PiqueABoo

Write enough code and your next util is mostly a cut & paste from an old one. I've just made one very, very quicky called "DoToOU" because I wanted to point an arbitrary command at every computer in or below an arbitrary OU in AD. Kind of like this: DoToOU someOU "C:\Some Folder\app.exe" /c:%comp% /v /r:"D:\Some Other Folder" someOU: is in easy format (if there's only one called "Room 1" that's all you need to type and you can qualify that with parent OUs until it is sufficiently unique e.g. "C-Block\Room 1") %comp%: where I put the computer name before executing the command. The rest is the external command and it's arguments/switches. --- Does anything like that exist already and if not, would it be genuinely useful? It achieves what I want now, but I'm trying to decide whether it's worth spending any more time (sometime) with idiot-proofing, an option to test whether comps are alive before doing anything and multi-threading to speed it all up by spitting out commands concurrently.

Yup.. because it's been maybe year since I did something for real with those utils, which as lots of irksome folk used to say is about 10 years at "web-speed", and what I knew then has been displaced by the million things I've had to know since. [Or: I've forgotten the syntax and I vaguely recall it was non-trivial]

I'm looking for a command line find and replace that will recursively search some file spec e.g. *.txt in some folder and replace "some text" with "some other text". So far I've found replace.exe 1.1 (bestcode.com) which may well do the trick. Anyone used and fond of anything else for this? [Have previously used and know about win32 ports of nix utils like sed]

Mmm.. but has update 11 fixed the broken (silent) uninstallation of update 10 or not? Or doesn't anyone care about things uninstalling? Everyone else who tried uninstalling 10 appears to have hit the same issue as me i.e. it won't uninstall unless you stop the quick-start service first. When looking at that I discovered there are command line switches for the quick start service EXE, one of which claims to removes it completely (who needs it anyway?). So you might want to do that at install time.

I'm looking for what I used to be able to do with search in 2003 Explorer. Seemed to do what I wanted using a boolean in the search box e.g. *.txt AND fred found text files with the word "fred" in them, but that didn't find what it should for *.xml. I just don't like or trust the new Explorer search - another baby/bathwater thing.

Admin is logged on in front of 2008 server, but if you RDP to it and log on as Admin to do some remote uhh.. admin, you essentially kick them off and take over their desktop. I'm sure there's a way to fix that so both folk can work using the Admin account at the same time - might have even fixed it on one box but I've forgotten the details. Anyone?

An update on CreateXMLFromEnvironment.wsf mentioned in another post. I made a migration table to map various bits in the source domain to equivalent bits in a new domain and CreateEnvironmentFromXML.wsf more or less worked very nicely - created OUs, groups, users, GPOs, and linked the GPOs in the right places with the right security. The only bit I missed was a command line option for the script to stop users being automatically set to Disabled on creation. But either it's my naff migration table or nothing got translated in the Preferences. These are stored in XML files in a sub-folder in the GPOs, so I ended up finding and replacing things that needed translating, manually.. well kind of.. used wingrep for that because I've yet to figure out how you search a given folder for *.xml files containing "sometext".. ..this kind of search was routinely trivial in XP/2K3 but I gave up trying in 2K8... anyone know if you can do it?

[Please save any mention of shell folder redirection for another thread] It's possible some of this is editing GPOs on 2008. Go to a GPO to folder redirect Documents (in this case based on group) and pick the action "Create a folder for each user under the root path". For \\\somepath\ it ends up looking like this: \\\somepath\%USERNAME%\Documents If instead you use "Redirect to the following location" and you type the entire path (note this now contains "My"): \\\somepath\%USERNAME%\My Documents Then exit and go back to it again, it still has the path you entered but has automagically changed the action to "Create a folder for each user under the root path". And with that action displayed on the redirect no one will ever figure out how you got that "\My Documents" at the end rather than it's usual "\Documents". Figuring out how the "My" got there just took me an irritatingly long time. I now hate the GUI for this policy area and next time I think I'll just go and edit the fdeploy.ini directly.

This is why I have nothing but fond memories for a couple of mail "servers" I ran a long time ago that used to keep your e-mail in the file system (some still do) i.e. one text file per e-mail. Pointlessly prettified mail kind of breaks it now, but worst case then you could just get mail-addicted users to point notepad or equivalent at a folder. Exchange's big mysterious database with those potentially huge integrity scanning/fixing timescales is definitely something to consider when picking a mail server. Not that I've seen a store issue for a long time, but I've had to run some of those scans in environments where mail was much more credibly business critical and yeah... much too, much too long.. restores are the only practical way out of these scenarios. Very few do... you need all that time, a lab bench with at least one DC, Exchange and a workstation and backup/restore. That's easier now though with VMs and I bet there isn't anyone who's been through an Exchange DR who wouldn't strongly recommend maybe a week configuring and playing with this and writing down all the important steps. DR prep and practice has been a chapter or two in decent Exchange books since they started writing them.

dsmove.exe with a couple of arguments for moving OU. net.exe with a couple of arguments for adding removing from a group. Much of a muchness but I'd probably go for groups because net.exe syntax is easier and is already installed everywhere you might need it. The group can be anywhere, the point is to use it for security filtering on the GPOs that apply to the users i.e. SinBin group is denied apply access to normal GPO, SinBin is only group that can apply the naughty GPO.

Mine stuck on PXE booting, specifically WDS TFTP doesn't respond (to a sensible request from the workstation) after the exchange of a few network packets. [Only installed WDS for MDT LiteTouch PXE booting so gave up and I'm happily using SolarWinds TFTP instead]

That's an approach to a slightly different problem.. in this case I want to copy a lovingly created OU structure, including it's groups, linked GPOs and a few standard user accounts to a completely *new* domain with a different name etc. Have been playing with the export to XML side of this and having skimmed through the resultant XML file it looks good. A few initial observations: -It only handles basic GPO security-filtering e.g. it doesn't capture Deny. I worked around that on a couple GPOs that have filtering by taking Apply away from Authenticated Users, then giving Apply to all groups that need it. The original Deny approach was simpler, but.. -The importing I haven't touched yet will in principle create users, groups, group memberships, set user profile paths and home drives. But sadly the export doesn't capture a user account's profile path and home drive so you have to edit the XML to add those. -The scripts are from the standard GPMC ones you get on 2003, but I'm doing this on server 2008 where they're not included by default, You have to download them from MS and one day I might figure out where the MSI installer puts them on the system! I gave up looking and extracted the scripts from the MSI with the (free) "qwerty.msi". - Being a bit of a pessimist I wasn't 100% sure this would backup the GPO Preferences I've configured here and there, but they are definitely present in the GPO backup folders.

Long shot I suspect, but has anyone used this GPMC script to back up some OU branch and all the GPOs applying to it? And more to the point has anyone subsequently used CreateEnvironmentFromXML with a migtable to import that backup into another domain? Does it just work? Aim is to get test domain config on to a live domain. I've done this before the hard way (manually via the GPMC, with backups, GPO creation & importing via a migtable), but this looks like a lot less hassle.

Well I guess they're not going to give your current ISA for free. YMMV but I'd be more offended by (what I presume is) some app protocol squatting on 16,000 ports.

I have a simple SRS GPO with a UNC path rule banning default executables (including .LNK) on a particular server share. I put one .LNK and one .EXE in that share. The SRS GPO is linked to a user OU and when one of those logs on it works i.e. both the LNK and EXE are banned. The SRS GPO is also linked to a computer which has a loopback replace policy. The SRS policy appears to be happily delivered to a user logging on to that computer because it is in their ntuser.pol (viewing/dumping those is a recurrently useful trick). For them the EXE is banned, but the LNK works. To me that suggests something other than the SRS GPO is involved in stopping that LNK working in the first case. But what? Must be something, does anyone know what I might be missing here?

I've got a mystery control ID for word 2003. I've got a pretty good dump of control IDs for menus, toolbars. The former is not in the latter VBA isn't exactly one of my strong points. Is there some easy way with VBA to use that control ID, discover whether it is valid and if it is, dump some info to give me a clue to it's nature?

There's an MS KB somewhere telling you how to create and only "pin"/cache files for a primary user (you set an account as a Primary User on a box with a few regedits).

Absolutely - I've scripted a complete DHCP setup and the post-install config uses netsh.

OK I'm having second thoughts and now reckon these KBs might be intended as a monthly list of what you need. There's an example here: Cumulative update packages for Office 2003 SP3, Project 2003 SP3, Project Server 2003 SP3, Visio 2003 SP3, SharePoint Services SP3, and SharePoint Portal Server 2003 SP3: October 28, 2008 Dunno.

MS claim to make a cumulative update for O2K3 SP3 every month and there are KBs for that, but no obvious download links. How/where do you get these? Or is hiding them away just another annoying symptom of their genuine advantage thing.

Nope.. but since the last version or so I've stopped using it (too buggy).

Nope.. well I do to make this favourites redirection work, but the user doesn't get to see the drive. I'm into "less is more" for pretty much everything and think it's easier for people to understand having one way to get to their work, rather than two. It's also one less AD account attribute to configure or reconfigure in future. I am doing that but I'm using a GPO Preference which are easier and given the targeting features etc., is much nicer than making ADMs. Attempt #2... you make a default roaming profile by copying one that you've typically set up for a local account to a Default User folder in the netlogon share. That profile will have some desktop.ini files for it's special folders (My Documents etc.) that contain the source account name i.e. a line. "Owner=Alice". When a new user Bob logs on, their new profile inherits those desktop.ini files together with everything else . That means when anyone looks at Bob's My Documents via Explorer it still shows up as Alice's My Documents which is confusing. The solution to that is to eliminate the "Owner=" lines from desktop.ini files in the Default User profile. I also spent some time zapping unnecessary files from the Default Profile, but there may be other generally good things to do. Not for me. If I go to the folder redirection policy then Favorites in the list of folders I can redirect, but on the second tab "Also apply redirection policy to Windows 2000, Windows 2000 Server, Windows XP, and Windows Server 2003 operating systems" is greyed out and empty. I definitely had to tick that box to make folder redirection work for other folders e.g. My Documents.

The Favorites folder redirect? That's less about 2K8 and more about what policies Vista understands.. I'm targeting XP and it's a bit dim, hence the faffing about tatooing USF. You probably need to have made Default Users profiles (local or roaming) to get it. There might still be other things to tweak, but I found the answer to to "X's My Music" etc.. you have to strip the "Owner=" line out of all desktop.ini files in your Default User profile. I'm essentially doing the same thing, but have a Preferences CSE registry item setting the regval to: %homedrive%\My Documents\My Favourites It creates the My Favourites folder (although thanks to that desktop.ini it appears as the usual "Favorites" in explorer).

Sorry bit of a long involved story, but am I missing something? For the default roaming profile I made a local account X, logged-on & configured a couple of things, logged-on as an admin and copied X's local profile (usable by \Everyone) to a netlogon share then cleared the obvious junk files out of it. That seems to work fine but... I'm using GPO redirected My Documents with various sub-folders set to follow it. I also wanted to put a user's Favorites[sic] inside My Documents and the only way to do that appeared to be using User Shell Folders. I want to set the USF regval to something universal with an environment variable or two in it, but there aren't any I can use. So Plan B[tm] was to give accounts ye olde Home Folder in AD which then gives me %homedrive% (or %homeshare%) to use in the USF regval. That seems to work fine but... I logged on as domain user Y and at some point explored the unavoidable mapped Home Folder drive and everything in it had the original local profiles name on it e.g. "X's My Music", "X's My Pictures". Now I don't care about that too much because I don't want users to see that mapped Home Folder drive in any case (via NoDrives), but all of this does make me wonder whether there's: a) More I can or should be doing to 'cleanse' that default roaming profile? b) A less convoluted way of getting Favorites in a redirected My Documents folder.

Deja vu: 'black boxes" popped up quite a bit in early RIPA discussion, but it concerned intercepting specific Bad Guys. This report is essentially a not very good take on a predictable implementation detail of the proposed 'central communications database' that has been out in the open for a while now e.g. featured on that Panorama "Orwellian" proggie a few weeks ago. A key point is the legal meaning of "communications data" which is the stuff they want to keep. That's already defined via RIPA but not very well so you can expect that to change in this round - whether it turns out better and where the line between comms data and content ends up is anyones guess, but right now comms data is about who you sent a mail to, which web-sites you browsed etc. and it is feasible to store that. Early days but I haven't seen any evidence that they want content scanning, although thanks to Phorm and the like there must be a few control freaks asking "If it's plausible for ads, then why can't we have it for law enforcement?".