Jason Yoder, MCT

This question came from one of my Active Directory classes. To find the solution, I installed RSAT on a Windows 8 client.  I also created a user named JYoder who is not a member of any special group. I also had to do a little bit of detective work to figure out a small piece of this puzzle. The first real big problem is that I noticed the Last Name field is missing from the Delegate Control Wizard. We are missing the SN attribute which is the last name.  Here is where the fun starts.  On the client that you are using to delegate rights, Open dssec.dat   You will find it in %Systemroot%\System32 .  Make a copy of this first and then open it in Notepad. Now, scroll close to the bottom.  You will notice that the file is divided into object types.  Close to the bottom, you will find the User object.  Look for the SN field in the user object.  Make sure, you are in the user object. Now, look for SN=7.  Change this to SN=0.  Save the ...

This one was actually easier than I thought.  Robocopy seems to do a good job at this.  I created a folder structure that had empty folders and some NTFS permissions.  I called this folder that I wanted to copy Copytest.  I then executed this Robocopy command to make a copy of this folder structure on another hard drive. Robocopy e:\CopyTest c:\CopyTest /sec /mir The /SEC preserves the permissions and the /MIR creates a mirror of the original location on the destination.

This is a question that I often have to ask a user.  The problem is that our users answers cannot always be considered…shall we say “reliable.”  Below is a PowerShell function that you can use to to determine when the client in question was last started.  Here is what you get when you run this function. PS C:\windows\system32> Get-LastStartTime -ComputerName Work-PC Last Startup Time: 12/31/2012 1:44:43 PM I’m using this as part of the HelpDesk module that I creating for my up coming book and also I’ll be demonstrating the full module at the Cincinnati PowerShell users group meet up on Thursday, February 21, 2013.  Here is a link to the event .  Our focus will be on using PowerShell with your Help Desk. # ............................................................................. # Function Get-LastStartTime # Retrieves the last start time on the client machine. Function Get-LastStartTime { Param ( $ComputerName = "." ,     [ Sw...

Updated: 2016MAY04 To clarify when this functionality is available, you can only save the view when you are viewing a Data Collection Set.  The "live" data cannot be saved in this way. Performance Monitor in Windows Server give us the ability to see when our servers are having some issues.  Analyzing that data into something meaningful can be a problem.  You can export your data to Excel so you can better see what your performance data represents.  First collect your data. Right click the graph and select Save Data As . Change the Save as type to Text file (comma delimited)(*.csv) . Give the file a name and save it where you want to store it. Now open that file on a client with Excel installed on it.  By using excel, you will be able to present the data in a more meaningful format.

To be able to do this in your domain will require some setup work.  First off, you need to configure a Group Policy to ensure that the proper events are being audited on your clients.  As with all Group Policy, you must make sure that the policy is scoped to reach your clients, and that you have allowed ample time for the policy to be replicated in your domain, downloaded to the clients, and applied. Note: This will only work for client that are Windows Vista or later. The audit policy to set is: Logon/Logoff Events with the sub category of Other Logon/Logoff Events set to capture Successful events. In your Group Policy, follow these instructions. Expand Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Advanced Audit Policy Configuration \ Audit Policies \ Logon/Logoff Double click Audit Other Logon/Logoff Events Check Configure the following audit events . Check Success Once this policy is applied to your clients, you will now be able to l...

This is one that I have been thinking about for a while. One of my students in a server 2008 class pointed me to an article that corrected my train of thought. The question is, why is the Everyone group granted access when a share is created? Remember, I’ve been an MCSE since Windows NT4. At that time, the Everyone group included all authenticated users, and those who were on the network anonymously. I found this to be a security vulnerability so I have been advising students to remove this and use the Authenticated Users group instead for general share access for your entire domain. (Caution, it you have a trust relationship set up with another organization, they are also a member of the Authenticated Users group.) This article from Microsoft explains that the anonymous users have been removed from the Everyone group. This change happened in Windows 2003/XP.

By default, authenticated users can connect to a WDS share and read the .wim files.  When a user performs a PXE boot using the boot image provided by WDS, their domain credentials can be used for authentication.  This is the default behavior for the share. If this is not desirable in your environment, create a new security group that contains the users that you want to be able to access the share. Grant this group the ability (at minimum) to Read & Execute ,   List Folder Contents , and Read . Then remove the Authenticated Users group. Once this is completed, if a user attempts to authenticate to the WDS server, this is what they see: The user will not be presented with any images.   If the user is in the correct security group, they will get a listing of the available images to select from.  

You can restrict the type of USB drives that are allowed on your clients be using group policy. I would like to give a word of caution when implementing this. You should consider having a “Support Device List.” This will allow your organization to formally declare what can and cannot be plugged into your USB drives. Without such a list, a constant flow of requests will come in to add more and more devices. It is best to draw the line early and have a formal review process to make sure that the number of supported devices does not become unmanageable. Settings to control USB Device Access: Policy Location Computer Configuration \ Administrative Templates \ System \ Device Installation \ Device Installation Restriction Policy Name Prevent installation of devices not described by other policy settings Setting Enable Configuration   Description Prevents other USB devices from being installed unless they are specifically allowed in a policy. Procedure to get Pl...

Here is the official word from Microsoft :   In particular, this paragraph: What is Key Management Service (KMS) and how does it work? KMS is a lightweight service that does not require a dedicated system and can easily be co-hosted on a system that provides other services. With KMS, you can complete activations on your local network, eliminating the need for individual computers to connect to Microsoft for product activation. A KMS host key is used only to activate the KMS host with a Microsoft activation server. A KMS host key can activate six KMS hosts with 10 activations per host. Each host can activate an unlimited number of computers. If you have an existing machine configured as Windows KMS* host, you will need to enter and activate the Office 2010 KMS host key before the KMS host can activate Office 2010, Project 2010, and Visio 2010. If you need additional KMS activations so you may activate more than 6 KMS hosts, find the telephone number for your Microsoft Activat...

Many years ago, Microsoft allowed users to logon to Windows clients utilized a set of cached credentials.  These were credentials from a previous authentication with a domain controller.  This allowed for two things.   1) The user could log on to a mobile computer without contacting a domain controller and, 2) The user could logon to the client before the network connection initialized.  This gave the appearance of Windows booting faster.  It is also why the hard drive is still going strong on the I/O operations after you log in. By default, Windows 7 stores the last 10 logged on users credentials and Windows Server 2008 stores the previous 25.  You can change these values to better suite your organizations needs. Click Start . Type Regedit and press Enter . Browse to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Current Version\Winlogon\ Change the value of CachedLogonCount to any value between 0 and 50.   Giving the value of zero will ...

On some installation of Server 2008, the Reliability Monitor does not record data.  The instructions below are from Microsoft and I’ve tested them out.  They do work.   Click Start , type Task Scheduler in the Search box, and then click Task Scheduler . Enable the trigger that regularly starts the RacTask task. In Task Scheduler, expand Task Scheduler Library , expand Microsoft , and then expand Windows . Right-click RAC , click View , and then click to select the Show Hidden Tasks command. Note If the Show Hidden Tasks command is already selected, go to step 2c. Double-click RacTask . In the RacTask Properties dialog box, click the Triggers tab. On the Triggers tab, double-click the One time trigger. In the Edit Trigger dialog box, click to select the Enabled option, and then click OK . In the RacTask Properties dialog box, click OK . Close Task Scheduler. Update a registry setting. Click Start , type Regedit in the Search box, and then clic...

Below is a screen shot of an IPConfig /all command: The question from class is “What is the DUID?”   According to section 9 of RFC3315 , DHCP servers use DUIDs to identify clients for the selection of configuration parameters and in the association of IAs with clients.  An IA (Identity Association) is a collection of addresses assigned to a client.  The DUID must be both unique in the environment and to be dynamically created.  This is because some devices cannot store this information.  For this reason, a DUID is generated in one of 3 ways.  The link above contains more detailed information. Link-layer Address Plus Time Vendor-assigned unique ID based on Enterprise Number Link-Layer address

During a DFSR sysvol migration on Windows Server 2008, problems can occur with the migration of Read Only Domain Controllers. See the image below. The RODC is stuck trying to move to the Prepared state.  First go to the RODC and type Repadmin /SyncAll /AeD .   On the PDC Emulator, run dfsrmig /GetMigrationState . If the migration completed, continue on.  If not type dfsrmig /CreateGlobalObjects . This will manually create the global objects for DFS replication. On the PDC Emulator, run dfsrmig /GetMigrationState . You should be ready to move on to the next step in the migration process.

To test this out, I used NETDOM QUERY FSMO to make sure that all the FSMO roles were on the server that I was about to demote to a member server. When DCPromo was executed, the FSMO roles were transferred to another DC.

Backing up your EFS key can help you recover files in the event you suffer a hard drive loss.  Obviously this will not help recover lost file on the crashed hard drive.  For those encrypted files on the crashed hard drive, hopefully you have good backups.  To back up the EFS certificate on your client, you first need to make sure you have encrypted at least one file or folder.    Open a command prompt and type Cipher /y     This displays your EFS certificate thumbprint.  Now that we have established that you have one, lets back it up.  Type Cipher /x . Click OK . Provide a name for the file you want to export to certificate to. Provide a password and confirm it to protect the key.   To recover the certificate, you need to use the certificate mmc. The end user who owns the certificate must log on to the destination computer. Open MMC by typing mmc in the Run dialog box. In the File menu, click Add/Remove Snap-in ....