Firefox

Within Sites and Services, if you haven't already, add all the subnets that exist in your organisation. These subnets then will need to be linked to a site. You can add multiple subnets to a site without too many issues. This controls the site each subnet goes to for authentication. If you have knowledge consistency checker turned on.....which I believe is default. Then it should auto calculate the replication links that it requires. Under intersite transports and then IP you can create site-to-site links which allows you to have some control on the frequency of the replication. As previously stated, having addition DC's on other sites, has previously been the preferred method for combating slow links.

Hello, I have a user that needs to RDP to one of our Windows 2008 R2 servers, but everytime they try, they receive a message simply saying "Access Denied". Checking the event log on the server doesn't show any particular alerts that relate. The user is in a group that allows logon locally, remote desktop users, logon through terminal services. We have other people in the same groups and they can successfully logon. The issue seems to somewhat relate to profiles. The user has a profile usernameRDS.v2 for which they have full control over. On the server there is an environment variable that converts %osver% to RDS Within ADUC the profile path points to username%osver%. I have ensured the user has full control over both of these folders, still no joy. I deleted the RDS folder in the hope this will be created when the user logs on...no joy. However, if I totally remove the profile path from ADUC...then the user can successfully RDP the server. Anyone else come across this?

In all honesty it's probably due to lack of understanding. What would happen to the user desktop if the user wasn't connected to the network? what would get loaded? would it simply load the icons from the local copy of the "sync'd" folder that was redirected? Does this rely on roaming profile at all? as we have disabled romaing profiles for anyone using a desktop device

Excuse my ignorance, but if the File Resource Manager service lives on the server, how does it prevent the user creating files on their local desktop? Does it mean the server is in contant communication with the device? or that it downloads the "rules" from the server upon logon?

thanks for the replies - seems there isn't an ideal way of achieving this :-( Looked at the resource manager, but i guess that just stops the upload and not the creation?

Hello, I am currently looking for a way to lockdown the Windows desktop to only allow shortcuts to be created by the user. Is there a simple way to achieve this? This is to help control the size of the user profile. Have already looked at the desktop redirection idea, but that doesn't really suit our needs

Absolutely perfect Not much changes with 2010 User Configuration\Administrative Templates\Administrative Templates(ADMX Files)\Microsoft Office Outlook 2010\Disable items in user interface\Custom, double click Disable command bar buttons and menu and enter the same ID 17648 Many thanks for helping with this...how did you track down the specific ID of that menu item?

The suggestion here would be to turn cached exchange mode off...But I wish to leave cached exchange mode on, but disable the ability to "ignore" as I can see this causing all sorts of problems

Ok it seems MS in their infinate wisdom added a new feature that lets you "ignore a conversation" this sounds like a great idea for all the tech minded people. But what about the users who accidentally turn this on? It seems if you are running cached exchange mode there is no obvious place to disable this option. Anyone else had much luck with this? Ideally I'd like to grey the option out...have been looking for registry hacks, but not much posted online.

To get what I said above to work effectively the users XP and W7 profiles would need to be in the same share, as obviously AD will only point to 1 location for each user

For our servers we use accounts that don't actually have profiles attached (speeds up login) but you could add an environment variable to your servers should you so wish ;-)

Within your AD path you put username%osver% You then create profiles for each OS with the OS version in the profile name e.g usernameXP usernameW7.v2 Then on your XP machines you create an environment variable with the name osver and value XP for Windows 7 machines do the same but the variable is W7 - these can be both set via GPO Then when you logon, AD will put th ecorrect profile depending on your OS

I assume you are using a completely different profile for XP and Win7? and that the profile ends in .V2? this is an inbuilt requirement of windows 7 We call our profiles UsernameW7.V2 then then add an environment variable via group policies preferences with a name of osver and the value W7. Within AD we point the users to ProfileShareLocation\Username%osver% the variable that is then applied to Windows 7 will then work out which profile it needs to load. Also clear down any local profiles the affected users might have, also look at HKLM\Software\Microsoft\Windows NT\CurrentVersion\Profilelist expand this key and check none of the SID's below match an affected user....delete if necessary

You say killed access...but what do you mean? does it simply not run? does it run but then error?

ah unfortunately we're using CIF shares so now sure we can implement this. What adverse effect would be seen from simply deleting desktop.ini from the My documents folders? in testing I noticed if deleted it does not get recreated, and I'm not seeing any obvious detremental effect. It seems desktop.ini is initially created when your roaming profile first updates when logging off of a Windows 7 device. When using just a local profile the desktop.ini is not created. After first upload of the file, if I delete it, subsequent log on/off events do not create another ini file.

Have you considered just going for a 2008 install? unless you plan to "test" an upgrade to 2008 in your environment? Configurations such as AD, DNS, FSMO roles remain very much the same

We had over 3000 printers that needed migrating, and the easiest option by far was implementing Windows 2008 32bit print servers. As you can imagine having that many printers, we have a large number that don't even have a 64bit driver :-( It's not ideal, but we plan to look at this again in the future when we have everyone on Windows 7 and we can "lose" the unsupported printers :-D

What Operating system do the current DC's have in your domain? if you wish to install a 2008/2008 R2 DC into an existing domain then yes you will need to run adprep with potentially the forestprep command and most definately the domainprep command. This should not need to be ran on exchange. Once this is complete then you'd need to run a dcpromo from the new 2008 server to make it a domain controller. A quick question, how come your exchange is in a different domain?

As long as you have a trust between the 2 domains in question it shouldn't be a problem, I must admit to not using Exchange 2010 as yet, but I know it's easily done in previous incarnations

I'm assuming you mean using DFS replication? Do you have have a DFS setup? e.g a friendly name for users to connect to the resources on the server. Because assuming the 2008 box now has all the data, you can simply change the backend server (target) within DFS and to the users all will look the same.

Do you need FRSM installed on all DC's for this to work? Also how when choosing the File screen Path, do you select a network location? I seem only to be able to select local drives

I already have a central store though :-(

Hello, Ok I have a domain that is fully Windows 2008 R2 and another that is currently in mixed mode with a 2008 R2/2003 mix When logging onto group policy from the full 2008 domain I appear to have extra settings - Windows 2008 R2 - User Configuration>>>>Administrative Templates>>>>Start Menu and Taskbar = 76 settings Mixed Domain - User Configuration>>>>Administrative Templates>>>>Start Menu and Taskbar = 63 settings Initially I thought this was due to the policy templates having not been updated in the mixed domain. But I have now copied over both the PolicyDefinitions and Policy updates folder and the same result. My mixed Domain has both Windows 2008 R2 and Windows 7 machines, and we were lead to believe this was the minimum requirement for managing Windows 7 devices via GPO. Any ideas?

1) I'm guessing you have not blocked Inheritance inheritance anywhere in your structure? 2) Have you filtered the GPO to only to certain users\groups 3) Have you filtered to apply to a particular WMI service? 4) Have you made sure that the policy settings you have made are under User Configuration and not Computer Configuration? 5) Have you made sure the User Configuration is enabled? 6) Check the Group policy ordering, to make sure your policy applies last (top of the list) when you run a GPRESULT /R does it tell your your policy should be applying? Also I assume you are operating all in 1 domain? otherwise you might need to consider loopback

How do you cope with users folders that already exist, and therefore already have a desktop.ini?