PiqueABoo

That's the spirit. No one's answered the question yet, so after a very quick google I found this Configuring Terminal Servers for Server Authentication to Prevent “Man in the Middle” Attacks. Not necessarily the last word, but it's recent-ish and item 2b (pointing to KB895433) is the 2K3 update I had in mind. And again with 2K8 you just run RDP over TLS with all that security stuff to play with. The only downside, as ever, is the client boxes: If they're "yours", locked down and configured nicely before they get home it's not too bad, otherwise..

I didn't see it in one of your links, but yes - I get that "..cancelled by restrictions on this computer.." message instead. [i'm not convinced that's better than it opening, but them not being able to do anything with it]

Me! Me! Me! I can't get rid of Explorer->Tools->Synchronize... on XP SP3 w. IE7 either. I have all the above mentioned polices set and trust me, they are definitely applied. Well except there is no HKCU "Allow or disallow" with GPMC or in the MS PolicySettings.xls file (for XP) I've been using. The HKLM one is there. I considered hacking it out of the Tools menu but that's not a "nice" thing to do really, plus there it's empty sos *nothing* they can do with it.. life is too short. Before giving up I did wonder there might also be some IE-ish policy involved because on a standalone the only thing in there is Offline Web Pages -> My Current Home Page, and that's something a bit different from standard CSC of fille shares etc. Hmm: Since you'd got me thinking about this I decided to take another swipe at it and this does something: HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions\NoManualUpdates -> 1 (DWORD). I don't know where you'd find that in GPMC/GPME because I just tried with a GPP. Without that selecting Tools->Synchronize gives me a nothing-to-synchronise message. With it, I get a restricted-by-your-admin message. Would be nice to take the entire option off the menu (same as others) though - if that's possible anywhere then I imagine it is an IE policy and somewhere nearby.

Do any of the RDP MITMs people have in mind actually work if you turn on server TLS authentication (something you've had an opportunity to do for years now)? The problem for RBCs/whatever is that you can't rely on people to configure these features, or have genuinely strong passwords etc. , so they're pretty much forced to mandate VPNs. I expect the 2K8 [2k8R2]+ TS[RD] stuff over TLS will get people more in the security groove though... and I'm definitely prepared to argue the case for that vs. splashing out what can often be a *lot* of money on commercial VPNs.

There are quite a few primary schools, and I suppose that might even mean the majority of all UK schools, which one way or another have a single DC+jack-of-all-IT server too.

SR1 now does PXE (which imnsho is the best method in any case) - try that

Nope it doesn't, but as a serious long-term dev I recall going to PDCs specifically to collect betas of 2K (devs were pretty much first in line for obvious reasons), using early versions of VMWare to test code against a collection of OSs & environments including OS betas. And when RTMs of anything came around you already knew everything worked fine on it's predecessors and following timely QA on the RTM, for there was rarely anything much that needed tweaking for userland client-server code. The difference here I suppose is a long period of relative stability with XP/2K3 where devs could get quite complacent, and of course the smaller risk of people moving to someone else's product that does work (and is supported) on the latest platform.

Hmm.. there's no upgrade path from x86 to x64 so that could be interesting i.e. how detachable might the RM stuff be from an x86 CC4 "forest root" server? [it apparently wasn't that easy for CC3 given the BESR swaps to new hardware] Wrong kind of word to use for something like that in front of someone who vaguely recalls doing double-maths and other things like "lemmas" an eon ago

Yup, worked on some stuff with an assorted bunch of HPs not long ago, this (directed broadcast) was one minor ingredient and I think that and it being relative to feature sets is spot on.

Yes they have but not very loudly... this precise topic has cropped up a couple of times on here to my knowledge.. suspect searching for USN will find them, but it's *definitely* worth repeating as it's clearly not widely understood and more and more folk will be getting involved with VMs. I reckon (YMMV) the safe way to do DC snapshots is to shut down all your DCs and then snapshot them - and if you do want to roll back and it's within the tombstone period, shut them down again and revert them all back to that set of snapshots, then of course start them up. Not sure how useful it is, but it's the kind of thing I might consider doing immediately before a round of serious upgrading. The other issue with snapshots is of course performance - can't comment on how much it hurts but I've been assured by a serious expert that it does (and the hit obviously increases with the number of snapshots).

You sure someone wasn't pulling your leg? It took RM a while to sort out the PXE builds that worked from the start in vanilla deployment, but otherwise it is standard Windows OS deployment tech using WIM images and although I suppose someone might have been bored enough to make one, I've yet to see an imagex equivalent that will capture a (single instance file based) a *typical* nix file system to a WIM or write it back to a disk. That you can use this MS tech to cope with Win7 is given[1]. For CC4 I reckon it's more about the Win7 specific policy/lockdown side of things and whether Win7 breaks any of the large number of RM apps running on the workstation. Any news/rumours on the CC4 server OS e.g. 2k8, 2K8R2? [1] You may now need the Win7 WAIK version of PE, the imaging API and tools to do Win7 deployment nicely.. does anyone know?

If you think mailbox rights is elusive, just wait until you want different recipient policies applied to different mail DBs e.g. New-EmailAddressPolicy 'Test Address Policy' -RecipientFilter {((Database -eq 'CN=Mailbox Database,CN=Test Storage Group,CN=InformationStore,CN=SVR-NETBIOS,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=Some Organisation,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=EXAMPLE,DC=COM') -and (RecipientType -eq 'UserMailbox'))} -EnabledPrimarySMTPAddressTemplate 'SMTP:%[email protected]' Adjust and repeat for each DB. Oh look, it's long enough for the forum to decide to put a space in the second "DC"... I just love Exchange powershell commands.

This is relatively mundane *userland* code though, I don't really see much scope for MS throwing major spanners at it prior to release... especially if you're writing your code to run on both the current and future platforms i.e. not going crazy using Win7 only features. And given the current "churn" rate i.e. turnover of OS versions, SQLs, Offices, dotNets and SPs and patches I don't see how you can successfully run a non-trivial s/w project without committing resources to and paying serious attention to the betas and RCs. I suspect it's simply cultural - XP SP3 wasn't that different from a fully patched XP SP2 and IIRC it took at least 6 months, that is far too long, for them to say it was officially supported.

Uh.. are you putting the entire line in the GPP run field? You are supposed to split it like this: Run: C:\Windows\System32\defrag.exe Arguments: C:

Not really - for me an Exchange box only ever runs Exchange and considering how massive/complex that can be (subject to your functionaility requirements), I'm just not that interested in the OS. And if it did run on 2K8 R2 you'd still need an earlier 32bit Windows box with the Exchange Management stuff for PST imports/exports and so on.

You can NOT deploy wireless keys to XP with 2K8 group policy. [search the forums for the WifiCfg_XP which is one way to automate doing that]

"Plays" being about right imnsho. I contemplated moving from a 2K8 to 2K8 R2 base for a production system I'm implementing soon, but quickly decided against that - it was mostly OK but there were a few gotchas for me in the RC, including support with various 3rd party bits and bobs. I'd rather wait for an easier life when things like that have caught up, there's a bit more knowledge of arcane areas out there on the net etc. And I'm still happy enough with relatively undemanding XP on the desktop, especially given that I know all the apps I want to run on it will run on it. Win7 is something I'll look at next year. Basically I don't have a "business case" for 2K8 R2 or Win7 for this scenario i.e. I don't think it's in the user's interest (a bit like a CC3 to CC4 upgrade). There are other scenarios where I do e.g. Hyper-V R2 failover clusters, but that's not notoriously run-of-the-mill school stuff.

There is definitely something that doesn't work consistently for me - copying and pasting a bunch of preferences from one GPO to another. Haven't pinned down the precise circumstances, but roughly 10% of the time the copied prefs haven't worked (until I recreated them from scratch). And another thing although it is a fairly special requirement: I can export GPOs from one domain and import them on another via GPMC. To make settings that refer to security principals (and so on) work, you create a migration table that maps references to say Domain Admins @ Source Domain to Domain Admins @ Target Domain. This migration is fine for standard registry policy, but has no effect on preferences. So before importing GPOs with preferences I have scripts run around grabbing the relevant names and SIDs, then use those for text search and replaces in the various XML files where preferences are stored.

You mention it not working for nested groups - that works fine for me for several things (including those drive mappings) with the XP CSE. Example: User A in Group B. Group B in Group C. Drive mapping preference targeted at Group C => works.

Interesting little article in there about a report on BSF by "Policy Exchange, a right leaning think-tank" based on interviews with a variety of "stakeholders" The article alleges that "when a draft was leaked to PfS ... it resorted to dirty tricks to silence the criticism ... Interviewees were leaned on to tone down or withdraw their remarks, with the implicit threat that their businesses or careers would suffer if they did not". It goes into more detail. There's a PDF of the presumably toned down report PDF here.. Worth a look, although I suspect some of you will take exception to some of what they say on why ICT should be detached from BSF.

I wanted the ability to elevate (turn off some bits of policy for) domain user A when they log on to a specific domain computer X, but not when they log on to domain computer Y. Further, it must *not* affect domain user B when they log on to the same computer X, so good old loopback won't help. And getting user A to logon with a local account on computer X definitely won't cut it. I didn't think I'd ever get around this without some clunky code, but eventually I made this recipe: a) Make and link a GPO with higher precedence than the GPOs containing settings we want to override. b) Using Computer GPP Local Users and Groups add the domain user A to a local builtin group and target this at computer X. Usable local groups are Guests, Power Users, Administrators. [With this GPP you can type any old junk in for a group name, but it only works if GPP can resolve the group name to a SID. Because I was doing this on a 2K8 DC I couldn't browse for the local group and it didn't get the SID, so I fixed that manually by just editing the well-known SID into the relevant XML file in Sysvol] c) Using User GPP make a registry collection and target *the collection* at members of that local builtin group. Within that collection add lots of nicely arranged un-targeted items to undo various bits of normal policy. Now whenever I want to elevate one or more users on one or machines, I just go and repeat step b) above which is relatively easy.

Authenticode: When in doubt over KBs you can usually r-click -> Digital Signatures

One of the screen shots is wrong (power), but this is a nice little summary and one hadn't crossed my mind at all i.e. local admin password changing: 10 things GPPs can do better than your script!

They're hexadecimal - you don't need g-z

Uh huh.. maybe I didn't explain that last sentence well enough. Are you advocating using a PRF e.g. adding just an ImportPrf reg value at logon or something else?