PiqueABoo

You can delete them with policy as well. If you have a GPO set a registry value "**Del.ABC" in some specific registry path, client-side GPO processing will zap the value "ABC" from that path. More variations on this theme here: Registry Policy File Format (Windows)

It is on ESX 3.5 Update 2 (which AIUI is currently the only VMWare product that MS have validated so far). http://windowsservercatalog.com/item.aspx?idItem=fb304f90-92ed-4bed-ae4f-96805c16b61c&bCatID=1521

Folder redirection also works for me. Might be wrong because it's indirectly gained, but my understanding is that Capita have said they're not aware of any problems with SIMS and SP3, but for one reason or another won't unambiguously say they support it. Which is irritating.

Other protocols work & HTTP doesn't... I would definitely scrutinise the "web filter". What is it? Does it or can it made to show active connections, denied ones etc?

The above is good advice - I've seen the unhappy consequences of thin client in a few Primaries and will second all of it.

::blinks:: They're not connected with what I do, but I can point to people who do all the support for ~10 primaries all by by themselves (which adds up to something like 600 PCs and a couple of thousand users). Can't decide whether to move to Southampton for an easy life or to make a killing...

I turned on Remote Desktop and Remote Assistance with policy and added both of these options the computer object context menus in ADUC (or whatever it's called now). Offering RA is a bit more doable now from 2K8 now courtesy of msra.exe

Go to the Java download page (where you're right, they are still recommending 6u7) and look just below the logo in the banner: Download Java software for Windows from Sun Microsystems AFAICT it doesn't say "beta" anywhere. [serial Java MSI deployers: Watch out for this one - those rules we've had for years have changed a bit.]

::spoils his day:: Java 6u10 and Flash 10 were released this week.

Mmm.. so have you turned off automagic installation of updates now like the rest of us (who prefer to pick and choose when we have our disasters)? I got my very first blue screen the other day.. had been installing a few new features, then WebDav and an associated KB, but somewhere in there a couple of AU secfixes.. and it bluescreened when I shut it down (started up again OK though). I wonder.. ::shrug:: Very few fresh installs on (presumably) new h/w are as clunky as some box you've been abusing for years. I haven't seen anything scary about 2K8 yet. The only real drawback is the lack of quality info. Try googling for pretty much anything and there's truckloads of 'posturing' posts on the obvious shiny bits (e.g. bloggs with GBs of pointless screenshots that essentially amount to "I've played with X before you have! Na an na naah naaah!") or out at the other extreme, Powershell equivalents of Perl PGP sigs. Not a lot in the way of those quietly stated little tips and tricks that just makes admin's life easier - as in the stuff that really counts.

This probably sounds harder than it is, but you can add an item to the right-click context menu for computer and user objects in ADUC which calls a 2-3 line script to pop-up a message box with the objects location. This is easy because the script is passed the object's distinguishedName ("cn=blah,ou=bike shed,ou=..") as an argument .. all it has to do is display that. I've been doing more complex things around that, but I'm sure I've seen a little walk-through for just displaying the dn somewhere - will try and find it later. Later: Can't find it, but here's one for restarting computers which is close enough - just substitute a tiny script to display WScript.Arguments(0) and add the context menu item to user objects as well. Oddvar Håland Moe's blog

Anyone considered using preferences for delivering shortcuts e.g. completely contructing a start menu etc? I'm currently feeling a bit ambivalent about it (vs. any common d-i-y solution) so I'm interested in any clueful arguments for or against.

Not sure it you can still get it, wheter it costs now or how good it is/was, but there was a proggy for this called Promiscan (scans for 'promiscuous" NICs). On a switched network a Bad Guy would normally needs to mess around with ARP in order to see **other peoples traffic** and you can use things like Arpwatch to help detect that.

I've been trying to explain it, but nearest I can get is that (being User policy in this case) the GPO logon script [path]names end up in a "Script" value under this key: HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon\n\m Where I think 'n' and 'm' are numbers dependant on how many GPOs have logon scripts, and how many scripts any given GPO has respectively. This key is one that SysInternal's "Autoruns" and similar utils report on (looks like it has occasionally been abused by malware).

I made that happen very easily on a 2k3 + XP SP2, but just can't on the 2K8+ XP SP3 I'm playing with now. Which was really frustrating because I spent a fair bit of time on a cunning workaround before I noticed it didn't happen - not sure what to attribute that to.. luck, the precise set of GPO policies, starting from a nice clean baseline or XP SP3. The bit that's doing my head in: One comp which suffered several evolving generations of GPO Offline File settings, now absolutely **insists* on running a mobsync at logon and logoff when it's connected to a foreign network (e.g. home network) - the logon one sits there with an error message coz it obviously can't do it - the logoff one pops up, does whatever and goes away. If I remove the ticks via the Offline Files tab, they automagically come back again. Resetting CSC doesn't change this. SO FAR that is nor happening on a fresh built comp with the same build image, policies, user etc. Now do I or don't I dump and compare the respective registrys and run csccmd's etc. to find a good reason.. ughh! The other bit that's annoying, but less so, is whether syncing redirected (to DFS share) folders and enabling caching is supported. I can find old MS statements that say it isn't, and other ones that say it's OK.

..and then I accidently invoked a nice solution. Instead of setting a GPO to invoke a single logon script located on the PC which does this or that according to whether it thinks it's connected to the domain or not, I make two scripts based on this concept: 1) Make a logon script e.g. HelloWorld.js, contents: WScript.Echo("Connected to domain"); Throw that in the GPO's Scripts\Logon folder and add it as a logon script. b) Make another script with the same name but different contents e.g. HelloWorld.js, contents: WScript.Echo("Disconnected from domain"); Push that out to %windir% on the target computers. Basically when it's connected to the domain it runs the GPO logon script from the DC, but when it's offline it runs the local one from %windir% (or presumably anywhere else you want to put it in the PATH). Dunno about everyone else and YMMV, but I didn't know you could do that. This isn't why I'm playing with it, but an example of a potentially useful thing you could do with this is to automatically take the tick out of the IE proxy box when it's not online to your domain i.e. in the local version of the script invoke reg.exe to set the HKCU "ProxyEnable" value to 0, [& if necessary put it back to 1 again in the 'partner' script on the DCs]

Once upon a time you'd just look at the LOGONSERVER environment variable (would be the local computers name when offline) but that's always set to the last DC that logged you on now. What I've done isn't much harder: Look for an occurence of the USERDNSDOMAIN environment variable in the stdout from an 'ipconfig /displaydns' command. When it's connected and you logon you get at least one DC FQDN in the DNS cache, otherwise I'm saying it's offline. There's probably a loophole or two e.g. depends on no name resolution for the internal domain name outside your network, but it seems OK so far.

Mmm.. this is a GPO-attached logon script.. which runs when user logged on to domain normally or with cached credentials. The frustrating bit is that in the latter case the system already knows it can't talk to the domain, so I've been naively assuming you ought to be able just ask the system about that (somehow) rather than repeating one or more networky things the system has already done. If I have to talk to the network I suppose I have to, but that would be annoying on principle.

Yeah.. I looked at one of the v2 beta/RCs and decided server 1.0.6 (lastest 1 series then) was staying put, not least for the Workstation-like UI. This is a pity because there are some new virtual hardware bits in v2 I wanted.. just not that much!

1) Any script (it will be JS but I can translate almost anything). 2) So I can skip doing something that wants to talk to a DC and thus avoid timeouts and scary messages.

I'm playing with XP SP3 folder redirection to DFS® shares and specifically right now, offline files i.e. best way to ensure Alice gets her files sync'd and useable at home on Laptop A, but when she lends it to Bob he doesn't get any syncing at all and thus we avoid the access denieds during sync and so on... One approach I'm just trying is to turn off the automatic syncing for redirected folders and do it manually via logon/off script e.g. only sync if current user is allowed to on this box (lots of ways to flag that) and we're on our LAN. Alternatively there's the PrimaryUsers reg value assuming that still works on SP3(?), but that's not as good because you'll still get the Sync running and complaining when the machine is at home. Anyway, has anyone ever come across a really good 'best practice' kind of doc for this area? Or perhaps what you do works really well, keeps the users happy, never breaks(!) etc.?

Someone must have thought about this.. I've got a teensy logon script and I want it to quickly figure out whether the box has a hope in H. of talking to a DC e.g. it's: a) Not connected to a network. b) Is connected to a home/other network somewhere If possible I'd like it to be generic i.e. no comparing current IP address against some hard-coded value. Any ideas on what's the best thing to look at or test?

Not with Vista clients.. blerghh.. and haven't gone near shortcuts yet. One thing that might be worth quickly trying is using FQDNs in your UNCs e.g. \\MyServer.example.net\Share\.. as opposed to: \\MyServer\Share\... Permissions issues seems a bit more likely though. Are the NTFS perms behind that shortcut share also OK? Do 'Authenticated Users' (computer accounts in this case) have Read access? Does the event log say anything? So far I've found the preferences CSE does seem to log useful app log events when it fails to so something.

Just accidently hit this little article from Darren M-E (gpoguy) which is a good and fairly succint round up of the various GPO performance factors: Group Policy: Optimizing Group Policy Performance

I can't cope without "CMD Prompt here" on Windows servers and it's the first thing I install, but that has drive switching problems on 2K8. Yes you do now have that built-in one that some Vista fans reckoned was new and cool, but my having to hold down a shift key when r-clicking a folder in the right-hand pane is just wrong. Was on the verge of modifying the old cmdhere.inf myself but someone else has done that in an interesting collection you can get here: Security: New Elevation PowerToys for Windows Vista