Jason Yoder, MCT

Windows already protects your account passwords by first storing only a hash of the password, and then encrypting that hash.  You an increase protection of the database by either removing the SAM database encryption key to removable media, or by requiring a start-up password to unlock the database.  A word of caution, you will need a trusted administrator at the console of the server when you restart it to insert the media or type the password.  This document looks at setting up a password to unlock the SAM Database   On you Windows Server or client, click Start. Type SYSkey and press   Enter If User Access Control (UAC) is enabled, you may need to provide the proper credentials. Encryption Enabled should already be selected for you.  Click Update . Select Password Startup . Provide and confirm the password you want to lose. Warning: If you lose this password, you lose access to this computer. Click OK . Click OK at the confirmatio...

A server baseline allows us to so how changes we make to our servers affect the performance of the server. it also allows us to be, dare I say “proactive” in managing our servers. Creating a baseline involves collecting data that could lead to a bottleneck. A bottleneck is a point in the path that data travels in which it has to wait. If your data is stuck, so are your users. The data the you need to collect for a baseline will vary depending on what you have on that server. This document covers just the basics. For a basic baseline, we need to look at 4 areas: Processor, Network Interface Card (NIC), RAM, and the hard drives. We will be using the Windows Performance Monitor to collect this information for us. A baseline is taken over a period of time. Because of this, we will be using the Data Collector Sets in the Performance Monitor to do our collection. To start the Performance Monitor, click Start , type Perfmon and press Enter Expand Data Collector Sets . Right ...

This task is now much easier than it was in Server Core 2008 R1. First, log into server core. Type Sconfig and press Enter . Press 1 for Domain/Workgroup and press Enter Press D for Domain and then press Enter . Type the name of the domain that you want to join. Type the name of a user account in that domain that has the rights to add clients to the domain. A new Window will open up to ask you for the users password and then to confirm it. Once joined to the domain, type 11 to Restart Server . You should now see this server core as part of your domain.

On a Windows Server 2008 Server with the Print and Document Services role installed, you can deploy printers via group policy. The question in class is where in group policy is this stored. By opening the Group Policy Management program and selecting the GPO you created to deploy the printer, you can see the changes made. With the GPO selected, click the Settings tab. You should see something like the image below. To see the changes in Group Policy, open the GPO itself. Expand User Configuration \ Windows Settings \ Deployed Printers Above you can see the deployed Canon printer.

When your domain is at least at Windows Server 2008 R1 level, you have the option of using Fine Grain Passwords.  In previous implementations of a Windows domain. You were given only only password policy for every users.  This was the policy stored in the Default Domain Policy GPO.  Now you can have users of different security groups have different password policies that are more fitting to the security of their positions and the data they have access to.  One problem that comes up is when a user is a member of multiple security groups, all of which have different PSOs (Password Settings Object – aka Fine grain password policy) assigned to them.  The Precedence value assigned to each PSO determines the one in effect.  Of all the PSOs the user recieves from their respective PSOs, the User Object only uses the PSO with the lowest precedence value.  Here is how to determine which one a user account is using.   On your Domain Controller, open Ac...

The following article has instructions on how to set the encryption level for your clients. Below is an excerpt. http://technet.microsoft.com/en-us/library/bb457106.aspx Setting Encryption Levels Data encryption can protect your data by encrypting it on the communications link between the client and the Windows XP Professional–based computer. Encryption protects against the risk of unauthorized interception of transmitted data. By default, Remote Desktop sessions are encrypted at the highest level of security available (128-bit). However, some older versions of Terminal Services client software do not support this high level of encryption. If your network contains such “legacy” clients, you can set the encryption level of the connection to send and receive data at the highest encryption level supported by the client. There are two levels of encryption available: · High This level encrypts data sent from the client to the remote computer and from the remote comput...

One of the disadvantages of my job is that I have a constant need to access the internet.  In most locations that I go to, I usually can find a hot spot.  On occasion, I find myself without a connection.  This posses a few problems. My mother lives in a one blinking stop light town.  Internet?  Hey, we are lucky to have electricity here.  Well, tonight I am blogging from Mom’s house.  I have my new Google Droid 2 phone with its mobile hot spot on.  AWESOME!  Yes, I know.  I’ll probably be kicked off the Microsoft Born To Learn blog list for owning one.  Sorry Bill. I was holding out for a Windows 7 phone but I my old smart phone was being held together by tape. Now, for the down side.  You get 2 GB of data per month on the hot spot for $20…and then they begin to charge you more.  Being the power user that I am, I need to squeeze as much data as I can out of this phone.  I decided to try a trick that I learned years ...

According to Microsoft Documentation, no it does not.  Below is a list of the functions of IPCONFIG.  Noticed that FlushDNS only clears the cache. /all : Displays the full TCP/IP configuration for all adapters. Without this parameter, ipconfig displays only the IP address, subnet mask, and default gateway values for each adapter. Adapters can represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-up connections. /renew [ Adapter ] : Renews DHCP configuration for all adapters (if an adapter is not specified) or for a specific adapter if the Adapter parameter is included. This parameter is available only on computers with adapters that are configured to obtain an IP address automatically. To specify an adapter name, type the adapter name that appears when you use ipconfig without parameters. /release [ Adapter ] : Sends a DHCPRELEASE message to the DHCP server to release the current DHCP configuration and discard the IP...

You can use User State Migration tool to migrate your Credential Manager data. To do this you are going to have to create a Custom.xml file. The following link gives you more information on how to create a custome XML file for USMT: http://technet.microsoft.com/en-us/library/cc749416(WS.10).aspx#Creating . The link below gives you an example of a custome.xml file: http://social.technet.microsoft.com/Forums/en-US/w7itproinstall/thread/ab8d6d70-9d1b-419c-8149-37387d4eba6d In our case, we are interested in the following line: < component displayname = " Microsoft-Windows-Credential-Manager-DL " migrate = " no " ID = " http://www.microsoft.com/migration/1.0/migxmlext/cmi/microsoft-windows-credential-manager-dl/microsoft-windows-credential-manager-dl/settings " /> component > By setting the Migrate=”yes” option, your credential manager will migrate.

In class 50025, we noticed some odd code on page 9-2. This code 2>&1 did not come with any good description. It is a redirection operator. Below is some information on the different Powershell redirectors. > Redirects output to specified file. If the file already exists, current contents are overwritten. >> Redirects output to specified file. If the file already exists, the new output is appended to the current content. 2> Redirects error output to specified file . If the file already exists, current contents are overwritten. 2>> Redirects error output to specified file. If the file already exists, the new output is appended to the current content. 2>&1 Redirects error output to the standard output pipe instead of to the error output pipe.

In class, I performed a quick demonstration using Remote Desktop Services in Windows Server 2008 R2. I set up a Remote Desktop Server and applied a Group Policy that restricted the users that logged into this Remote Desktop Server to a single session. The policy was located at: Computer Configuration / Policies / Administrative Templates / Windows Components / Remote Desktop Services / Remote Desktop Sessions / Connections / Restrict Remote Desktop Services users to a single Remote Desktop Services Session Once this policy was enabled, users were restricted. To test what happens when they connect on two different clients, I use the Remote Desktop Connection on two separate Windows 7 clients. On the first connection, I created a folder on the desktop so we can confirm that a single session was being used. I connected on the second client, and we saw the desktop with the folder. I then went back to the first client and we were notified that the Remote Desktop Session was ...

Windows Server 2008 is deployed in a secured configuration.  As a result, a basic troubleshooting, the PING command, is not able to function.  This is a simple fix involving the firewall.  This article will focus on how to change this setting using Group Policy so you only have to do it once in a multi server environment. Log onto one of your Windows Server 2008 domain controllers. Click Start / Administrative Tools / Group Policy Management Either select a GPO to use, or create a new GPO.  To create a new GPO, right click Group Policy Object and select New .  Give the GPO a new and click OK . Right click the GPO you want to use and click Edit . Expand Computer Configuration / Policies / Windows Settings / Security Settings / Windows Firewall with Advanced Security / Inbound Rules Right click Inbound Rules and select New Rule . Select Predefined and then select File and Printer Sharing from the drop down list. Click Next .   Check...

The following link will take you to the Microsoft article concerning upgrading your XP RDC clients to the Windows 7/Server 2008 R2 compatible version. Take note of the known issues section. The download link for each version is at the bottom. As always, make sure you test before deploying to your clients. http://support.microsoft.com/kb/969084

To set up the senerio for this question. A user had installed a DNS server on a Winodws Server 2008 Server Core installation and was managing it from a graphical interface on another server. When an attempt was made to look at the log files, the user received the error: Unable to complete the operation on “DNS Events”. The file size exceeds the limit allowed and cannot be saved. Upon further investigation, I found that the log file was actually empty. I also noticed that there were no zones configured for this DNS server. Once I created a forward lookup zone, I was able to open up the log.

A common problem with using a client that multiple users log into is that a sensitive document could be stuck in the local print queue. With law suit heavy lawyers running around, you do not want to put your organization at risk. The below procedure will help to mitigate this issue. (Note: The following procedure is performed and tested on Windows 7) This procedure will set up your clients to clear their print queues when a user logs off. This prevents the printer from coming online and printing sensitive information when another user logs on. On your Windows 7 client, click , type Notepad and press Enter . Copy and past the following code: net stop spooler del %systemroot%\system32\spool\printers\*.shd del %systemroot%\system32\spool\printers\*.spl net start spooler Click File \ Save As In the Save as Type: dropdown box, select All FIles . In the File name: box, type C:\DeletePrinJobs.cmd . In a production environment, you may want to put this somewhere other...

In the original implementation of PowerShell, I was very discouraged with the lack of Active Directory support. SUre, you can create user accounts and Organizational units, but it was not easy.  With PowerShell V2, that all changed with the addition on the Active Directory module. For the Microsoft Exam 70-640, I’m seeing a couple of changes. In the Maintaining the Active Directory Environment , I’m seeing PowerShell listed with no mention of the DS commands that are taught in The instructor lead course 6425B.  Here are some tips on how to do the PowerShell equivalent of the DS commands.   DSQuery returns objects out of Active Directory.  With DSQuery you can return information on objects in Active Directory DSGet returns specified attributes of an object. DSMod modifies specified attributes of an object. DSAdd creates an object in the directory. DSMove moves an object to a new container or OU. DSRM removes an object, all multiple objects, from the ...

On a GUI version of Windows, you have this nice graphical way of turning on Remote Desktop. Just open the Server Manager and click Configure Server Manager . Click Configure Remote Dekstop and you see the nice GUI below.     Not so for Server Core.  One nice thing is that with the R2 version, we can do this without called a long, cryptic script. Log into Server Core R2. Type sconfig and press Enter . Press 7 for Remote Desktop and the press Enter . Press E to Enable and then Enter . You now get two options.  With WIndows Vista and WIndows 7, you can connect to a remote desktop session more securely than you could with Windows 200 or XP.  If you are only going to connecting with Windows Vista/7/2008, then select option 1.  If you will be connecting to this remote desktop session with Windows XP, click option 2. When you see the above prompt, then Remote Desktop is enabled.

According to Microsoft’s documentation , you can prevent the transfer of data by using AD RMS to restrict the Print Screen functionality. Here is an excerpt from that documentation: Microsoft Sharepoint is not required to install or use AD RMS. Using AD RMS with Microsoft Sharepoint can provide the following benefits: Helps to prevent an authorized viewer from copying, modifying, printing, faxing, or copying and pasting the content for unauthorized use Helps to prevent an authorized viewer from copying the content by using the Print Screen feature in Microsoft Windows Restricts access to content to a specified period of time, after which users must confirm their credentials and download the content again Helps to enforce corporate policies that govern the use and dissemination of content within your organization For additional information, see Microsoft Office SharePoint Server (MOSS)( http://go.microsoft.com/fwlink/?LinkId=154664 ).