jklight

If you come up with something please post back.

i just fixed this on a lab today. Checked application event log and it said permissions were wrong on a file that MS Visual Studio left behind. it was in the C:\users\default\ something something folder. so i wrote a script to do icacls \\computer\c$\users\default\whatever /reset /t /c /q and now no problem! Probably could have delete the file.

probably can do with dos for command like this: for /D %a in (\\server\users\yeargroup\) do icacls %a /grant itstaff:F I have used the script that follows in the past to fix problems. It querys AD first to select users you need fixing and the does the ICACLS work on their homedirectory taken from AD. REM reset users permissions REM @[u][url="http://www.edugeek.net/member.php?u=16971"]echo[/url][/u] off if {%1}=={} @[u][url="http://www.edugeek.net/member.php?u=16971"]echo[/url][/u] syntax: %0 Description&goto :EOF dsquery * domainroot -filter "(&(objectCategory=Person)(objectClass=User)(description=%~1)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(homedirectory=*FILE-SERVER*))" -limit 500 | dsget user -hmdir -samid -c > out.txt for /f "skip=1 tokens=1,2" %%a in (out.txt) do call :resetp %%a %%b goto :EOF :resetp if /I %1 EQU dsget goto :EOF TAKEOWN /F %2 /R /D Y > NUL icacls %2 /reset /Q /T /C >>log.txt icacls %2 /setowner %1 /Q /T /C >>log.txt icacls %2 /grant:r administrators:(OI)(CI)(F) system:(OI)(CI)(F) %1:(F) "creator owner":(OI)(CI)(IO)(F) /Q /C >>log.txt

Rem uninstall old versions "%~dp0sw_uninstaller.exe" /s msiexec /uninstall "%~dp0sw_lic_full_installer.msi" /qn /norestart /l*v "%windir%\temp\shockwave_uninstall.log" REG DELETE HKCR\Installer\Products\388E33E771D079344A165B6706E5431B /f REG DELETE HKCR\Installer\Products\7C43C21609E58D74B9C5F017D78D7262 /f REG DELETE HKCR\Installer\Products\CB540FA28F8E71F40859861EE4CC32F4 /f SW_uninstaller.exe downloaded from Adobe sw_lic_full_installer.msi was latest (12.1.6) downloaded from Adobe

Sometimes i have resorted to adding this to the local logon script: cscript c:\windows\system32\prnmngr.vbs -t -p "Whatever Printer You Want Default"

Could you give more detail? Default printer is a user setting so it should stay set to whatever the users selects and survive reboots.

dsquery user ou=Students,dc=school,dc=net | dsmod user -hmdir \\srv1\share\$username$ -hmdrv H: Using DSMod to update Active Directory | CRMguru

One of the things delprof2 (Delprof2 - User Profile Deletion Tool) says it can do.

Section from my student account creation script that does the share and permissions: function createUserDirectory { #CREATE USER DIRECTORY try { $homeDir=$UsersDir+"\"+$User if (!(Test-Path -path $homeDir)) { New-Item $homeDir -type directory | Out-Null Set-ItemProperty $homeDir -name attributes -value ([system.IO.FileAttributes]::Hidden) } } catch [Exception] { write-host $_.Exception.ToString()+" "+$homeDir+$Logon+"ERROR 700"; ExitWithCode (700) } $LocalPath="M:\"+$School+"\students" $Sharename = $Logon+"$" $checkShare = Get-WmiObject Win32_Share -computername $HomeSrv -Filter "Name='$ShareName'" if ($checkShare -ne $null) { # "Share exists and will now be deleted!!!" write-host "Share exists and will now be deleted!!!"+$ShareName get-WmiObject Win32_Share -computername $HomeSrv -Filter "Name='$ShareName'" | foreach-object { $_.Delete() } | Out-Null } try { #share the new home directory $Class = "Win32_Share" $Method = "Create" $description = "Home drive for:"+$User $sd = ([WMIClass] "\\$HomeSrv\root\cimv2:Win32_SecurityDescriptor").CreateInstance() $ACE = ([WMIClass] "\\$HomeSrv\root\cimv2:Win32_ACE").CreateInstance() $Trustee = ([WMIClass] "\\$HomeSrv\root\cimv2:Win32_Trustee").CreateInstance() $Trustee.Name = "EVERYONE" $Trustee.Domain = $Null $Trustee.SID = @(1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0) $ace.AccessMask = 2032127 $ace.AceFlags = 3 $ace.AceType = 0 $ACE.Trustee = $Trustee $sd.DACL += $ACE.psObject.baseobject $mc = [WmiClass]"\\$HomeSrv\ROOT\CIMV2:$Class" $InParams = $mc.psbase.GetMethodParameters($Method) $InParams.Access = $sd $InParams.Description = $description $InParams.MaximumAllowed = 4 $InParams.Name = $Sharename $InParams.Password = $Null $InParams.Path = $LocalPath+"\"+$user $InParams.Type = [uint32]0 $R = $mc.PSBase.InvokeMethod($Method, $InParams, $Null) switch ($($R.ReturnValue)) { 0 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Success"; break} 2 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Access Denied" -foregroundcolor red -backgroundcolor yellow;break} 8 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Unknown Failure" -foregroundcolor red -backgroundcolor yellow;break} 9 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Invalid Name" -foregroundcolor red -backgroundcolor yellow;break} 10 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Invalid Level" -foregroundcolor red -backgroundcolor yellow;break} 21 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Invalid Parameter" -foregroundcolor red -backgroundcolor yellow;break} 22 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Duplicate Share" -foregroundcolor red -backgroundcolor yellow;break} 23 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Reedirected Path" -foregroundcolor red -backgroundcolor yellow;break} 24 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Unknown Device or Directory" -foregroundcolor red -backgroundcolor yellow;break} 25 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Network Name Not Found" -foregroundcolor red -backgroundcolor yellow;break} default {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:*** Unknown Error ***" -foregroundcolor red -backgroundcolor yellow;break} } } catch [Exception] { write-host $_.Exception.ToString()+$Logon+"$ "+$LocalPath+"\"+$user+"ERROR 800"; ExitWithCode (800) } try { # set access permissions $acl = Get-Acl $homeDir $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Logon,"ReadData,ReadAttributes,ReadExtendedAttributes,ReadPermissions,WriteData,AppendData,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,Delete,Synchronize,Traverse,TakeOwnership", "ContainerInherit", "None", "Allow") $acl.AddAccessRule($rule) $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Logon,"ReadData,ReadAttributes,ReadExtendedAttributes,ReadPermissions,WriteData,AppendData,WriteAttributes,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,Delete,Synchronize,TakeOwnership", "ObjectInherit", "InheritOnly ", "Allow") $acl.AddAccessRule($rule) $acl.SetOwner([system.Security.Principal.NTAccount] $Logon) Set-Acl $homeDir $acl } catch [Exception] { Start-Sleep -Seconds 60 # WAIT AND TRY AGAIN $acl = Get-Acl $homeDir $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Logon,"ReadData,ReadAttributes,ReadExtendedAttributes,ReadPermissions,WriteData,AppendData,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,Delete,Synchronize,Traverse,TakeOwnership", "ContainerInherit", "None", "Allow") $acl.AddAccessRule($rule) $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Logon,"ReadData,ReadAttributes,ReadExtendedAttributes,ReadPermissions,WriteData,AppendData,WriteAttributes,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,Delete,Synchronize,TakeOwnership", "ObjectInherit", "InheritOnly ", "Allow") $acl.AddAccessRule($rule) $acl.SetOwner([system.Security.Principal.NTAccount] $Logon) Set-Acl $homeDir $acl }

I would use the commands from the other thread i linked to. for /? to see lots of help and examples for the for command.

Please use icacls instead of the older and problematic cacls Icacls: The New and Improved Cacls? | Security content from Windows IT Pro also, see this thread http://www.edugeek.net/forums/scripts/131364-icacls.html

dsquery * domainroot -filter "(&(objectCategory=Person)(objectClass=User)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(homedirectory=*server1*))" -limit 500 | dsget user -hmdir -samid -c > out.txt for /f "skip=1 tokens=1,2" %%a in (out.txt) do copy \\server\share\file %%a\folder\file

Password Policy Windows server 2008 R2 added a feature called "fine-grained password policy" which is what i think you are looking for. It does not look straight forward to implement and I have not personally tried to implement. Good luck.

A bit of a mess but maybe you can get what you need out of it! #CREATE USER DIRECTORY try { $homeDir=$UsersDir+"\"+$User if (!(Test-Path -path $homeDir)) { New-Item $homeDir -type directory | Out-Null Set-ItemProperty $homeDir -name attributes -value ([system.IO.FileAttributes]::Hidden) } } catch [Exception] { write-host $_.Exception.ToString()+" "+$homeDir+$Logon+"ERROR 700"; ExitWithCode (700) } $LocalPath="M:\"+$School+"\students" $Sharename = $Logon+"$" $checkShare = Get-WmiObject Win32_Share -computername $HomeSrv -Filter "Name='$ShareName'" if ($checkShare -ne $null) { # "Share exists and will now be deleted!!!" write-host "Share exists and will now be deleted!!!"+$ShareName get-WmiObject Win32_Share -computername $HomeSrv -Filter "Name='$ShareName'" | foreach-object { $_.Delete() } | Out-Null } try { #share the new home directory $Class = "Win32_Share" $Method = "Create" $description = "Home drive for:"+$User $sd = ([WMIClass] "\\$HomeSrv\root\cimv2:Win32_SecurityDescriptor").CreateInstance() $ACE = ([WMIClass] "\\$HomeSrv\root\cimv2:Win32_ACE").CreateInstance() $Trustee = ([WMIClass] "\\$HomeSrv\root\cimv2:Win32_Trustee").CreateInstance() $Trustee.Name = "EVERYONE" $Trustee.Domain = $Null $Trustee.SID = @(1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0) $ace.AccessMask = 2032127 $ace.AceFlags = 3 $ace.AceType = 0 $ACE.Trustee = $Trustee $sd.DACL += $ACE.psObject.baseobject $mc = [WmiClass]"\\$HomeSrv\ROOT\CIMV2:$Class" $InParams = $mc.psbase.GetMethodParameters($Method) $InParams.Access = $sd $InParams.Description = $description $InParams.MaximumAllowed = 4 $InParams.Name = $Sharename $InParams.Password = $Null $InParams.Path = $LocalPath+"\"+$user $InParams.Type = [uint32]0 $R = $mc.PSBase.InvokeMethod($Method, $InParams, $Null) switch ($($R.ReturnValue)) { 0 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Success"; break} 2 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Access Denied" -foregroundcolor red -backgroundcolor yellow;break} 8 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Unknown Failure" -foregroundcolor red -backgroundcolor yellow;break} 9 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Invalid Name" -foregroundcolor red -backgroundcolor yellow;break} 10 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Invalid Level" -foregroundcolor red -backgroundcolor yellow;break} 21 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Invalid Parameter" -foregroundcolor red -backgroundcolor yellow;break} 22 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Duplicate Share" -foregroundcolor red -backgroundcolor yellow;break} 23 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Reedirected Path" -foregroundcolor red -backgroundcolor yellow;break} 24 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Unknown Device or Directory" -foregroundcolor red -backgroundcolor yellow;break} 25 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Network Name Not Found" -foregroundcolor red -backgroundcolor yellow;break} default {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:*** Unknown Error ***" -foregroundcolor red -backgroundcolor yellow;break} } } catch [Exception] { write-host $_.Exception.ToString()+$Logon+"$ "+$LocalPath+"\"+$user+"ERROR 800"; ExitWithCode (800) } try { # set access permissions $acl = Get-Acl $homeDir $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Logon,"ReadData,ReadAttributes,ReadExtendedAttributes,ReadPermissions,WriteData,AppendData,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,Delete,Synchronize,Traverse,TakeOwnership", "ContainerInherit", "None", "Allow") $acl.AddAccessRule($rule) $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Logon,"ReadData,ReadAttributes,ReadExtendedAttributes,ReadPermissions,WriteData,AppendData,WriteAttributes,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,Delete,Synchronize,TakeOwnership", "ObjectInherit", "InheritOnly ", "Allow") $acl.AddAccessRule($rule) $acl.SetOwner([system.Security.Principal.NTAccount] $Logon) Set-Acl $homeDir $acl } catch [Exception] { Start-Sleep -Seconds 60 # WAIT AND TRY AGAIN $acl = Get-Acl $homeDir $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Logon,"ReadData,ReadAttributes,ReadExtendedAttributes,ReadPermissions,WriteData,AppendData,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,Delete,Synchronize,Traverse,TakeOwnership", "ContainerInherit", "None", "Allow") $acl.AddAccessRule($rule) $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Logon,"ReadData,ReadAttributes,ReadExtendedAttributes,ReadPermissions,WriteData,AppendData,WriteAttributes,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,Delete,Synchronize,TakeOwnership", "ObjectInherit", "InheritOnly ", "Allow") $acl.AddAccessRule($rule) $acl.SetOwner([system.Security.Principal.NTAccount] $Logon) Set-Acl $homeDir $acl }

If i remember correctly, pinned items are stored in the registry (at least in XP) so you would need to pin what you want and then save the profile and then make it a mandatory profile.

please don't use cacls.exe (unless you have Windows Server 2000!) use icacls.exe cacls has always had problems and even icacls had problems in Server 2003 and 2008 but i am sure i read (and tested) that in 2008 R2 and later those have been fixed!

my script for creating students has this to set owner $acl.SetOwner([system.Security.Principal.NTAccount] $Logon) I remember it being a lot of trouble to figure out!

I use gam to manage my google apps for education so just for fun i tried this: $username = Read-Host "Enter Username" new-item -itemtype directory -path "C:\$Username" c:\gam\gam.exe user $Username language en-GB Worked like a champ! created the folder and modified the users setting in Google apps.

The description doesn't go in the settings. From Boardguy (via the link you provided) New-MDTComputer -macAddress $machines[$i].mac -description $machines[$i].name -settings @{ So your modified code would look: [color=#333333]Import-Module –name C:\Scripts\MDTDB.psm1[/color] [color=#333333]Connect-MDTDatabase –sqlServer MDT –instance SQLEXPRESS –database MDT[/color] [color=#333333]$machines = Import-Csv C:\scripts\machines.csv[/color] [color=#333333]For ($i=1; $i -le $machines.count; $i++)[/color] [color=#333333]{[/color] [color=#333333]New-MDTComputer -macAddress $machines[$i-1].mac [/color][color=#333333]-description $machines[$i-1].name [/color][color=#333333]-settings @{[/color] [color=#333333]OSInstall='YES';[/color] [color=#333333]OSDComputerName=$machines[$i-1].name;[/color] [color=#333333]OrgName='myschool'[/color] [color=#333333]}[/color] [color=#333333]}[/color]

Would you mind posting your relevant code so we can take a look?

Download Windows Media Encoder 9 Series from Official Microsoft Download Center I used windows media encoder on windows xp many years ago but they do have a version for win7

Industrial Canless Air System - Canned Air and Air Duster Alternative | 200+ MPH Air compressors can get water in the line so be careful. They do make inline filters to remove the water so if i were go that route and do a lot of computers I would be sure to get one.

Seems do able, but lots of testing ahead. Take a look at: Google Apps – Active Directory Sync | Patrick Kremer Google Apps Directory Sync - Google Apps Help Google Apps Password Sync - Google Apps Help https://developers.google.com/google-apps/sso/saml_reference_implementation

Don't use mapped drives.

For windows xp clients, look in C:\WINDOWS\Debug\UserMode\userenv.log it is where windows logs this sort of stuff.