server service account's password is "forgotten"...but we think we know what it is. I'd like to pass the credentials to something and have it kick back with "correct password" or "incorrect password".

I even thought about a drive mapping script with that user account and password being passed to see if it mapped the drive successfully or not but got lost in the logic of making it work correctly...something like:

-Script asks for username via msgbox -script asks for password via msgbox -script tries to map a drive to a common share that everyone has access to -script unmaps drive if successful -script returns popup msgbox stating "Correct Password" or else "Incorrect Password"

Any help is appreciated...you'd think this would be a rare occurrence not requiring a tool to support it but...well....