Category Microsoft Windows Server 2012

WSUS and Windows 10 Clients – UsoClient.exe

So, you deploy a GPO to Window 10 clients, but your in a hurry to get the clients to check in…

As a SysAdmin for many years I would log on to a client, open command prompt and type :

wuauclt /detectnow  (Windows 7 / Windows Server 2008/2012 clients)

 

In Windows 10 you will notice that it doesn’t do anything and doesn’t show you anything. (As shown above)

(confirmed on https://blogs.technet.microsoft.com/yongrhee/2017/11/09/wuauclt-detectnow-in-windows-10-and-windows-server-2016/)

An example of “Whats New” in Windows 10, and Windows Server 2016 To check or scan “Windows Update” from the command prompt :
CMD (Run As Administrator)
c:\windows\system32\

UsoClient.exe startscan

And there is more switches….

  1. StartScan – Used To Start Scan
  2. StartDownload – Used to Start Download of Patches
  3. StartInstall – Used to Install Downloaded Patches
  4. RefreshSettings  – Refresh Settings if any changes were made
  5. StartInteractiveScan  – May ask for user input and/or open dialogues to show progress or report errors
  6. RestartDevice – Restart device to finish installation of updates
  7. ScanInstallWait – Combined Scan Download Install
  8. ResumeUpdate – Resume Update Installation On Boot

Sysinternals – Permissions, LoggedOn, Endpoints

How to Get the permission on folders:
PowerShell:
Get-ChildItem | Get-ACL
Path | Owner | Access

or more in depth use:

GUI based : Run AccessEnum against the drive or folder – (SysInternals tool) and save to text file (Run as administrator or a specific user)

Who is logged on via the resource shares:
Launch cmd and run PSLoggedon (SysInternals tool)
Displays :
1) Users logged on locally
2) Users logged on via resource shares

List TCP and UDP Endpoints connected
Run TCPView application (SysInternals tool) and save to text file

Ever need to identify the before and after changes in Active Directory
Use : ADExplorer (SystInternals tool)

Download Sysinternals 
https://docs.microsoft.com/en-gb/sysinternals/downloads/sysinternals-suite

Suggested top 10 sysinternals tools
https://www.techrepublic.com/blog/10-things/10-sysinternals-tools-you-shouldnt-be-without/
See an advert of interest, CLICK IT!  This site is funded by AD clicks.

Check / Set / Sync Time Source for Windows Servers

To set the time ( Tested against Windows 2016)

Launch CMD as administrator
exampled c:\time 09:00:00 AM   – This will set the time to 9am

Note a time source if domain joined will up date the time clock again
Check the source
c:\w32tm /query /status Will show the time “Source”

To set an internet based NTP

c:\w32tm /config /syncfromflags:manual /manualpeerlist:”0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org
3.pool.ntp.org”

This will take effect after stopping and starting the W32Time service

Powershell….
stop-service w32time
start-service w32time

for settings to take effect

check status
c:\w32tm /query /status Will show the new time “Source”

To check sync is working
c:\w32tm /resync (Check the time sync)

 

See an advert of interest, click it, this site is funded by ad clicks.

Get-AdUser -Filter {Multiple Filters Complex } -Properties | Export to CSV

#Import AD modules

import-module servermanager
Add-WindowsFeature -Name “RSAT-AD-PowerShell” -IncludeAllSubFeature

#List AD user accounts and show DisplayName, Email, Title and export to CSV

Get-ADUser -Filter * -Properties DisplayName, EmailAddress, Title | select DisplayName, EmailAddress, Title | Export-CSV “C:\temp\Email_Addresses.csv”

#List AD user accounts and show DisplayName, Email, Title and export to CSV. Advanced filter to show ENABLED accounts only

Get-ADUser -Filter {Enabled -eq $true} -Properties DisplayName, SamAccountName, EmailAddress, Enabled, DistinguishedName | select DisplayName, SamAccountName, EmailAddress, Enabled, DistinguishedName | Export-CSV “C:\temp\Email_Addresses_allusers.csv”

#List AD user accounts and show DisplayName, Email, Title and export to CSV. Advanced filter to show ENABLED accounts only and email address ending @test.com

Get-ADUser -Filter {(Enabled -eq $true) -And (EmailAddress -Like “*@test.com”)} -Properties DisplayName, SamAccountName, EmailAddress, Enabled, DistinguishedName | select DisplayName, SamAccountName, EmailAddress, Enabled, DistinguishedName | Export-CSV “C:\temp\Email_Addresses_testdomain.csv”

Get a list of inactive computers which have not logged on to the domain in the last 12 weeks

# Inactive computers ( this will include systems not regularly used)

# Launch command prompt as administrator and run the following commands

Dsquery computer -inactive 12 -limit 500

# Lists computers inactive for over 12 weeks and returns a limit of 500 results

Dsquery computer -inactive 12 -limit 500 | dsmod computer -disabled

# Lists computers inactive for over 12 weeks and returns a limit of 500 results and disables the computer accounts

 

# Similar command can be done for users.

 

Hide Folders Under Share with Access Based Enumeration

So todays challenge. Hide visible folders under share to users who don’t have access.

Example

We create some new shares. Folders are then created under the share and NTFS permissions set.

Share Name : Shared Folder

Folder :

  • IT (NTFS Permissions – IT group Only)
  • HR (NTFS Permissions – HR group Only)
  • PAYROLE (NTFS Permissions – Payrole group Only)
  • ALL USERS (NTFS Permissions – HR Only)

I created a share. When logged in as a user, i could see all the folders under the shared folder.
As you would expect, I could only open the folders I had access to.

So, is this suitable? It doesnt let users in to folders they dont have access to, but it does tell them which folders are there.

So this is where “Access Based Enumeration” might come in. This feature hides folders from users that do not have permission to that folder.
Access based enumeration (ABE) came out in Windows Server 2008.

How to setup Access Based Enumeration:

  • Launch “SERVER MANAGER” (Server 2012 or Server 2016)
  • Click on “FILE AND STORAGE SERVICES”
  • Click on “SHARES”
  • Right click on each share you want to set ABE, select “PROPERTIES”
  • Click “SETTINGS”
  • Click “ENABLE ACCESS BASED ENUMERATION”

The next time a user logs in and views the share only users that have permissions to that folders under the share will be able to see them. The folders they dont have permission to will not appear.

—Always try things in a lab environment, always seek further information before implementing from the vendor i.e Microsoft.com —

SQL 2012 install on Server 2012R2 “Error while enabling Windows feature NetFx3”

Problem… “Error while enabling Windows feature NetFx3″

We wanted to install APP-V 5.x on server 2008 running SQL 2008. At the very start this was a problem. Error you require a later version of the OS etc.

So we deployed 2012 R2, and then started to install SQL 2012….. error during install …

“Microsoft SQL Server 2012 Release Candidate 0 Setup
The following error has occurred:
Error while enabling Windows feature: NetFx3, Error Code: -2146498298, Please try enabling
Windows feature: NetFx3 from Windows management tools and then run setup again.”

Cancel install

We then tried to enable .NET Framework 3.5 on Windows Server 8 using the “Add Roles and Features Wizard” of Windows Serve 2012.

“Failed”

Next attempt.

Load 2012 disk & connect the server to the internet

Launch CMD as administrator

dism /online /enable-feature /all /featurename:NetFx3 /source:d:\sources\sxs

The operation finished successfully from the command prompt.

We then were able to install SQL Server 2012 successfully.

 

We also found this link to be useful for screen shots

 

Change user command to switch a Terminal Services server to Install mode.

KB 320185

How to put a Terminal Services server in Install mode.

You will need to switch to install mode, to install or remove programs on a terminal server.

The method I use the most is :
Open command prompt as administrator

Type:         change user /install
This will change the server to install mode.

Now your ready to install applications.

Switch Terminal Services to Execute Mode, when you are finished adding or removing programs.

Open command prompt as administrator

Type:         change user /execute

Users can now log in and start using the new applications

Create or Remove A Static Route in a Microsoft Windows OS

Route traffic via a specific NIC and IP in most Microsoft Windows operating systems.

Quick guide to create a static route in windows or remove a static route in a windows OS.

List static routes
Administrator command prompt
route print

Create a Static Route
Administrator command prompt
Add example :
route add -p 192.168.10.31 mask 255.255.255.255 192.168.1.1 if 2 metric 5

“if” is the network card number to route through.
metric is calculating the fastest, most reliable, and least expensive routes
-p Persistent
ipconfig /all (Shows the NIC for “if” number.)

Deleting a Static Route
Administrator command prompt
Delete example :
route delete 192.168.10.31

Remote Desktop Server – Customisation and Useful GPO settings

User cannot change an expired user account password in a remote desktop session that connects to a Windows Server 2008 R2-based RD Session Host server in a VDI environment

Hotfix Download Available

https://support.microsoft.com/en-us/kb/2648402

  1. 1. Open the following file: %systemDrive%/windows/web/rdweb/pages/web.config
  2. Set the following value to TRUE: <!– PasswordChangeEnabled: Provides password change page for users. Value must be “true” or “false” –> <add key=”PasswordChangeEnabled” value=”false” />

 

 

Disable IE security in a GPO using reg change

https://4sysops.com/archives/disable-internet-explorer-enhanced-security-configuration-ie-esc-with-group-policy/

 

 

Set Trust sites

http://deployhappiness.com/managing-internet-explorer-trusted-sites-with-group-policy/

 

 

Setup SSO & disable remote app prompt  

http://social.technet.microsoft.com/wiki/contents/articles/2381.how-to-remove-the-access-messages-and-enable-the-single-sign-on-for-remoteapps.aspx

 

 

Deploying RD Session Host Servers or Farms

http://social.technet.microsoft.com/wiki/contents/articles/5466.deploying-rd-session-host-servers-or-farms.aspx

 

How to Remove the Access Messages and Enable the Single Sign On for RemoteApps

http://social.technet.microsoft.com/wiki/contents/articles/2381.how-to-remove-the-access-messages-and-enable-the-single-sign-on-for-remoteapps.aspx

 

 

Deploy Certificates by Using Group Policy

http://www.ervik.as/microsoft/windows-server-2008-r2/3321-how-to-configure-single-sign-on-for-remote-desktop-services

 

 

Enable RDC Client Single Sign-On for Remote Desktop Services

https://technet.microsoft.com/en-us/library/cc742808.aspx

http://blogs.msdn.com/b/rds/archive/2007/04/19/how-to-enable-single-sign-on-for-my-terminal-server-connections.aspx

https://technet.microsoft.com/en-us/library/cc742808.aspx

 

 

How to resolve the issue: “A website wants to start a remote connection. The publisher of this remote connection cannot be identified.”

http://blogs.msdn.com/b/rds/archive/2011/04/05/how-to-resolve-the-issue-a-website-wants-to-start-a-remote-connection-the-publisher-of-this-remote-connection-cannot-be-identified.aspx

 

 

Do you trust the publisher of this RemoteApp Program? prompt even though the Publisher is trusted?

https://social.technet.microsoft.com/Forums/windowsserver/en-US/f47bcba9-67bf-45d0-af3f-fd9b9982ee2a/do-you-trust-the-publisher-of-this-remoteapp-program-prompt-even-though-the-publisher-is-trusted

 

 

Create a Self-Signed Server Certificate in IIS 7

https://technet.microsoft.com/en-us/library/cc753127(v=ws.10).aspx

 

 

IT: How To Create a Self Signed Security (SSL) Certificate and Deploy it to Client Machines

http://www.howtogeek.com/107415/it-how-to-create-a-self-signed-security-ssl-certificate-and-deploy-it-to-client-machines/

 

 

 

 

 

Makecert.exe (Certificate Creation Tool)

https://msdn.microsoft.com/en-us/library/bfsktky3(v=vs.110).aspx

Tested example (sets the start date to 30.6.15 and the end dates is 20yrs+ later.

makecert.exe -r -pe -n “CN=rdscluster.test.world.com” -eku 1.3.6.1.5.5.7.3.1 -b 06/30/2015 -ss my -sr localmachine -sky exchange -sp “Microsoft RSA SChannel Cryptographic Provider” -sy 12 “E:\Media\Cert\rdscluster.test.world.com.cer”

 

 

About Digitally Signing RemoteApp Programs

https://technet.microsoft.com/en-gb/library/cc754499.aspx

 

 

Create RDS Farm – Check list

https://technet.microsoft.com/en-us/library/cc753891.aspx

 

 

Install the RD Connection Broker Role Service

https://technet.microsoft.com/en-us/library/cc732076.aspx

 

 

Add Each RD Session Host Server in the Farm to the Session Broker Computers Local Group

https://technet.microsoft.com/en-us/library/cc753630.aspx

 

 

Configure an RD Session Host Server to Join a Farm in RD Connection Broker

https://technet.microsoft.com/en-us/library/cc771383.aspx

 

 

Configure DNS for RD Connection Broker Load Balancing

https://technet.microsoft.com/en-us/library/cc772506.aspx

 

 

Limit Profile Size

http://www.techrepublic.com/blog/the-enterprise-cloud/limit-profile-size-with-group-policy/

 

Note Files deleted from a network share do not go to the recycle bin. They are deleted permanently

https://social.technet.microsoft.com/Forums/windowsserver/en-US/7119aafa-fe55-470c-ae20-568b80c5dcb4/files-deleting-over-the-network-share-drive-is-not-going-to-the-recycle-bin-it-permanently-delete?forum=winservergen

 

https://social.technet.microsoft.com/Forums/windowsserver/en-US/db181312-bc96-4c3d-b7d6-daa0250b5552/applying-quota-for-user-profile-in-terminal-server

 

Empty recycle bin at log off… GPO log off script –

User Configuration – POLICIES. WINDOWS SETTINGS – SCRIPTS – Logon/Logoff

Add Empty recycle bin batch

http://www.cryer.co.uk/brian/windows/batch_files/how_to_empty_recycle_bin.htm

e:

cd \$RECYCLE.BIN

del /s /q .

 

Types of profiles

http://blogs.msdn.com/b/rds/archive/2009/06/02/user-profiles-on-windows-server-2008-r2-remote-desktop-services.aspx?Redirected=true

 

 

User Configuration – Administrative Templates – System – Logon/Logoff

 

 

SHOW and HIDE ALL DRIVES

      1. A Create one policy for admins with show all drives https://support.microsoft.com/en-us/kb/231289
      2. Create a second policy for all users with hide all drives and a deny apply policy for admins https://support.microsoft.com/en-us/kb/816100
      3. Third policy has all the terminal server config details

 

 

Temporary Profiles Loading

http://social.technet.microsoft.com/wiki/contents/articles/3571.windows-user-profiles-service-event-1511-windows-cannot-find-the-local-profile-and-is-logging-you-on-with-a-temporary-profile.aspx