link470

Thanks for your reply. I double checked all policies being applied, and as I mentioned before, the policies applied to both labs are identical. The group policy modeling shows the exact same for the two lab OU's. Extremely confusing. The only thing I can think of is that it's something to do with the image on those lab machines, and nothing server side. I just don't know what to check. I built the images all the exact same way, only making the software different on each one depending on what each lab needed. Extremely confusing, all other labs work perfectly with my test restricted user but I can't roll this policy out until I figure out how to make it work properly with the software installed on Lab 129. IE is literally the only thing I can launch besides Windows Explorer windows. Paint, notepad, other software installed on the machine in Program Files, all fail to run due to software restriction policy. Makes no sense.

Good idea, but the exact same policies are sent to both OU's. The two computers are both in a parent OU called "Student Computers", then there's two OU's underneath for the sole purpose of organization, no policies applied right at the child OU. Room 115 and Lab 129 are the two OU's. Room 115 is one of the many that work with no problems, Lab 129 is the problematic lab. Again, I never would have known by just using the computer, it works great. But when I apply the restriction policy to all students, and they try to log into Lab 129 as a student, that's when I realize I can't open anything. Again, the path's in the properties of any shortcut on both a working computer and a Lab 129 computer both show the exact same path. One works, one's restricted. If you refer back to my first post, you can see that an error showed in the Event Viewer. It's interesting because this should technically be the exact same path on both systems, and yes, .lnk's are in the list of items to block, but the object that's blocked isn't the .lnk file, it specifically shows c:\windows\system32\notepad.exe has been blocked just on that one lab. Anything in Environment Variables that would throw this off? I know I had to modify the path on this lab at the beginning of the year because Mastercam decided it would have some fun and instead of append the Mastercam directory to the end of the list, it would just remove everything in PATH and just add itself. So no login scripts were running at first. I then copied a working path from another computer, and combined it with the custom entries that Mastercam had made, and login scripts started working perfectly. In the Administrator account, if I go to Environment Variables I see TEMP, and TMP directories at the top for User variables, and I also see a PATH directory up there referring to a PTC Pro/ENGINEER program. I don't know if that makes a difference that that's there.

Anyone got any ideas on why this may be?

Thanks for your reply. That's a good thought, but the strange thing is that none of the icons are redirected from anywhere. The start menu's are all local. I build every image the exact same, just loading different software onto each one depending on what lab the image is for. The way I typically build images involves me tweaking the Administrator account to how I want it to look for everyone else, and then I copy the Administrator profile to default profile, and sysprep/image. Everything always works great. This one image though for whatever reason doesn't want to cooperate with the software restriction policies. I just booted up the exact same hardware, one from the problematic lab, and one from one of the many working labs next to each other. I logged in as the restricted test user on each, and on the working one, I was able to launch Word, notepad, anything that was installed right on the system. On the problematic lab, I can't launch a single application except Internet Explorer or a file explorer window. Any more suggestions? Also, I looked at the path as suggested. The path for say, the OpenOffice.org icon on the desktop, is the exact same path on both systems, and both systems have the exact same policy as the policy is applied to the user. Any other suggestions would be greatly appreciated. I really want to roll out this policy but I can't until I get it working with this lab. Do you think anything in the system PATH could confuse it if there's different entries on both machines?

I'm implementing Software Restriction Policies for student accounts in our school and I'm having issues with one of the labs. So far, here's what I've done. I've created an initial test policy with the default rule as disallow, and then added paths as needed [such as network application UNC paths and Program Files, and the default system paths]. These work great on every other lab and system in the school. Using a student test account with that policy enabled, I'm allow to only run what's installed already on the computer, and I can't run any executables from USB drives, student H drives, my documents folder, desktop, user profile, and other locations besides Program Files and application drives. On this one lab however [all lab computers are the same image, different image per lab], the computers won't allow a student with this policy enabled to run ANY application. Internet explorer works, and that's about it. Everything else, including Notepad, fails to launch and says that there's a software restriction policy preventing it. I logged into another computer in the lab just to make sure there wasn't something going on with that exact computer, but I got the same results on the next machine. When I log onto the machine as a local administrator and pull up the Event Viewer, I see the following entry for Software Restriction: Access to C:\Documents and Settings\Test-Student\Start Menu\Programs\Accessories\Notepad.lnk has been restricted by your Administrator by the default software restriction policy level. Sure, .LNK is an extension that's included in the default designated file types list in the policy, but why isn't it affecting any other system builds in the school? I really want to roll this out because students are starting to use tor for web browsing and playing games brought in via USB drives. This would work perfectly for preventing all of that, and it works for every system. But this lab of 10 computers doesn't work with it, so I can't roll out the policy until I find out what's causing it. Any advice would be greatly appreciated. Please let me know if anyone needs more information.

Shouldn't make a difference. For IT site templates for example, they're each exact copies of the IT template site root that I designed. One root [and propagated down] has permissions for everyone and IUSR, and the other has permissions for only IUSR. The IUSR one is the one that looks wrong. The only difference between the two directories is permissions, they have identical files.

Yup, all servers have all updates as of this past Tuesday.

Thanks for your reply! I managed to get the server up and running. At the moment, the permissions are Everyone read, which I'm not a fan of, but that's the only way it seems to work. The website is up and for the next few days it's critical to stay online so I'm not sure if I should make any tweaks. Ended up installing PHP 5.2.11 since I've had luck with that version especially on server 2008 even though this is a server 2003 box. The other interesting thing is when I remove Everyone's permissions on the web root, I don't get a 403 or 401.x error, I get a 404. Just page cannot be found. Doesn't prompt for a password, just can't find the page. The only thing now is it seems a bit slow serving PHP pages. Static HTML is no problem. But there's a lag [5 seconds or so] between pages for PHP [MySQL is installed locally, but these are PHP pages even that aren't using a database]. I'm using PHP-CGI, wondering if that may be an issue and if I should use FastCGI instead. I've never had luck getting ISAPI to work on Windows. ::EDIT:: Wow...so that's interesting... First off, here's the website in question: http://sisp.sd63.bc.ca/ I pulled an old IT site template I had made awhile back as a test and put it in the root under a folder IT-1, I gave it only IUSR read permissions. Then, I made a copy and called it IT-2, and I added Everyone as well as IUSR. Look at the difference. IT-1 IT-2 Any ideas?

Windows Server 2003 with IIS 6. I'm in a huge pickle at the moment. Somehow something happened to one of our web servers and I can't make it serve web pages as IUSR. I've always used the builtin IUSR account to serve websites from IIS and our other IIS server is working just fine. This one however doesn't want to show anything when the contents being published has IUSR as read/execute [i get a 404 page]. However, if I add everyone to the list, I can see contents from a web browser. I'd type more of a description but I'm frantically trying to get this web server back up. I need it running for tomorrow. Any help would be greatly appreciated. I know I didn't provide much information at all. PHP was installed, but I uninstalled it in the mean time to remove any complications. I'm just trying to serve some HTML pages right now and even that seems to prove too difficult a task for IIS 6 to handle. I've tried a few means of resetting the IUSR account's password and trying things listed here and here but I'm not having much luck.

Came to edit this post so I could change the title and add a [sOLVED] tag but editing is turned off after a short period of time. It ended up being that failing mirror hard drive. I broke the mirror, swapped the drive, and we're good to go. No problems! Man, took me way longer than I should have though. I had two dynamic disks in a mirror [software RAID 1] and I right clicked the problematic one and chose remove mirror. After that, the original mirror wouldn't boot [fun!] so I spent today doing lots of research. Ended up getting everything back by getting the good mirror disk plugged into my desktop with an IDE to USB converter, running a command line tool called TestDisk 6 which converted the disk back to a basic NTFS disk without damaging the files, which made the disk readable, and then I popped the drive back into the server, booted from the recovery console of a Windows Server 2003 installation cd, and then rebuilt the mbr using the fixmbr command. Everything worked perfectly, and I was able to boot from the hard drive after editing the Boot.ini file to not show the software mirror anymore. Beauty! Popped another drive in, converted both disks to dynamic, and rebuilt the mirror. Good to go.

Hey everyone! Got a server here that's been chugging along great, nothing has changed to it, it's an ISA server and it's configuration has remained the exact same. Recently, I walked into the server room and noticed the hard drive activity light was on for a long period of time, so I RDC'd into the server and noticed it was rebuilding it's mirror [Windows software mirroring, 2 drives]. I had a look through the event viewer and found that it had restarted. The strange thing is I had RDC'd into that server a couple days prior on Patch Tuesday and had a look for what it needed, but didn't install anything. It's uptime at that point was around 80 days, no problems. So I didn't think anything of it. But somehow within the last 2 days, the darn thing has restarted itself around 10 times, maybe more. The only thing I've noticed is that one of the disks in the software mirror has an exclamation point over it, so I'll replace that later today, but still, that shouldn't matter shouldn't it? That's the point of a software mirror, it should operate on one disk. This is the only suspicious item in the event log: The COM sub system is suppressing duplicate event log entries for a duration of 86400 seconds. The suppression timeout can be controlled by a REG_DWORD value named SuppressDuplicateDuration under the following registry key: HKLM\Software\Microsoft\Ole\EventLog. Is that normal? I actually filtered the System for event ID 10026 which is the one above, and it looks to be normal, it's been occuring on every start up the server has ever had. So maybe it is the disk...who knows? Thought I'd poll my favorite group of IT troubleshooters over here. Thanks guys for any advice! I'll be doing the usual memory test and hard drive tests later today. PS. Coincidentally...I woke up this morning, and my personal desktop, which has had 0 problems since I purchased it in January 2004...had an unexpected shutdown last night. Still trying to find the problem, but that's unrelated I'm sure.

Great! Thanks guys, I'll look into these solution possibilities and report back if I have any issues.

Post copied from my post at TechRepublic Hey everyone, Interesting question here. I run a small network for web hosting. I have ISA at the perimeter, and a web server, mail server, and database server inside the network. My question is about the web server, Windows Server 2008 running IIS 7. I have a few clients/friends who would like the ability to schedule scripts to run for websites they're working on. This is very easy to do if the client uses a UNIX based web server with an SSH connection and creates a cron job using crontab, but how do I do this with someone only having FTP access to their web root on the server? Yes, I can schedule the task for them using Scheduled Tasks. But there has to be a better way. I don't have time at the moment to rebuild my network and use UNIX/Linux hosts, and as much as I wouldn't mind creating tasks for my users/friends, they'd love the ability to schedule a "cron job" themselves on my web server. I tried Googling but all I could find were articles repeatedly saying "oh that's easy you just have to use Scheduled Tasks!". That's great, for me. But my users only have FTP access, not administrative RDP access to the box. Thanks in advance for any advice!

Errr...so uh...came in this morning, and a student came up to me saying "I tried repeatedly logging into my account...but it says now that my account is locked out" and I thought "nah it can't say that, I don't have that policy working". I checked his account in Active Directory, low and behold, his account was locked out. I tried logging into a test account and changing the password...policies are working! Why it took that long? I have no idea! But it's working!

I tried calling Microsoft to help me with this issue, but they were about to charge me $300. No thanks. ::EDIT:: Gahhhh, even more annoying, I just ran Group Policy Results on the test staff machine with a test staff user, and the correct password policy is apparently being applied no problem. ::EDIT:: New development, looks like the Default Domain Policy is only effecting local accounts, which there are none. I just created a new local account to test on the same staff test machine, and tried to change the password. It told me my password must be at least 7 characters, and cannot repeat any of the last 10 passwords. Correct! Now how do I make that apply to a DOMAIN user?!

I was wondering about the conflicting settings to be honest. I found some other GPO's that for some reason had 2 password policy fields set in them. No idea why, they didn't need to be there, so I pulled them, but they weren't the Default Domain Policy. Nothing else contains any password policies, only the Default Domain Policy now. Here's a question though, if Microsoft only allows the Default Domain Policy/Domain Security Policy [which I think are the same thing, the second shows up if you're looking directly on the server in Administration tools] to have the password policy in them in Windows Server 2003, why does Windows Server 2003 allow you to make password policies in more than one GPO if they aren't going to work or apply anyway? Because people who don't know this magic tidbit about Windows Server 2003 only using password policies from the Default Domain Policy now must be pulling their hair out trying to figure out why they don't work.

Hey guys! Here's a fun one, another password policy issue. I've got a Windows Server 2003 domain here, and I'm trying to configure a password policy for the school. I use Group Policy Management on my Windows XP here to manage our Domain's policies using the Administration Kit. I'm working with the Default Domain Policy within the root of our Domain. I've set the password policy to: Enforce password history: 10 Max age: 180 days Min age: 0 days Min Length: 7 Complex: disabled This is all fantastic, but when I go and log in to a teacher account and try to change their password, they get a prompt that says password must be at least 0 days old, cannot repeat any of your previous 0 passwords, and be at least 30 days old. I have NO idea where it's pulling that from. I can't find it anywhere. I double check on our domain controller directly that Domain Security Policy matches, and it does, exact same settings as listed above. But nobody can change their password because of these settings that are apparently coming from somewhere. Any advice would be great! Thanks!!!

Wow! That looks like just a really nice version of Hotmail. Looks good!

Wait, they can run the Setup file for Firefox? Or the Firefox executable itself? If they can run the Setup and successfully install it, that may be another issue. I like to start at most secure, rather than most convenient when doing Software Restrictions. I start at everything restricted, and then only allow locations like Program Files to allow executables to be ran. I then just have to make sure that none of the places I allow to run executables allow users to write, because then they can place an exe of their choice into the folder that has execute permissions and run whatever they like. rvdmast covered this 4 posts up.

I've used it in the past and had no issues. Great product.

If you run Start>All Programs>Accessories>System Tools>Internet Explorer with no addons, and clear all temporary files completely and try again, do you still get the error? Is your IE version fully up to date [8 with the latest patches from Windows/Microsoft Update].

I find these some of the more important devices to install. Try installing the chipset driver [using the full executable as it usually installs some components that just installing INF's through device manager won't pick up] and any card reader drivers. I never like seeing an unknown device before deploying an image, I always make sure an up to date driver for anything is sent out first. A lot of the time I like going straight to the manufacturer of the individual component, not even the manufacturer of the computer, such as HP or Acer. I'll install, say, Windows XP, and all drivers from the computer manufacturer website or from Microsoft Update, and I'll find that some drivers are dated 2003, 2004, etc. I'll go to the manufacturer's website of the actual individual component and find that a new driver for 2008 was released and is much better. I see what you're saying though about some drivers not being good and tested for the machine, but in my experience I haven't had any issues.

Is the Local Security Policy even enabled in Windows XP Home AXE? I don't remember it being there, although I haven't touched Windows XP Home in quite some time. The only way I know of in Windows XP Home is to restart the computer and boot into safe mode. The security tab is shown if you log into an administrator account via safe mode in Windows XP Home.

I'm using the Barracuda Web Filter 310 here at the high school I'm at. Works great, has strict safe search as an on/off option out of the box and has always worked. I'd be surprised if Websense of all companies didn't have that built in. Is it something you can ask a Websense support representative about?

Hate to bump this, but still looking. Anyone know of any good PHP/MySQL freeware inventory software for any product and multiple locations, not just IT? Thanks!