At My Wits' End: Shortcuts no longer trusted by workstations?

[sonofsanta]

If anyone can fix this I may divorce my wife to marry them if requested. It has all of us stumped.

 

When we came back after the Xmas holidays, some users started seeing errors when they opened shortcuts from the desktop or start menu, as attached:

when attempting to open My Documents

 

When opening a shortcut

 

When opening a shortcut to an EXE

 

(note that I've redacted our internal network name, but it displays correctly IRL)

 

All of these shortcuts are from a single DFS network share that users are redirected to via GPO. Students share one set of desktop/start menu shortcuts, staff share another set. Both kinds of users are affected.

 

It doesn't affect the My Computer and Recycle Bin shortcuts that are put in place by the local client.

 

It doesn't affect shortcuts to URLs, so the desktop shortcut to our helpdesk system, for example, opens fine. So it only seems to be .lnk files, not .url

 

Weirdly, it's not affecting PDFs linked on the desktop.

 

Other potential clues: when users log off now there is nearly always some kind of error copying the roaming profile back across. When resetting a roaming profile, after the user has first logged back on to recreate the profile, not all files will copy across to the network.

 

Nothing changed over Xmas apart from some Windows Updates, but computers that had been in storage since before the holiday also displayed the problem.

 

We were running DFS replication until recently, and I suspect the blame for all this can be laid at its door. DFSR is now disabled entirely, and both fileservers have recently been reformatted, reinstalled, redone afresh, and the problem still exists.

 

Win2k3 R2, WinXP SP3.

 

Even with full control set on the permissions to SYSTEM, Administrators & the relevant user group, the problem continues.

 

You're my last hope, EduGeekers. Anyone?

[3s-gtech]

Internet Explorer. Trusted Sites. Your users have lovely, lovely IE settings to thank for this. Basically, they're not seeing the areas where these links point to as trusted. Should automatically be trusted, but it can slip (used to have this on an old DC). You should be able to force it by changing their IE settings (Internet Explorer Maintenance in GP). Set the areas linked to (file server, DFS share) as Trusted Sites, making sure the definition for trusted fits. Should disappear then. This is a bit of a fudge in all honesty, but that shouldn't cause issues - there may be an underlying cause elsewhere.

[sonofsanta]

Internet Explorer. Trusted Sites. Your users have lovely, lovely IE settings to thank for this. Basically, they're not seeing the areas where these links point to as trusted. Should automatically be trusted, but it can slip (used to have this on an old DC). You should be able to force it by changing their IE settings (Internet Explorer Maintenance in GP). Set the areas linked to (file server, DFS share) as Trusted Sites, making sure the definition for trusted fits. Should disappear then. This is a bit of a fudge in all honesty, but that shouldn't cause issues - there may be an underlying cause elsewhere.

 

Might be worth a go anyway as it's something I need to tidy up for other reasons anyway, but I should add:

* Problem doesn't seem to affect all users, but seems to affect anyone who has their profile reset

* Problem doesn't affect me with my extra god-like administrative powers and privileges

* Early on, at least, it didn't affect people all the time, even on the same PC - so someone could log on a PC, get the errors, log off, log on again and be fine. Which was madness.

 

So a pattern has escaped all investigation so far

[3s-gtech]

DNS scavenging working okay?

[sonofsanta]

DNS scavenging working okay?

 

Event Viewer says so, just run it now and it sez:

The DNS server has completed a scavenging cycle:

Visited Zones = 17,

Visited Nodes = 1037,

Scavenged Nodes = 16,

Scavenged Records = 6.

 

This cycle took 1 seconds.

Which looks like it should

[SkreeM1980]

There is a way of forcing your local domain name into the intranet zone which really helps with this i used a script to import a .reg file onto all machines on startup with the following

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\myadnamehere.local]
"*"=dword:00000001

 

obviously replace myadnamehere.local with your AD name

[srochford]

It definitely looks like trusted zones - we have something similar to that suggested by @SkreeM1980 in our login script (we also add the home directory server as a trusted location and this makes sure that desktop and quick launch icons are trusted)

[sonofsanta]

There's something weirder going on here then, because that key already exists on the PC I'm testing on... as do all the zone mappings I put in the IEAK8 MSI I built yesterday to test... but when I open up IE and actually look at the trusted sites etc., it's pulling them from somewhere else as it has a completely different list. It doesn't let me remove anything either - although the list looks editable (for domain admin only*), and looks like it lets you add/remove sites, when you click OK out the list and go back in, it's reverted to its original state.

 

This has me even more confused, because I know the only GPO that sets them (Under User Config > Admin Templates > Win Components > IE > Internet Control Panel > Security Page > Site to Zone Assignment List). That list doesn't look like the one I'm actually seeing under IE.

 

*Literally just the named domain admin account - my account, with same membership, in same OU etc. has the site list greyed out

 

EDIT: Zone assignments are not currently set by registry either, checking any other computer (that hasn't had this new branding MSI run on it) there's no entry for domains at that location. What else could be setting this if not GPO?

Edited March 10, 2011 by sonofsanta

[3s-gtech]

Do you have Imported Internet Settings overriding it? User Config/Windows Settings/Internet Explorer Maintenance/Security/Security Zones and Content Ratings ? That's how I have mine set, may override the others.

[sonofsanta]

Do you have Imported Internet Settings overriding it? User Config/Windows Settings/Internet Explorer Maintenance/Security/Security Zones and Content Ratings ? That's how I have mine set, may override the others.

 

RSOP says no, and I've manually checked every GPO in the list, and nothing sets it in that way - and if you try and set it that way, Windows has a bit of a whigne about Server 2k3 and the enhanced security etc. etc. which makes it look like a bad idea.

 

I genuinely have no idea where this trusted sites list is coming from :/

[sukh]

Hi

 

A simple test. Can you create a new OU and block inheritence of all GPO's. Add a PC, fresh install to that OU. Create a new test account and logon.

 

What are the results?

[sukh]

Hi

 

If the Site to zone assignment list policy is enabled, the users cannot see the setting and cannot manage their site to zone assignments via the IE User interface.

 

 

If we want to push a standardised list of site to zone assignments but want the user to still be able to manage their own site zones, we should use Internet Explorer Maintenance policy instead and import the security settings from a machine that has been configured with the required zone settings.

 

 

 

User Configuration ->Windows Settings ->Internet Explorer Maintenance-> Security -> Security Zones and Content Ratings-->Import the current security zones and privacy settings-->Add the sites to trusted zone.

 

 

 

For 2003 R2 clients, IE Enhanced Security Configuration feature is enabled by default and a KB was published for this scenario:

 

There is a KB about Site to Zone Assignment List issue:

 

918915 The Site to Zone Assignment List policy prevents Internet Explorer from using other zone configuration settings when the Internet Explorer Enhanced Security Configuration feature is enabled on a Windows Server 2003 SP1-based computer

 

The Site to Zone Assignment List policy prevents Internet Explorer from using other zone configuration settings when the Internet Explorer Enhanced Security Configuration feature is enabled on a Windows Server 2003 SP1-based computer

 

Regards

Sukh

[sonofsanta]

Hi Sukh,

 

Given that no-one can modify the list then - domain admin is the only one with even the appearance of control, even though it's not true - it seems a lot like the GPO doing it then. I can't see anywhere that would have the list set through IE Maintenance.

 

I'll try the new OU malarkey this morning and update again when I know what's happening. Cheers!

[sonofsanta]

Hi

 

A simple test. Can you create a new OU and block inheritence of all GPO's. Add a PC, fresh install to that OU. Create a new test account and logon.

 

What are the results?

 

Brand new OU, completely outside our normal structure, with inheritance blocked, so even default domain policy shouldn't apply.

 

Computer reimaged entirely, updates run. Joined to domain and dropped in this new OU, where it gets no settings whatsoever.

 

New test account also dropped in OU. One GPO linked, to redirect start menu & desktop to copy of relevant locations. Confirmed as only GPO being applied through gpresult.

 

No sites listed anywhere in IE - not in Intranet or Trusted Sites (default settings for automatically detect Intranet etc.)

 

Error still happening

 

So looks like something on the file servers end, maybe...? Presumably something, somewhere on an ACL list or NTFS permissions, because as I've said, file servers were rebuilt over the half term - but files, of course, were just copied back on.

 

EDIT: creating new shortcuts also does nothing - just made a new shortcut to iexplore and it has the same problem.

 

Worth noting that the problem is entirely with shortcuts to programs, apart from My Documents - any shortcuts to files or URLs are OK. Whether this is because of a difference in .lnk and .url files I don't know - can't actually see what extensions the shortcuts have :/

Edited March 11, 2011 by sonofsanta

[sukh]

Hi

 

Thanks for doing the test. Just want to clarify the error still happening. Error as is the sites are still being listed in trusted sites?

 

And we are sure that the in the single GPO applied there is no IE settings?

 

Also, has the new test user got a login script?

 

Thanks

Sukh

[sonofsanta]

Hi

 

Thanks for doing the test. Just want to clarify the error still happening. Error as is the sites are still being listed in trusted sites?

 

And we are sure that the in the single GPO applied there is no IE settings?

 

Also, has the new test user got a login script?

 

Thanks

Sukh

 

Error is still happening as in the shortcuts still bring up a security warning when trying to open them. IE lists no sites anywhere.

 

Linked GPO is a new GPO I made for testing this, and only has the User > Windows Settings > Folder Redirection settings.

 

No scripts of any kind.

[sukh]

OK. My understanding was that there are two issues in this post.

 

1. IE Settings being applied (trusted sites etc...)

2. Shortcuts not working.

 

Are we saying 1 is no longer an issue but 2 is?

 

Thanks

S

[sonofsanta]

Right. Further developments in the land of hair-tearing.

 

Issue 2 (shortcuts) IS resolved by adding domain.local to the Intranet list explicitly. If I open up IE on this new, clean PC, open up Security, Intranet, untick all the boxes, go to advanced and add domain.local explicitly, OK out of everything - problem disappears.

 

Remaining problem now is Issue 1 - IE security settings being applied by mystery policy. RSOP has only ever listed it as coming from the one GPO that now defines a different list (amongst a host of other settings) through site-to-zone assignment - nothing uses IE maintenance to apply the setting, as far as can be seen. Settings are not in the registry of machines so have not been hardcoded into IE8 MSI. Not sure where else it could be coming from...

 

Still completely confused as to how this issue spontaneously arose over the Xmas holidays :|

 

 

EDIT: Adding in the site-to-zone assignment list on that one GPO being applied does work correctly. So there's no reason why just setting that policy on main domain structure shouldn't work, but it's being overridden by something else.

Edited March 11, 2011 by sonofsanta

[sukh]

Hi

 

I was going to ask you to do this on a PC with an issue.

 

1. ck Start->Run, type regedit.exe and click OK to open registry

 

2. Expand to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations

 

NOTE: If you cannot find the Associations key, please manually create it.

 

3. Right click Associations and select New, point to String Value and click it

 

4. Type LowRiskFileTypes as the value name

 

5. After it is created, double click it and type .exe as the Value data

 

6. Quit registry and restart the workstation to take effect.

 

 

 

However, please note that this is not recommended as it opens up your computer to other risks.

 

Right now on issue 2. Do you see any settings in any of the zones which you have set?

 

Also remind me if you have applied your IE8 to this test PC?

 

Thanks

Sukh

[sonofsanta]

Hi

 

I was going to ask you to do this on a PC with an issue.

 

1. ck Start->Run, type regedit.exe and click OK to open registry

 

2. Expand to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations

 

NOTE: If you cannot find the Associations key, please manually create it.

 

3. Right click Associations and select New, point to String Value and click it

 

4. Type LowRiskFileTypes as the value name

 

5. After it is created, double click it and type .exe as the Value data

 

6. Quit registry and restart the workstation to take effect.

 

 

 

However, please note that this is not recommended as it opens up your computer to other risks.

That does sound like rather a scary process to go through - not reg hacking, but that setting in particular...

 

Right now on issue 2. Do you see any settings in any of the zones which you have set?

 

Also remind me if you have applied your IE8 to this test PC?

 

Thanks

Sukh

 

With the new tweak to the GPO, I can see the sites I've added in to the S2Z list reflected in IE8 on the PC in question. It's also greyed out correctly and not letting me edit it, as you suggested it would do.

 

If I login with the domain admin account - which sits in the bog standard Users container - I don't see anything in those lists. If I log on a normal domain machine with the domain admin account, I do see sites listed - which leads me to believe the sites are being set in a computer GPO somewhere...

[sukh]

OK. Point 1 was just to test, as it's resolved we can leave this.

 

As for your other issue, can you move the the PC which you used to logon to with the same domain admin account to the Test OU you created with the other test machine. The run the gpupdates and and gpresult on this PC, reboot to make sure, then try logging on with the same domain admin account on that pc and check?

 

Thanks

S

[Michael]

All of these shortcuts are from a single DFS network share that users are redirected to via GPO. Students share one set of desktop/start menu shortcuts, staff share another set. Both kinds of users are affected.

 

Have you considered moving the shortcuts from a DFS share to a standard share? Unless you're running an exceptionally large network with many servers and users, there's little need to operate shortcuts from a DFS share.

[sukh]

Can you Download the mpsreports tool from this link:

 

 

And select General and Internet and Networking and Business Networks option on the effect machine.

 

The tool will automatically collect the information. This procedure will take 5~10 minutes

 

Can you then send it to me, check the size and let me know how big it is?

 

Thanks

Sukh

[sonofsanta]

Running now.

 

On a normal domain computer though, that I can reproduce the problem on, when I login as the new test user, I'm fine, and the S2Z list is correct for the test GPO. So it is a user policy somewhere, it seems.

 

RE: DFS shares, system has always run happily on DFS shares, and it has advantages for us. I think I tried using a UNC path to the shortcuts the other day and it still didn't work anyway - i.e. was just as bugged as was just as bugged as

[sukh]

Make sure when you run that report, it's on the effected machine with a effected user.

 

Use yousendit, PM me email address and I'll reply back.

Edited March 11, 2011 by sukh