mistersparky

Good morning everyone! I've got a strange issue with auto-processing on some of our Exchange resource mailboxes. These resource mailboxes have all been configured with relatively standard auto-processing rules, however not all meeting requests appear to be accepted automatically, with no clear pattern as to what is and is not accepted. For a given resource mailbox, if I take a look the deleted items I will see multiple meeting requests which correspond to requests that the resource mailbox has received and fall under the in-policy criteria for the resource, and which were automatically accepted and added to the calendar (with the meeting request itself deleted). However, if I look at the inbox for the same resource mailbox, I see multiple meeting requests that also fall under the in-policy criteria, but which for some reason are not auto-accepted by the resource mailbox. Does anyone have any ideas what could be causing this, or what I could test to try and resolve? Thanks in advance for any help with this!

Good evening everyone! I’ve got a question regarding handling the Exchange Online mailboxes for staff leavers. We currently have a hybrid setup with Exchange 2010 on-prem servers running alongside Exchange Online E1 and E3 licenced users. With have Azure AD sync in place to replicate relevant AD details to Office 365. For leavers with on-prem mailboxes, we will disable the account and remove from groups, leave the mailbox active for a few months with necessary auto-replies and forwards in place, then delete the mailbox after a given period of time. With Exchange Online mailboxes, the mailbox is lost within a short period of time of the associated AD account being disabled. I’d like to find a tidy way to disable the accounts as required, whilst maintaining the mailboxes. I believe holds and converting to shared mailboxes are the recommened approach for this, however I’ve got a few questions: Is an Exchange Online license reserved for the duration of a hold on a mailbox? Holds only seem to be available for E3 licenses and above. Is it possible to just upgrade an E1 license to E3 shortly before implementing the hold and disabling the account? Do holds allow mailbox, auto-responses and forwards to run on the mailbox? With the approach of converting to a shared mailbox, what’s the best way to keep track of desired deletion times for such mailboxes? How difficult is it to handle return staff for mailboxes that have been converted into shared mailboxes? Finally, I’d love to hear what approach you take, and the pros and cons of your choice. Thanks in advance for any help or advise!

Some questions on the WiFi front: Does the problem happen more often when using the laptops in the same location, or when using larger numbers of laptops? Do you have good WiFi coverage around the building? What have you done to avoid overlapping 2.4GHz channels (have you had some kind of WiFi survey done, manual settings, or is it managed by the WLC?) How much is connecting via 802.11b/g? I've seen some strange situations where 802.11b/g/2.4Ghz n devices with faults/poor signal can drop the bandwidth across the SSID (I think a common workaround for this is to data rates than 11Mb/s for the 2.4 GHz 802.11b/g/n networks). I had a lot of problems a few years ago with a situation not to dissimilar to this that, much to my frustration, I was unable to resolve. Some of the details of this eppisode can be found here: http://www.edugeek.net/forums/windows-server-2008-r2/108941-roaming-profie-oddities.html. The biggest takeaway I took from all of this is a lot of functionality one would associated with a managed Windows desktop environment (roaming profiles, folder redirection, network drives, other general GPO policies, etc.) simply don't work well over low bandwidth, poor signal WiFi networks. It might be somewhat stating the obvious, but I think it would be good to start from checking the WiFi network. Is coverage as good as it can be, are there any settings or tweaks you can put in place to improve the network? Is it possible to get any users to connect over wired connections?

Assuming this is a VM, is the VM itself set to sync time with the host? You can find the options for this here: In general, I've always avoided this and stuck with the built-in time functionality within Windows. However, it would still be highly advisable to configure the ESXi hosts to sync to a valid time source (if you are not doing so already), to avoid issues such as this, maintain accurate log times, etc.

A few follow-up questions: What OS iis the server? How behind (if at all) are you on Windows Updates? What version of VMware tools are installed? Is the server running anything else other than print services? For the drivers already installed, what driver isolation is configured? Where is the OS getting stuck during the long restarts? (check via vSphere console)

Good morning everyone! We have a number of users with access to shared mailboxes. These mailboxes are usually added as secondary mail accounts, in online mode, within Outlook 2013 clients. Users are reporting that view settings for these shared mailboxes synchronise between users. So, if a user applies a particular filter or sorting to the shared mailbox, these view settings syncronise across all users of the shared mailbox. Is there any way to have view settings for such shared mailbox to be local, and not synchronise across all users of the shared mailbox? Thanks in advance for any help with this!

Hello everyone, I have the following server: HP DL360p G8 Latest BIOS and drivers ESXi 5.5 U1, HP custom image, latest update patches. Running in stand-alone mode (no vCentre Server). Windows Server 2008 R2 Standard, latest updates. 53c1030 PCI-X Fusion=MPT Dual Ultra320 SCSI card HP Ultrium 2 SCSI tape drive Backup Exec 2010 R3 I am trying to use all of the above to run backup file shares and Exchange MBs from another server. To even get an active path on the SCSI adapter to the tape drive I had to run the commands form this thread: https://communities.vmware.com/message/2307054. With the tape drive installed I am now getting pretty terrible results trying to backup to tape. Every once in a while a job will finish, but most commonly they will either fail (with the file share backups often failing during the verify phase), or simply time-out, with the tape drive itself appearing to go offline. Once in this state, a host restart is required to release whatever lock is in place on the tape drive. I have tried different drivers (HP and Symantec), different SCSI BIOS settings, trying to match SCSI IDs to VMware device IDs (there are a few links that suggest this as a solution) and also running the SCSI card in bypass mode on the ESX host (the VM wouldn’t even boot with this configured). None of these things seem to make much of a difference to the success rate of backup jobs.Any ideas as to what could be causing this? I’d be very grateful for any suggestions!

Hello everyone! I am looking at configuring a fresh set of directories for user home folders & documents redirection. I have a few questions about the finer permissions of this process. In the past, I have always followed the Microsoft TechNet “Security Recommendations for Folder Redirection” guide (Security Recommendations for Folder Redirection: Group Policy). However, I have noticed that an increasing number of sources recommend “Read Attributes” and “Traverse Folder/Execute File” permissions for users at the root of the share, in addition to “Create Folder/Append Data” & “List Folder/Read Data”. I have also noticed a couple of sources recommending adding further permissions, such as “Read Extended Attributes” & “Read Permissions”. Which of these is the best option? What considerations are there for taking the various approaches? Second of all, most sources indicate that “Creator Owner” should be given full control of subfolders and files from the root of the documents share. This should give users the ability to change ownership and permissions on their files – do they actually need full control or would modify permissions suffice? Thanks in advance for any help with this issue.

Good morning everyone! We currently run Active Directory Certificate Services across our domain. We have a stand-alone root certificate authority and a single intermediate certificate authority. We use Group Policy to deploy the root and intermediate certificates to workstations and auto-enrol the workstations using the “Computer” template. We are looking to expand upon this setup by adding a second intermediate certificate authority from the root that at the least can serve a separate site and at best can provide some redundancy for certification requirements. However, I am unclear on some of the mechanics of this and relevant documentation appears sparse. A few questions: I don’t see anywhere in Group Policy where I am able to actually specify what intermediate CA to enrol with. I am assuming that this is dictated simply by which intermediate certificates are published via Group Policy? If this is correct, if we wanted to have workstations enrol with multiple intermediate CAs would it just be case of publishing each of them via GP? Is there any way to influence which of the two intermediate CAs a workstation will enrol with? Is it possible to set up cross-certification, where certificates from one intermediate are trusted by the other? Is there any way to have a workstation enrol with more than one intermediate CA? Thanks in advance for any help with this enquiry!

Good morning everyone! I am currently in the process of creating dedicated accounts for a number of services that currently use domain admin credentials. One of these is DNS dynamic updates. The domain itself is 2003 functionality level, with 2003 DCs and DHCP and DNS on DCs. Taking a look on the MS MVPs website (DHCP, Dynamic DNS Updates , Scavenging, static entries & time stamps, the DnsUpdateProxy Group, and DHCP Name Protection - AD and Exchange Quantum Singularity), I believe I need to do the following: Add DHCP DC to DnsUpdateProxy security group. Change DHCP to update all records. Secure update settings are already in place, so no need to change this. Create a standard domain user account and configure DNS dynamic updates to use this. Clear all current DNS entries. No 2008 R2 servers, so no securing DNS update proxy group or name protection. Can anyone spot anything missing from this list? If not, that looks like quite a lot of change to enable a least privilege service account, and quite possibly a number of negative security changes. Would it be better to just create a service account with sufficient permissions to update DNS records, when required? If so, what permissions would such a service account require? Thanks in advance for any help with this enquiry.

The old network manager understands well enough as they (me!) have worked in IT in education for a decade, including 2 years in this role. Ultimately, the call to make it part time was not mine. As to whether it the right call or not, I would quote pantscat: 650 students, 150 or so staff, just under 600 end devices. So, not big but not small either. I think it's a relatively well-oiled ship, although there will certainly be challenges moving forwards. The ICT techs are also pretty good, and have been getting increasingly involved in higher level tasks over the last 18 months. I think ultimately the job will be whatever the new NM makes of it, and the role is a great opportunity for someone who is looking for something that matches the time requirements.

Nope. The position was full time on a lower scale, but it was decided with the old network manager (me!) moving on that the nature of the role would be changed. In addition to the network manager role, there are two full time network technicians in place.

As title, an opening for the Head of Technical Support/Network Manager at Christ's College, Guildford. Permanent Contract. 15 hours a week. 52 weeks a year with 24 days (pro – rata) annual leave. Pay: Pro–rata to SP10 in the range £36,965 - £41,942 depending on experience. Actual salary based on minimum point: £15,402. Full job description here - http://www.christscollege.surrey.sch.uk/user/74/112973.pdf. Application form here - Vacancies. Please feel free to drop me a line with any questions!

OK, a few updates: We have deployed a GPO to disable slow link detection on all workstations across the domain We have added the Microsoft KB2775511 updates to our WSUS server to deploy to all workstation PCs - however, we cannot deploy these fixes to our user and roaming profile fileshares as they are currently running on 2008, not 2008 R2 servers. This update is now on 75% of our workstations and counting. However, I am pretty sure we are getting problems both on PCs it is and is not installed on We are still getting a slow but steady stream of students with folder redirection settings going missing. I don't think we have once had this for a member of staff, with the only major difference between these users being students heavy use of wireless networks. Could this be related to laptops sleeping/now shutting down, as opposed to general wireless logon attempts? We are using DFS-N for our roaming profile and are not using FQDNs for these shares when configuring the profiles. I would be more concerned about both if it were not for the fact that our staff users pretty much never exerience these issues I've tracked a good number of logins for users who are having these issues, and there seem to be a good number of similarities: ntuser.ini file in the root of the users roaming profile resetting to not include the folders configured in GP to not be included in the users roaming profile Multiple missing keys under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer in the users ntuser.dat registry file, including User Shell Folders and Shell Folders Event Viewer logs similar to the ones below (taking out direct references to our domain, usernames and directory paths): This has been going on for far too long now, creating extra work and hassle for our users. We would really like to get to the bottom of the issue and in turn would greatly appretiate any help in getting it fixed. Many thanks for the reply. As mentioned, we are deploying the updates across our network now. There are some really great suggestions in there about wireless. Some of them we already do (non-overlapping channels), some of them we don't but at some point I would like to (such as the seperate VLAN for wireless devices, they currently share our student PC vlan). However, although I am pretty confidant that the problem is being created by users logging in on wireless domain devices, shouldn't there be a difference between "now working very well/general slowness" and flat out "breaking things"?

Thoes settings look OK to me. Certainly the DNS settings are set the same as on our DHCP server, although I know some people say that having the DHCP server manage DNS entries might not be the best thing. The scavange settings also look OK, although off the top of my head I cannot remember best practice for ratios of DHCP leases, refresh and non-refresh times. There is a pretty good guide here that covers the lot - DHCP, Dynamic DNS Updates , Scavenging, static entries & time stamps, the DnsUpdateProxy Group, and DHCP Name Protection - AD and Exchange Quantum Singularity One more quick question - I take it the mac addresses for the network adaptors on the host PCs match the uniquie ID entries on the DHCP leases? One thing you could try - deleting forward and reverse entries for a single device in that address scope with a missing name entry in DHCP (ideally a test PC or similar) then restarting it. See if creating a new entry in DNS (as opposed to refreshing an exsiting entry) solves the problem. It probably won't, but it's an easy thing to try that shouldn't break anything else.