TechGuyTJ's questions

Currently, I have 2 GPO's in play for a new machine I just added to the domain. The second GPO (stagingGPO) is not showing up in the gpresult /r. The First (Power SettingGPO) is the only result in the report. However, when I check the local Policy settings for the StagingGPO they are set correctly on the newly added PC. The first GPO did have Loopback Processing set, I have set this back to the default of Not Configured. I ran gpupdate /force and then gpresults with the same results. Why would the StagingGPO not show in the results of gpresults?

Edit: Here is a screenshot of the RSOP for one of the Settings.

Here is also the output from gpresult /r /v why are they different than what is displayed on screen.

Microsoft (R) Windows (R) Operating System Group Policy Result tool v2.0 c 2016 Microsoft Corporation. All rights reserved.

Created on 1/11/2017 at 2:12:46 PM

RSOP data for DOMAIN\xxxxxxxx on WKST02 : Logging Mode

OS Configuration: Member Workstation OS Version: 10.0.14393 Site Name: Default-First-Site-Name Roaming Profile: N/A Local Profile: C:\Users\xxxxxxxxxxx Connected over a slow link?: No

COMPUTER SETTINGS

CN=WKST02,OU=Staging,DC=xxxxx,DC=xxx
Last time Group Policy was applied: 1/11/2017 at 1:44:59 PM
Group Policy was applied from:      dc2.xxxxxx.xxxxxx
Group Policy slow link threshold:   500 kbps
Domain Name:                        xxxxxx
Domain Type:                        Windows 2008 or later

Applied Group Policy Objects
-----------------------------
    password
    disable ipv6
    root CA
    Prod-StagingOU

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
    Local Group Policy
        Filtering:  Not Applied (Empty)

    power settings
        Filtering:  Not Applied (Unknown Reason)

The computer is a part of the following security groups
-------------------------------------------------------
    BUILTIN\Administrators
    Everyone
    BUILTIN\Users
    NT AUTHORITY\NETWORK
    NT AUTHORITY\Authenticated Users
    This Organization
    WKST02$
    Domain Computers
    Authentication authority asserted identity
    System Mandatory Level

Resultant Set Of Policies for Computer
---------------------------------------

    Software Installations
    ----------------------
        N/A

    Startup Scripts
    ---------------
        N/A

    Shutdown Scripts
    ----------------
        N/A

    Account Policies
    ----------------
        GPO: password
            Policy:            LockoutDuration
            Computer Setting:  30

        GPO: password
            Policy:            MaximumPasswordAge
            Computer Setting:  90

        GPO: password
            Policy:            MinimumPasswordAge
            Computer Setting:  1

        GPO: password
            Policy:            ResetLockoutCount
            Computer Setting:  30

        GPO: password
            Policy:            LockoutBadCount
            Computer Setting:  5

        GPO: password
            Policy:            PasswordHistorySize
            Computer Setting:  10

        GPO: password
            Policy:            MinimumPasswordLength
            Computer Setting:  8

    Audit Policy
    ------------
        N/A

    User Rights
    -----------
        GPO: Prod-StagingOU
            Policy:            RemoteInteractiveLogonRight
            Computer Setting:  xxxxxx\ROL_RemoteDesktop_ADM

    Security Options
    ----------------
        GPO: password
            Policy:            PasswordComplexity
            Computer Setting:  Enabled

        GPO: password
            Policy:            ClearTextPassword
            Computer Setting:  Not Enabled

        GPO: password
            Policy:            ForceLogoffWhenHourExpire
            Computer Setting:  Not Enabled

        GPO: password
            Policy:            RequireLogonToChangePassword
            Computer Setting:  Not Enabled

        GPO: password
            Policy:            LSAAnonymousNameLookup
            Computer Setting:  Not Enabled

        GPO: password
            Policy:            @wsecedit.dll,-59058
            ValueName:         MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash
            Computer Setting:  1

        N/A

    Event Log Settings
    ------------------
        N/A

    Restricted Groups
    -----------------
        N/A

    System Services
    ---------------
        N/A

    Registry Settings
    -----------------
        N/A

    File System Settings
    --------------------
        N/A

    Public Key Policies
    -------------------
        N/A

    Administrative Templates
    ------------------------
        GPO: Prod-StagingOU
            Folder Id: SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\EnableFirewall
            Value:       0, 0, 0, 0
            State:       Enabled

        GPO: Prod-StagingOU
            Folder Id: SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\EnableFirewall
            Value:       0, 0, 0, 0
            State:       Enabled

        GPO: Prod-StagingOU
            Folder Id: SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\fWritableTSCCPermTab
            Value:       0, 0, 0, 0
            State:       Enabled

        GPO: root CA
            Folder Id: Software\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots\Flags
            Value:       0, 0, 0, 0
            State:       Enabled

        GPO: disable ipv6
            Folder Id: SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents
            Value:       255, 0, 0, 0
            State:       Enabled

        GPO: Prod-StagingOU
            Folder Id: SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\fDenyTSConnections
            Value:       0, 0, 0, 0
            State:       Enabled

USER SETTINGS

CN=xxxxxxxxx,OU=Users,OU=Prod,DC=xxxxxx,DC=xxxxx
Last time Group Policy was applied: 1/11/2017 at 1:20:42 PM
Group Policy was applied from:      dc2.xxxxxx.xxxxx
Group Policy slow link threshold:   500 kbps
Domain Name:                        xxxxxx
Domain Type:                        Windows 2008 or later

Applied Group Policy Objects
-----------------------------
    power settings

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
    Local Group Policy
        Filtering:  Not Applied (Empty)


Resultant Set Of Policies for User
-----------------------------------

    Software Installations
    ----------------------
        N/A

    Logon Scripts
    -------------
        N/A

    Logoff Scripts
    --------------
        N/A

    Public Key Policies
    -------------------
        N/A

    Administrative Templates
    ------------------------
        N/A

    Folder Redirection
    ------------------
        N/A

    Internet Explorer Browser User Interface
    ----------------------------------------
        N/A

    Internet Explorer Connection
    ----------------------------
        N/A

    Internet Explorer URLs
    ----------------------
        N/A

    Internet Explorer Security
    --------------------------
        N/A

    Internet Explorer Programs
    --------------------------
        N/A

Dose anyone know if it is possible to collect ESX Performance Stats in LogStash/ELK stack? looking to see if I can collect ESXTOP data for use in the ELK stack.

I have a script that is moving VM's from one datastore to another. I have other logic to protect the Storage backend and fabric from over subscription and to wait to submit new requests at specific times (Business requirement). I am only moving datastores and not hosts. I have a try catch block around the Move-VM as I want to handle the failure. The first two or three times I ran the script only a few errors occur and were handled as I expected. The last 5 times the move returns an error but the VM move request is successful as indicated by the task I see in vCenter. This job completes successfully as well. The Move-VM is not using the RunAsync switch. What would cause Move-VM to return an error but successfully submit the move request.

$VMs = Get-VM -Name $ComputerName
$CurrentDataStores = Get-Datastore

foreach ($VM in $VMs){
   foreach ($store in $CurrentDataStores){
      if ($store.name -eq "$Datastore"){
         $rawDatastore = $store
      }
      if ($store.id -Match $VM.DatastoreIdList){
         $VMDatastore = $store.name
      } 
   }
   if ($VMDatastore -eq "$Datastore"){
      Write-Output "$VM : is already on requested Datastore"
   }
   else{
      try {
          Move-VM -VM $VM -Datastore $rawDatastore -ErrorAction Stop
      }
      catch {
         Write-OutPut "$VM : Unable to move VM to new Datastore" 
         continue
      }
   }
}

Move-VMDatastore : <VM Name> : Unable to move VM to new Datastore
At line:1 char:1
+ Move-VMDatastore -ComputerName <VM Name> -Datastore <Move TO Datastore>
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Move-VMDatastore


Move-VMDatastore : 12/24/2014 12:50:02 AM    Move-VM        Operation is not valid due to the current state of the
object.
At line:1 char:1
+ Move-VMDatastore -ComputerName <ComputerName[]> -Datastore <Datastore>
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Move-VMDatastore

I have a newly installed Server 2012 R2, Physical Host. Joined to the Domain. When I try to access a file share on a different (older, not sure how old but it might be 2008 R2) DFS File share I get the following error message

Network Error

Windows Cannot Access "file Share Location"

Error Code: 0x80070035

The Network path was not found

This is only happening from the 2012 R2 server. From 2008 R2 Server I can access the share. What is causing this issue?

I have a Param block in my script

Param (
    [Parameter(Mandatory=$True)]
    [string]$FileLocation,

    [Parameter(Mandatory=$True)]
    [string]$password = Read-Host "Type the password you would like to set all the users to" -assecurestring
)

Can I use the Read-Host CmdLet in a required Parameter field? if not what can I do to make sure I take in the correct type of variable type so I can pass it to a user creation process?

I am in the process of migrating file shares from my EMC NS-20 to my new VNXe 3100. I am using a RoboCopy script to move the files but am getting errors on some files and folders. I have Domain Admin privileges but when I go to view the security permissions on the folders it says I don't have permissions. I have tried taking ownership to get around the permissions issue but that fails too. So as a last resort can I set permissions on this folder from the EMC console or Web management console?

In my Exchange 2010 set up I have all my conference rooms configured as resources and to auto accept non-conflicting requests. All the resources have been scheduling correctly until Monday. The only thing that changed from last week was patching the server with windows update. Now the resources will not auto-book the room and because it's not auto-accepting it's not sending an e-mail to the meeting organizer saying the room has been booked. Can anyone help me out here?

Natively Active Directory Administrative Center (ADAC) doesn't give you the powershell alternative when performing any function, like Exchange Management Console. Is there a way to change this or is there an addin that will show this?

I have migrated about 45 mailboxes at this point from our single instance of Exchange 2003 to a High Availability Exchange 2010 environment successfully. However one mailbox moved successfully and the user is able to send and receive e-mail internally and externally with no problems but they do not show up in the Global Address List. The OAB is owned by an Exchange 2010 mailbox server. What am I missing?

• Did they appear in the GAL without issues when their mailbox was on Exchange 2003?
yes
• Was it OK when the OAB generation server was Exchange 2003?
Yes
• Does rebuilding the OAB help?
I did an update to the OAB and it didn't change anything
• Are there any OAB errors in the event log?
I do not see any errors in the even logs

One interesting thing is that in an e-mail message if I select All Users from the All Address list the user shows up there but not in the Global Address List.

I have two CAS/HUB servers (CAS1 & CAS2) and two Mailbox servers (MBX1 & MBX2). All four servers live on ESXi 4.0 hosts. CAS1 and MBX1 are on ESXA and CAS2 and MBX2 on ESXB. I am using the Microsoft NLB for my CAS Array. I have configured the NLB with the correct ports according to CAS template Microsoft has provided. My problem is this: CAS2 who is the primary CAS server that takes requests is unable to ping or access anything on MBX1 but is able to get to MBX2 And MBX1 can't talk to CAS2 but can talk to MBX2. MBX2 is able to ping MBX1. CAS1 can ping CAS2, MBX2, & MBX1. Going through a lot of different iterations on what could be causing this problem I moved all VM's to a single ESX host, ESXA, and everything started talking like it should. As soon as I moved one MBX, and it didn't matter which one, to the other ESX host communication to that MBX is lost. So my first thought would be a network problem with the ESX host. I rebuilt the vSwitch, and it didn't correct the problem. This only happens when a MBX server is moved. If I moved a CAS server no problems.

So my question, I think, revolves around Microsoft NLB. Is NLB the problem or is it some deep down network issue? and is the issue in the VM or on the ESX host?

I don't know how it happened but for some reason one of the sub folders in the Network shares (call the share Market and the sub folder Support) no longer has any groups or users with full permissions on the share. The Market top level has users and groups with these permissions and everything is set up for folder inheritance but it's not inheriting permissions from the top level and only has modify permissions for the single group that is in the Access List for the sub folder Support. I can see items in the sub folder but I can not add, edit, or delete permissions to the Support folder. What are my options so I can once again manage permissions?

I have successfully migrated a User and Computer account using ADMT. The user is able to login to the computer with the new account and is able to open outlook receive mail but is not able to send internal or external mail. The Exchange server is still in the Old domain. The bounce back message received was that the user doesn't have permissions to send to the recipient. When I migrated the user I did migrate the SID history so why is mail not being about to be sent? The body of the bounce back message is as follows:

Your message did not reach some or all of the intended recipients. Subject: test Sent: 1/6/2010 4:17 PM The following recipient(s) could not be reached:

User, user on 1/6/2010 4:17 PM
You do not have permission to send to this recipient. For assistance, contact your system administrator.
MSEXCH:MSExchangeIS:/DC=com/DC=DOMAIN:SERVER

I am having issues migrating my current Active Directory objects to my new Domain using ADMT. I have gone to a lot of resources to resolve this issue and they seem to point to DNS. Is there a tool or command or something that can validate my DNS configuration is functioning correctly? The DNS server is a Win server 2000 and is the primary Domain Controller.

I am in the process of trying to start moving my AD accounts to my new domain using ADMT 3.1 but when I do a user migration I get the following error in the error log.

2009-12-08 14:55:32 ERR2:7435 SID History cannot be updated for admigtest. This operation requires the TcpipClientSupport registry key to be set on "source domain". Changes to the TcpipClientSupport registry key require a restart to take effect. rc=6.
2009-12-08 14:55:32 WRN1:7392 SIDHistory could not be updated due to a configuration or permissions problem.  The Active Directory Migration Tool will not attempt to migrate the remaining objects.

I have checked on my source domain to ensure that the TcpipClientSupport value has been created and set correctly. Searching Microsoft and Google I have found that this issue can be related to DNS. I am going from AD 2000 to AD DS 2008r2. A trust has been configured correctly between the domains and are able to talk to each other. DNS in both domains are AD integrated. Are there any tools or recommendations on what to try? I know the basics of DNS but don't know what to look for in DNS to ensure my DNS is correctly configured.

I am in the process of migrating to a new AD DS from AD 2000. We have Exchange 2003 in the old and in the new domains. I am wondering if and how it's possible since I will be doing a slow migration (a group of users each day) to allow the users who have been moved to the new Domain and Exchange server to be able to still see and send mail to the other users on the old domain and exchange server. Microsoft KB articles are requested but not required for answers.

I am in the midst of building a new Active Directory 2008 Domain. My organization is currently running on a AD2000 and the decision has been made to build a new AD instead of migrate our current AD to 2008 ADDS. We have an Exchange 2003 infrastructure and Team Foundation/Sharepoint server that are in the 2000 AD environment. I know the easiest route is to migrate up but the current AD was not built correctly and is having problems. For this reason the powers that be decided to build a new AD.

I know ADMT is one tool that I will need for this project but what other tools, resources, and books/articles can you suggest for such a project especially for moving Exchange from the old Domain to the New?

Possible Duplicate:
Can you help me with my software licensing question?

I run a small it shop with roughly 60 PCs currently. We add about 5 to 10 new employees annually. Up to this point, when it comes to software for the Desktop/Laptops of my users, we have purchased through the PC manufacture OEM versions of Office and OS. We are considering a going to route of the Microsoft Open Value Company Wide. We have put all our numbers in spread sheets and at this point over 5 years it looks like the Open Value path would be about 20k more than continuing down the path we are currently on. I need to justify spending the extra 20k so my question is what benefits, other than the single product key and rights to upgrades, are there to going with an Open Value License agreement?

I am considering changing my backup strategy from using backup tape to using a product from EMC called Avamar. I have a Corp Data Center and a Disaster recovery Data Center. The plan is to put Avamar units in both DC's and replicate between the two fulfilling our SLAs requirement for off site backups. I was just pitched the Avamar product and was impressed, now I want the cold hard facts about the solution. What are the pros and Cons of going this route and what is the good the bad and the ugly with the Avamar product?

The possibility of having one of your users' laptop being either stolen or lost is fairly high. What are some of the best practices/policies when protecting your data on mobile computers?

Understanding that Disk Encryption is a must have, what products give you as the IT admin the most flexibility when working with a user's laptop?

My company operates a SaaS product. My charge is our corporate environment, i.e. users, computers and the Data Center at the Corp office. I am planning to upgrade our current Active Directory structure. I have roughly 65 users where 60 work from our Corp office and the other five from their respective Home Offices. I have five data centers geographically dispersed with their own AD Forest. I would like to pull everything under a single forest. What is best practice here? Should they be their own independent Forest or should they be Domains under a parent forest. Keep in mind all access to the other data centers are accessed from the Corp office.

Also would it be better for me to Upgrade my Current Active Directory environment by promoting up or start from scratch? What are the pros and Cons of both?