Advanced Windows PowerShell Scripting Video Training

Advanced Windows PowerShell Scripting Video Training
Advanced Windows PowerShell Scripting Video Training

Friday, December 31, 2010

Happy New Year!!!


Thank you to all my clients who have made 2010 such a good year.  I’m looking forward to spending 2011 with all of you.

How to mount a VHD in Disk Management

To complete this you will need a Windows 7 or Windows Server 2008 R2 client available.

Click Start and type Disk Management.

In the menu, click Create and format hard disk partitions.  This will open up Disk Manager

Click Action \ Attach VHD


Next, enter the location of your VHD file and click OK


Notice that you can check the box to mount the VHD in Read-only mode.


The drive will be loaded and you can open it just like it was an actual hard drive.

Wednesday, December 29, 2010

Using SConfig to set IP address on Server Core 2008 R2

Microsoft gave us a nice tool to use with the release of Windows Server 2008 R2 when working with server core. To set the IP address on Server Core 2008 R1, you would have to follow this procedure:

· Type netsh interface ipv4 show interfaces
· Press Enter
· Record the name of the interface you want to set a static IP address for. Sample output is below.

Idx Met MTU State Name
--- --- ----- ----------- -------------------
3 5 1500 Connected Local Area Connection

· Type netsh interface ipv4 set address name=3 source=static address= mask=
· Optionally, you can add a gateway address by appending gateway=address to the end of the command.
· In the Name parameter, we used the Idx value. We could have also typed “Local Area Network”.

The above method still works if you need to batch file something. Now with the R2 version, you can use a menu based system thanks to SConfig.

On you Server Core 2008 R2, log in and type sconfig.


Press 8 for Network Settings.


Select the index number for the network adapter that you want to configure. In this case, it will be 0.


Press 1 to Set Network Adapter IP Address


We can set this server core for DHCP by pressing D. It will only take a few seconds for the change to take effect. Had this adapter already been set to DHCP, we could click S for Static address.


You will need to enter data for the IP Address, Subnet Mask, and Default Gateway.

Once completed, you can set the DNS server if necessary by selecting 2


You will be given a chance to configure both a primary, and a secondary DNS server if you need to.

Once you are finished, press 4 to exit to the main menu and then 13, to exit SConfig.

Monday, December 27, 2010

RSAT (Remote Server Administration Tools)

For Windows Server 2000 and 2003, the installation media contained a support tools folder that allowed us to install the server management software on our clients. From Windows Server 2008, you need to download them. Below are the links to RSAT for both Vista and Windows 7. Remember to down load the correct version for both OS and processor. Below are the installation instructions from Microsoft.

1. On a computer that is running Windows 7, download the Remote Server Administration Tools for Windows 7 package from the Microsoft Download Center.

2. Open the folder into which the package downloaded, and double-click the package to unpack it, and then start the Remote Server Administration Tools for Windows 7 Setup Wizard.

Important: You must accept the License Terms and Limited Warranty to start to install the Administration Tools pack.

3. Complete all the steps that you must follow by the wizard, and then click Finish to exit the wizard when installation is completed.

4. Click Start, click Control Panel, and then click Programs.

5. In the Programs and Features area, click Turn Windows features on or off.

6. If you are prompted by User Account Control to enable the Windows Features dialog box to open, click Continue.

7. In the Windows Features dialog box, expand Remote Server Administration Tools.

8. Select the remote management tools that you want to install.

9. Click OK.

10. Configure the Start menu to display the Administration Tools shortcut, if it is not already there.

• Right-click Start, and then click Properties.

• On the Start Menu tab, click Customize.

• In the Customize Start Menu dialog box, scroll down to System Administrative Tools, and then select Display on the All Programs menu and the Start menu. Click OK. Shortcuts for snap-ins installed by Remote Server Administration Tools for Windows 7 are added to the Administrative Tools list on the Start menu.



Friday, December 24, 2010

Change Server Core 2008 R2 Windows Update Settings

In Server Core 2008 R1, this was a bit of a mess.  Microsoft provided us with a script.  We had to type:

Cscript c:\Windows\system32\scregedit.wsf /AU 4 to turn Automatic updates on.

To turn them back off we had to type Cscript c:\Windows\system32\scregedit.wsf /AU 0.

With R2, we have an easier method.  Type sconfig and press Enter

Press 5 for Windows Update Settings.


Press A for Automatic or M for Manual.


You will receive the prompt above to let you know that you disabled Automatic updates or, you will see the one below if you turned them on.


Wednesday, December 22, 2010

How to tell how long it has been since a computer logged in with PowerShell

This is an easy one liner in PowerShell.

Open PowerShell V2.

Once open, we need to access the Active Directory objects by typing Import-Module ActiveDirectory.

Now Type Get-adcomputer –filter * -properties lastlogondate | Where {$_.LastLogonDate –le [DateTime]::Now.AddDays(-7)}

We first use the Get-ADCopmuter cmdlet to access the computer objects in Active Directory. Setting –filter * allows us to work with all the computer objects. Next we added the –properties LastLogonDate. This is done because that attribute is normally now returned with the object. Second, we piped the output of the first command to the Where cmdlet. The $_.LastLogonDate variable looks at each input one at a time and grabs the LastLogonDate attribute for analysis. We then compare it to [DateTime]::Now.AddDays(-7) This command gets the current date/time from the host and subtracts 7 days from it. We then use the –le comparision operator (Less than or equal to) to determine if the date in Active Directory for the computer object is more than 7 days old.

Friday, December 17, 2010

Will a file screen look inside a .ZIP file?

From my testing, it does not. I set up a file screen to prevent .TXT files from being copied into a folder. In another folder that was not screened, I created two text files and then sent them to a compressed (.zip) file. I was able to copy the .zip file to the screen folder. To help prevent blocked files from being saved to restricted locations, you may want to consider also blocking .ZIP files.

Wednesday, December 15, 2010

Making sure your OUs have Deletion Protection

Deletion Protection is a feature that prevents an OU from being accidently deleted.  This is a feature of Windows Server 2008.  For those servers upgraded from Windows Server 2003, Deletion Protection is not turned on.  Until now the only way to turn on the Deletion Protection is manually.  Well, now you can use PowerShell V2 to take care of this for you.

Windows PowerShell V2 comes installed on Windows 7 and Windows Server 2008 R2. For previous versions of Windows, you can download PowerShell V2 from here:

You will also need to make sure the Active Directory Module for Windows PowerShell is installed.  This can be found as a feature in the Remote Server Administrator Tools.

The First step is to launch the PowerShell environment.  If you do not have an icon on the screen, you will find it is  Start \ All Programs \ Accessories \ Windows PowerShell \ Windows PowerShell

Once the Shell loads, you need to add the Active Directory module by typing Import-Module ActiveDirectory and pressing Enter.

First off, look for OUs that do not have Deletion Protection turned on:

Get-ADOrganizationalUnit – Filter * -Properties ProtectedFromAccidentalDeletion | Where {$_.ProtectedFromAccidentalDeletion –eq $False} | FT DistinguishedName

If any OUs are listed, you may want to enable the Deletion Protection.  To do this:

Get-ADOrganizationalUnit – Filter * -Properties ProtectedFromAccidentalDeletion | Where {$_.ProtectedFromAccidentialDeletion –eq $False} | Set-ADOrganizationalUnit –ProtectedFromAccidentalDeletion $True

Running the first command will verify that the protection is turned on.

Monday, December 13, 2010

How to prevent users from shutting down the PC

There may be situations in which you do not want to allow a user to shut down a client. This is an easy one to fix.

In Group Policy expand User Configuration \ Policies \ Administrative Templates \ Start Menu and Taskbar. Enable the policy for Remove and Prevent access to the Shut Down , Restart, Sleep, and Hibernate commands.

Or you can set it in the local policies on the client. User Configuration \ Administrative Templates \ Templates \ Start Menu and Taskbar. Enable the policy for Remove and Prevent access to the Shut Down , Restart, Sleep, and Hibernate commands.

Friday, December 10, 2010

Rename a Server Core 2008 R2 Server

This is now a very easy task over the R1 version.  The R1 method involed using the NETDOM command.  It went something like this:

netdom RenameCOmputer Old-Name /NewName:New-Name

you then had to manually reboot the machine by typing Shutdown /r /t 0.

In Server Core 2008 R2, you can use the sconfig command.

Log into your server core server.

Type sconfig and press enter.

Type 2 for Computer Name: and the press Enter.

Enter the computer name and press Enter.

You will then be asked for the username of a user who has the rights to change this servers name and then press Enter..


A new window will open up asking for that users password.  Enter it and press Enter.


You will need to click Yes to reboot the server.

Wednesday, December 8, 2010

How to clear the print queue when the user logs off (Domain Version)

A common problem with using a client that multiple users log into is that a sensitive document could be stuck in the local print queue. With law suit heavy lawyers running around, you do not want to put your organization at risk. The below procedure will help to mitigate this issue. (Note: The following procedure is performed and tested on Windows 7) This procedure will set up your clients to clear their print queues when a user logs off. This prevents the printer from coming online and printing sensitive information when another user logs on.

On your Windows 7 client, click image , type Notepad and press Enter.

Copy and past the following code:

net stop spooler
del %systemroot%\system32\spool\printers\*.shd
del %systemroot%\system32\spool\printers\*.spl
net start spooler

Click File \ Save As

In the Save as Type: dropdown box, select All FIles.

In the File name: box, type C:\DeletePrinJobs.cmd.

In a production environment, you may want to put this somewhere other then the C: drive. The above batch file will clear out any stuck printouts in the print queue on the local client when it the batch file is ran. To test this, I created two fictitious printers. One is the default printer, the other is not.


I sent test pages to both. Right now we have documents pending in both queues. When the batch file was ran, both queues emptied. To get this to happen each time a user logs off, you need to place it in a log off script.

You need to save the script in a location that all users will have access to. Also, you want this script replicated to all domain controllers. to do this, save it in the following location on a domain controller


Now, we need to modify a Group Policy to deliver this instruction to your clients.

On a Domain Controller, click Start \ Administrative tools \ Group Policy Management

Expand Forest:<YourDomainName>\Domains\<YourDomainName>\Group Policy Objects

Right click Group Policy Objects and click New

Give the GPO a name.

Click OK

Right click the GPO you just created and select Edit

Expand User Configuration \ Policies \ Windows Settings

Click Scripts (Logon/Logoff)


Click Double click Logoff

Click Add

Click Browse

You need to access the script through the namespace of your network. This ensures that any client requesting the script will get it from their local Domain Controller. For example, if your domain is, you would look in the location \\\SysVol\\scripts

Click the script that you created and then click Open

Click OK

Close the policy.

From here you will have to apply the GPO according to your company policies.

Once the GPO is applied, each time you users log off the client, any printouts in the local print queue will be deleted.

Friday, December 3, 2010

Can you use a file screen to prevent files from being redirected?

Yes you can. The scenario here is we have set up our clients, through Group Policy, to redirect the desktop to a server. I have also set up a files screen on the shared folder that will host the data. This file screen is configured to block .TXT files. When the user tries to create a .TXT file on their desktop, they are prevented from doing so. Below is the setup procedure to do this.

Step 1: configure the folder to hold the user data.

I created a folder on my server

Next I shared it by right clicking the folder and selecting Properties.



Click Advanced Sharing.

Click Permissions.

Click Add

In the Enter the object names to select box, type Authenticated Users and click Check Names.

Click OK


Click Authenticated Users

Check Full Control.

Click OK

Click OK

Click Close

The folder is not set up for your users to have their desktops redirected to this location.


Step 2

We now need to create the Group Policy that will redirect the users desktop to this location.

On your Domain Controller, click Start / Administrator Tools / Group Policy Management

Expand the tree until you expand Group Policy Objects.

Right click Group Policy Objects and click New.


Give the GPO a name.  In this example, we will call it DesktopRedirection.  Click OK

Under Group Policy Objects, right click DesktopRedirection and then click Edit.

Expand User Configuration / Windows Settings / Folder Redirection.

Right click Desktop and select Properties.

In the Settings drop down box, select Basic – Redirect everyone’s folder to the same location.

In Target folder location select Create a folder for each user under the root path.

IN Root Path, enter the UNC path to the folder we created earlier.  In this example, it is \\MCT-1\Desktop.


Click the Settings tab.

By default, Grant the user exclusive rights to Desktop.  For this example, I unchecked it.

Click OK


Close Group Policy Management Editor

In the Group Policy Management window, drag and drop the GPO onto the Organizational Unit that holds your user accounts.  Remember, you cannot link a GPO to the default users container.

This policy is now being applied to your users.


Step 3 Install FSRM

On the server that holders the Desktop folder, clickStart \ Administrator Tools \ Server Manager

You need to add the File Server Resource Manager Role service to this server.  If File Services are not installed, click Add Roles and add the File Services role to this computer.

In Server Manager click Roles.

Scroll down until you get to the Role Services section and click Add Role Services


Check File Server Resource Manager and then click Next.

Select the drive that you have the Desktop folder on.

Click Next

Click install.

Close the window when completed.


Step 4 Set up the file screen

Click Start / Administrator Tools / File Server Resource Manager

Expand File Screen Management

Right click File Screens and select Create File Screen.

In the File screen path, choose the Desktop folder that you created.

In Derive properties from this file screen template (recommended), choose the file screen you want to use.  For our example, we are using a custom file screen.  This screen blocks .TXT files.


We are now ready to test the screen

Log into your client as a user who has the Group Policy applied to them.

Attempted to create a .TXT file.  You should receive an error like the one below:


If not, make sure your group policies have replicated and this client has downloaded the policy.

Tuesday, November 30, 2010

How to require a password to unlock the SAM database

Windows already protects your account passwords by first storing only a hash of the password, and then encrypting that hash.  You an increase protection of the database by either removing the SAM database encryption key to removable media, or by requiring a start-up password to unlock the database.  A word of caution, you will need a trusted administrator at the console of the server when you restart it to insert the media or type the password.  This document looks at setting up a password to unlock the SAM Database


On you Windows Server or client, click Start.

Type SYSkey and press  Enter

If User Access Control (UAC) is enabled, you may need to provide the proper credentials.

Encryption Enabled should already be selected for you.  Click Update.


Select Password Startup.

Provide and confirm the password you want to lose.

Warning: If you lose this password, you lose access to this computer.

Click OK.


Click OK at the confirmation screen.



Now, reboot the server/client.

The computer will go through the normal boot process, but it will stop at the screen below.


Type in the Password you choose and click OK.

At this point, the system will complete the boot.


To remove this password from the startup, you will need to return the key to the local system

Click Start, type SYSkey and press Enter.

If User Access Control (UAC) is enabled, you may need to provide the proper credentials.

Encryption Enabled should already be selected for you.  Click Update.



Select System Generated Password.

Verify that Store Startup Key Locally is selected

Click OK.


Type in the password you used to unlock the database and click OK.

Click OK at the confirmation screen.


A restart of the machine will let it boot normally.

Monday, November 29, 2010

Basic Baseline of a Server

A server baseline allows us to so how changes we make to our servers affect the performance of the server. it also allows us to be, dare I say “proactive” in managing our servers. Creating a baseline involves collecting data that could lead to a bottleneck. A bottleneck is a point in the path that data travels in which it has to wait. If your data is stuck, so are your users. The data the you need to collect for a baseline will vary depending on what you have on that server. This document covers just the basics.

For a basic baseline, we need to look at 4 areas: Processor, Network Interface Card (NIC), RAM, and the hard drives. We will be using the Windows Performance Monitor to collect this information for us. A baseline is taken over a period of time. Because of this, we will be using the Data Collector Sets in the Performance Monitor to do our collection.

To start the Performance Monitor, click Start, type Perfmon and press Enter

Expand Data Collector Sets.

Right click User Defined and then click New \ Data Collector Set


Provide a name for the baseline.

Click Next

Select Basic and click Finish.

Click Baseline.

Double click Performance Counter

Click Remove to remove the \Processor(*)\* entry.

We are now ready to add our basic counters to collect our performance data.


The processor is the brains of the computer. Like us humans, our brains can only do so much before it starts to slow down. We need to take a good look at the activity of the CPU to see if we are asking to much of it. When reading the data for the processor, remember that spikes to 100% are normal and should be expected. Sustained activity above 75% shows a potential bottleneck. If you have this sustained activity, take a close look at what is being done on this server and consider offloading some of the applications to another, less utilized server.

Let’s add in our counters:

Click Add

Expand Processor

Select %Processor Time

Notice in the Instances of selected object box, you may have more than 1 processor. I the example below, there are 4 processors labeled 0-3.


You may want to monitor each processor individually. Click each processor and then click Add.

Physical Disk

The Physical Disk represents each physical hard drive on your server. You may have several logical disks. That is a physical disk with several partitions. To get an accurate look at the disk usage, we need to look at the physical disk. We are interested in the %Disk Read Time and %Disk Write Time. This tells us how often our disk is being used. We also want to look at the Average Disk Queue Length. Should this number stay above 4, you may have a bottle neck. With today's high speed devices, that number can be much higher before users notice anything.


For more than a decade now, your PC has been able to use more memory than what you have installed in the computer. PCs and servers use a technology called virtual memory. WHen the physical memory is full, but the system needs to load more information into memory, the server will look at the contents of its physical memory that has not been used in a while, and write it to the hard disk. When it needs to use that content again, it copies more information from RAM to the hard disk and then grabs the information it needs off the hard disk, and stores it in RAM. RAM is fast, disk is slow. Anytime you need to do this swap, it is called a Page Fault. Because Page Faults require the use of a disk, they slow things down. A lot of Hard Page Faults/Sec indicates that you need to add more RAM to your server. In the Memory object, add the Page Faults/Sec counter.

Network Interface Card (NIC)

The next item to take a look at is the NIC. We must allow Fantasy Foot to be played without delay! Two things to look at here is how much data is waiting to travel out of the computer, and how many errors does that card receive. The Output Queue Length will tell us if there is a traffic jam trying to get out of your computer. This can indicate that your network connection is not fast enough. You may need to upgrade the NIC, the infrastructure, or both. Another option may be to add an additional NIC to the server. The Packets Received Errors will tell you if there is a bad NIC on your network.

An optional metric to monitor is in the Server object. Take a look at the Server Sessions to get an idea about how many users are using this server.

Click OK to save the counters.

Right click Baseline and select Properties.

Click Schedule tab. Here you can schedule when this performance counter starts. Under the Stop Condition tab, you can control how long the sampling takes place.

After a period of time, or after you deploy new functionality to the server, you will want to re-run this baseline and see what the effect has been. By knowing the utilization state of your servers, you can make a more informed decision about what can, and cannot be added to a servers work load.

Friday, November 26, 2010

How to Add Server Core 2008 R2 to a domain

This task is now much easier than it was in Server Core 2008 R1. First, log into server core.

Type Sconfig and press Enter.

Press 1 for Domain/Workgroup and press Enter

Press D for Domain and then press Enter.


Type the name of the domain that you want to join.


Type the name of a user account in that domain that has the rights to add clients to the domain.

A new Window will open up to ask you for the users password and then to confirm it.

Once joined to the domain, type 11 to Restart Server.

You should now see this server core as part of your domain.

Wednesday, November 24, 2010

Where are the GPO settings for a printer GPO created in Print Manager?

On a Windows Server 2008 Server with the Print and Document Services role installed, you can deploy printers via group policy. The question in class is where in group policy is this stored. By opening the Group Policy Management program and selecting the GPO you created to deploy the printer, you can see the changes made. With the GPO selected, click the Settings tab. You should see something like the image below.

To see the changes in Group Policy, open the GPO itself. Expand User Configuration \ Windows Settings \ Deployed Printers

Above you can see the deployed Canon printer.

Tuesday, November 23, 2010

How to determine the effective Fine Grain Password Policy on a user account.

When your domain is at least at Windows Server 2008 R1 level, you have the option of using Fine Grain Passwords.  In previous implementations of a Windows domain. You were given only only password policy for every users.  This was the policy stored in the Default Domain Policy GPO.  Now you can have users of different security groups have different password policies that are more fitting to the security of their positions and the data they have access to.  One problem that comes up is when a user is a member of multiple security groups, all of which have different PSOs (Password Settings Object – aka Fine grain password policy) assigned to them.  The Precedence value assigned to each PSO determines the one in effect.  Of all the PSOs the user recieves from their respective PSOs, the User Object only uses the PSO with the lowest precedence value.  Here is how to determine which one a user account is using.


On your Domain Controller, open Active Directory Users and Computers.

Click View and make sure there is a check mark beside Advanced Features.


Next browse to the users account object.  Right click it and select Properties.

Click the Attribute Editor tab,

Click the Filter button and make sure there are checks by Show Attributes: Optional and Show read-only attributes: Constructed.


Look for the attribute msDS-ResultantPSO.  The name of the PSO being applied to this user is the value of this attribute.


Monday, November 22, 2010

Setting Remote Desktop Encryption Levels

The following article has instructions on how to set the encryption level for your clients. Below is an excerpt.

Setting Encryption Levels

Data encryption can protect your data by encrypting it on the communications link between the client and the Windows XP Professional–based computer. Encryption protects against the risk of unauthorized interception of transmitted data. By default, Remote Desktop sessions are encrypted at the highest level of security available (128-bit). However, some older versions of Terminal Services client software do not support this high level of encryption. If your network contains such “legacy” clients, you can set the encryption level of the connection to send and receive data at the highest encryption level supported by the client.

There are two levels of encryption available:

· High

This level encrypts data sent from the client to the remote computer and from the remote computer to the client by using strong 128-bit encryption. Use this level only if you are sure that your client computer supports 128-bit encryption (for example, if it is running Windows XP Professional). Clients that do not support this level of encryption will not be able to connect.

· Client Compatible

This level encrypts data sent between the client and the remote computer at the maximum key strength supported by the client. Use this level if your client computer does not support 128-bit encryption.

You can set the encryption level of the connection between the client and the remote computer by enabling theSet client connection encryption level Terminal Services Group Policy setting.

Friday, November 19, 2010

Conserve Bandwidth when using the Droid 2 Mobil Hotspot.

One of the disadvantages of my job is that I have a constant need to access the internet.  In most locations that I go to, I usually can find a hot spot.  On occasion, I find myself without a connection.  This posses a few problems. My mother lives in a one blinking stop light town.  Internet?  Hey, we are lucky to have electricity here.  Well, tonight I am blogging from Mom’s house.  I have my new Google Droid 2 phone with its mobile hot spot on.  AWESOME!  Yes, I know.  I’ll probably be kicked off the Microsoft Born To Learn blog list for owning one.  Sorry Bill. I was holding out for a Windows 7 phone but I my old smart phone was being held together by tape.

Now, for the down side.  You get 2 GB of data per month on the hot spot for $20…and then they begin to charge you more.  Being the power user that I am, I need to squeeze as much data as I can out of this phone.  I decided to try a trick that I learned years ago when I needed to cache web pages on my Pocket PC.  The only way that I could get a web page on my Pocket PC was to have it cradled.  I would cache pages to read while I was on a plane.  This worked OK, but back then we did not have a lot of storage on those things.  The solution was not to cache the images.  The same potential solution applies to using your mobile hot spot.

This may be a bit odd for most. The internet without pictures!!! What is this? 1995?  You can get any one of these images when ever you want.  The idea is to not download any extra data to conserve bandwidth.  Most of the information you read is in text anyway, right?  Here is how my website looks with, and without text.



OK, not very pretty, but I just reduced my bandwidth utilization by around 90% as well as accelerated my web surfing experience. If I wanted to view an image, just right click it and select Show Picture.



Here is how to do it in Internet Explorer 8

Click Tools / Internet Options

Click the Advanced Tab

Scroll down to the Multimedia section.

Uncheck Show Pictures.

Click OK


Tuesday, November 16, 2010

Does IPCONFIG /FLUSHDNS do anything other than clear the cache?

According to Microsoft Documentation, no it does not.  Below is a list of the functions of IPCONFIG.  Noticed that FlushDNS only clears the cache.

/all : Displays the full TCP/IP configuration for all adapters. Without this parameter, ipconfig displays only the IP address, subnet mask, and default gateway values for each adapter. Adapters can represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-up connections.

/renew [Adapter] : Renews DHCP configuration for all adapters (if an adapter is not specified) or for a specific adapter if the Adapter parameter is included. This parameter is available only on computers with adapters that are configured to obtain an IP address automatically. To specify an adapter name, type the adapter name that appears when you use ipconfig without parameters.

/release [Adapter] : Sends a DHCPRELEASE message to the DHCP server to release the current DHCP configuration and discard the IP address configuration for either all adapters (if an adapter is not specified) or for a specific adapter if the Adapter parameter is included. This parameter disables TCP/IP for adapters configured to obtain an IP address automatically. To specify an adapter name, type the adapter name that appears when you use ipconfig without parameters.

/flushdns : Flushes and resets the contents of the DNS client resolver cache. During DNS troubleshooting, you can use this procedure to discard negative cache entries from the cache, as well as any other entries that have been added dynamically.

/displaydns : Displays the contents of the DNS client resolver cache, which includes both entries preloaded from the local Hosts file and any recently obtained resource records for name queries resolved by the computer. The DNS Client service uses this information to resolve frequently queried names quickly, before querying its configured DNS servers.

/registerdns : Initiates manual dynamic registration for the DNS names and IP addresses that are configured at a computer. You can use this parameter to troubleshoot a failed DNS name registration or resolve a dynamic update problem between a client and the DNS server without rebooting the client computer. The DNS settings in the advanced properties of the TCP/IP protocol determine which names are registered in DNS.

/showclassid Adapter : Displays the DHCP class ID for a specified adapter. To see the DHCP class ID for all adapters, use the asterisk (*) wildcard character in place of Adapter. This parameter is available only on computers with adapters that are configured to obtain an IP address automatically.

/setclassid Adapter [ClassID] : Configures the DHCP class ID for a specified adapter. To set the DHCP class ID for all adapters, use the asterisk (*) wildcard character in place ofAdapter. This parameter is available only on computers with adapters that are configured to obtain an IP address automatically. If a DHCP class ID is not specified, the current class ID is removed.

/?: Displays help at the command prompt.

Monday, November 15, 2010

When using WET, dos it transfer your credential manager data?

You can use User State Migration tool to migrate your Credential Manager data. To do this you are going to have to create a Custom.xml file. The following link gives you more information on how to create a custome XML file for USMT:
In our case, we are interested in the following line:
<component displayname="Microsoft-Windows-Credential-Manager-DL" migrate="no" ID=""/>
By setting the Migrate=”yes” option, your credential manager will migrate.

Friday, November 12, 2010

What does 2>&1 mean in Powershell?

In class 50025, we noticed some odd code on page 9-2. This code 2>&1 did not come with any good description. It is a redirection operator. Below is some information on the different Powershell redirectors.


Redirects output to specified file. If the file already exists, current contents are overwritten.


Redirects output to specified file. If the file already exists, the new output is appended to the current content.


Redirects error output to specified file. If the file already exists, current contents are overwritten.


Redirects error output to specified file. If the file already exists, the new output is appended to the current content.


Redirects error output to the standard output pipe instead of to the error output pipe.

Wednesday, November 10, 2010

If you restrict a user to a single session, what happens if they log into another computer?

In class, I performed a quick demonstration using Remote Desktop Services in Windows Server 2008 R2. I set up a Remote Desktop Server and applied a Group Policy that restricted the users that logged into this Remote Desktop Server to a single session. The policy was located at:

Computer Configuration / Policies / Administrative Templates / Windows Components / Remote Desktop Services / Remote Desktop Sessions / Connections / Restrict Remote Desktop Services users to a single Remote Desktop Services Session

Once this policy was enabled, users were restricted. To test what happens when they connect on two different clients, I use the Remote Desktop Connection on two separate Windows 7 clients. On the first connection, I created a folder on the desktop so we can confirm that a single session was being used. I connected on the second client, and we saw the desktop with the folder. I then went back to the first client and we were notified that the Remote Desktop Session was disconnected. Reconnected with the first client caused the second client to lose its connection.

Tuesday, November 9, 2010

Getting Server 2008 to return a PING

Windows Server 2008 is deployed in a secured configuration.  As a result, a basic troubleshooting, the PING command, is not able to function.  This is a simple fix involving the firewall.  This article will focus on how to change this setting using Group Policy so you only have to do it once in a multi server environment.

Log onto one of your Windows Server 2008 domain controllers.

Click Start / Administrative Tools / Group Policy Management

Either select a GPO to use, or create a new GPO.  To create a new GPO, right click Group Policy Object and select New.  Give the GPO a new and click OK.

Right click the GPO you want to use and click Edit.

Expand Computer Configuration / Policies / Windows Settings / Security Settings / Windows Firewall with Advanced Security / Inbound Rules


Right click Inbound Rules and select New Rule.

Select Predefined and then select File and Printer Sharing from the drop down list.

Click Next.



Check File and Printer Sharing (Echo Request – ICMPv4-In) and click Next

If you are using IPv6, check File and Printer Sharing (Echo Request – ICMPv6-In)


Select Allow the connection  and then click Finish.


Close the Group Policy Management Editor.

Any OU that you will apply this policy to will set the Windows Firewall to allow the PING request to be responded to.