Bruce123

In Group Policy Management you can backup the GPOs (right click on Group Poliicy Objects, I think). BUT, I don't think you would be able to to restore the backup into another Domain. But maybe you can... The main issue might be the unique-ness (or not) of the various GUIDs/SIDs used in the GPOs. Would be interested to know if it is possible.

I'd guess differential backups would be much slower, as it has to analyse the existing files first rather than just blaze through. It could also be because that the files that change more frequently tend to be smaller files (e.g. shortcuts) and smaller files tend to take longer (per MB of transfer) to backup due to their fragmentation. I remember when we were using BExec 9 (a very old version!) and the transfer rates weren't great. But I think there's always going to be a problem with transfer rates when backing up at the file level, rather than block transfer using Volume Shadow Copy.

I've come across exactly the same issue. None of the basic NTFS folder permissions have the permissions you want for staff/students; give them Modify and it doesn't allow users to delete/move folders, and Full Control gives them this ability, but also the (dubious) right to modify NTFS permissions, which you don't want them to have. Oddly enough, at the Share level Modify right means something different, it allows users to delete/remove folders, which is what I want for NTFS permissions. The only solution I can think of is to go into the Advanced section of the NTFS folder security and permit everything at a granuler level (or almost), apart from modify folder/file permissions. But it seems a bit untidy. Bruce.

Hi Witch, When folder redirection gets applied to a user it modifies the values contained within the following key for this user HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders By default Desktop value will be %USERPROFILE%\Desktop, but with redirection enabled it should be whatever you set it to in the GPO (i.e. "\\server\share\folder") At each logon these values are read by Windows and are then copied into HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders And any environment various are expanded to their actual value. These are the effective shell folders used by Windows for that user during a logon session. It may be worth logging on as a user and using reg editor to drill down to check what they are actually set to. You'll probably find that the Desktop value has not been changed from the default (in User Shell Folders and Shell Folders), meaning for whatever reason the GPO setting is not being applied at logon. The reason redirection works for existing users but not new users could be that the registry entry has already been changed in their ntuser.dat (assuming local or roaming profiles), so even when you take away the policy, Folder Redirection is still enabled for these users. But new users won't have it applied. As mentioned by another helpful user, one possible cause could be that an update or something else on has prevented Folder Redirection (or may be all User settings) from applying at logon. A simple check would be to look for errors in the Application Event log on the desktop PCs. And there is also a Group Policy processing log on the PC if you really want to delve into a problem. One other possibility is that there is a file replication problem between your DCs and the changes you are making on one DC aren't being replicated to the another DC that is being used by the clients for authentication/group policy. And the initial problem could have been caused by a corruption of the file within the group policy object that enabled the folder redirection policy. It's a long shot but worth looking into; look for DFS/FRS errors in the event log on all of your DCs. These are just two possibilities, there are of course many other possible causes / avenues of investigation which fellow Edugeekers have already mentioned Regards, Bruce.

There's always Poledit.exe and TweakUI.exe for Win95-XP clients. And in addition, the local GPO (gpedit.msc ?) and local security policy ( *sec.msc ?) for XP-? workstations. Mind you, with no local file security on 95/98 someone could always get around them if they knew how. Bruce.

ditto (me too)

Thank hit and Michael, I just tried the reg fix to disable Media Sensing and it seemed to resolve this issue on this particular PC, without causing any obvious issues. Hit, is this the same fix that you had to apply to your base image? If so, this would seem to answer my second question, about any side-affects, but from what you said it had very little. The problem is I can't roll out the reg change because there is no way to apply the GP (Catch 22). On the other hand, I don't know if any way to identify this model of PC to target them in the GPO. I guess I probably wouldn't want this to apply to all PCs? May involve going around all this model of PCs and making the change manually. Michael, the switch these PCs connect to is 10/100Mbit..... Thanks, Bruce.

Another thing I noticed about these PCs is that they run really slow and after a bit of research I found that Windows Search starts automatically, which really seems to slow them. I created a GPO to stop the Windows Search service and to set it to manual and to remove the shortcut from the Start-up menu for all users of the PC. But since these two settings are Computer settings, I am left wondering whether these will apply to these PCs given the problem above. Basically, what I am wondering is do Computer Settings refresh in the background? (I know User settings do) Many Thanks, Bruce.

Hi all, I just noticed that on some newer PCs we are getting an error event in the Application log, every time they are turned on, relating to not being able to find a DC and subsquent error events relating to the failure to find/process start-up scripts. Windows cannot obtain the domain controller name for your computer network. (The specified domain either does not exist or could not be contacted. ). Group Policy processing aborted. The event log shows one error for each start-up script that it fails to run (all of them). Presumably no Computer GPO settings apply either. However, when the user logs on, the user Group Polices and scripts do seem to apply properly. After a bit of research I found this: Cannot connect to domain controller and cannot apply Group Policy with Gigabit Ethernet devices This suggests that the problem is related to the 1Gbit integrated NICs ("Realtek PCI GBE family controller" in our case) fitted to these PCs and the delay/fluctuation in establishing a connection (at 100MBit in our case). The solution in the article is to disable a Windows feature call Media Sense How to disable the Media Sensing feature for TCP/IP in Windows which I am going to investigate. But I wondered if anyone else has encounted this issue (affecting some PCs with 1Gbit NICs/driver), and how they resolved it? Many Thanks, Bruce.

Chris - You haven't said what version of Windows Server is hosting your VMs? I have a theory that random failed backups of VMs on DPM 2010 can be related to either network or I/O bottlenecks caused by DPM. Windows 2008 R2 HV seems to be more resilient than 2008 HV. 1. Make sure the Hyper-V Host has the latest service pack installed (I know it sounds obvious but DPM 2010 lists various prerequisites for reliable Hyper-V protection and most of them seem to be incorporated into the latest SP). 2. Check what other DPM backups are running at the same time. BMR and system State Backups aren't done incrementally; a BMR backup of 50GB can really hammer your network. If you have any BMR/System State backups, try to schedule these so they occur outside your VM backup window. I have scheduled my (only) BMR for 5am (the VMs finish around 2am). 3. By default DPM 2010 allows several VM backups to occur simultaneously (seems to be around 3 from my own experiences). This can impose a high network load/disk IO (on DPM and the protected server), which could potentially cause the backups to fail. There is a registry hack to enforce serialized backups (one after the other). I have not tried it myself as (2) worked for me when I experienced a similar problem. On your DPM server: HKLM\Software\Microsoft\Microsoft Data Protection Manager\2.0\Configuration\MaxAllowedParallelBackups Set this to DWORD=1 Of these 2) and 3) seem look good avenues of investigation (esp. given your observation that the VM backups are successful when done one-by-one during the day). Good luck. Bruce.

When did Veeam start supporting Hyper-V out of interest?

I have a DPM 2010 server setup with a storage pool consisting of 3 NASs (iSCSI over a dedicated 1Gbit Switch). I use the iSCSI Initiator build-in to Windows 2008 R2 to connect the server to them (there is a shared key which I have recorded). Eash NAS is 3.5TB and I have split each NAS into 2 LUNs (2GB and 1.5TB). DPM therefore sees 6 disks (3x2TB and 3x1.5TB). I need to change the IP of addresses of the 3 NAS boxes (QNAP). How can I do this to ensure that DPM will see them as the "same" disks and continue to use them (and the data on them) as the Storage Pool. I really want to avoid having to start again with the replicas. Is there anything I need to do in advance? Regards, Bruce.

Thanks Arthur, that's actually really useful to know. Bruce.

Glad you got it sorted, in my experience FRS can be hard to fix when replication stops working on 2000/2003. They are easier to fix in 2008/2008 R2. Can I ask how you recovered GPOs without restoring the whole of ADS? I know that you can backup GPOs with a right-click in Group Policy Management Console, but can this be automated? Or can you recover individual GPOs from the System State backup taken from a DC? Regards, Bruce.

I have had similar thoughts, but whether it is possible to recover a backup of a server backup taken using wsbackup.exe into a Hyper-V host. I am guessing probably not, due to if anything, "incompatible hardware" (i.e. the difference between the hardware on the physical server where the OS was first installed and the virtual hardware created by Hyper-V/VirtualPC). However, if you have done a Bare Metal backup (or even a System State backup) then it would be interesting to see if you can recover the backup into a new VM using the standard BMR recovery procedure. I.e. 1. Create a new VM of similar spec (in Hyper-V or VirtualPC - not used VirtualPC before) 2. Boot to the Win 2008 R2 CD (using a virtual DVD drive) 3. Choose the option to perform a BMR and point it to the wsbackup .VHD file For a BMR recovery, the hardware doesn't have to be identical, only similar. If this works it could be really useful for Disaster Recovery (e.g. in the case of a hardware failure of a physical server recovery into spare capacity on a Hyper-V host). Regards, Bruce.

Yes. I don't know about Ruckus WiFi, but "roaming" was part of the original 802.11b standard, which has been around for over 10 years now and works with standard WAPs (they don't even need to be managed). Essentially for client roaming to work each AP: SSID is identical Encryption type is identical Key is identical Channel is different. Ideally each AP should be on a different (and non-overlapping channel*). Otherwise, the radio waves from your APs/clients will interfer with each other, potentially causing problems and slowing performance. The Netgear WiFi Switch that we use has a feature call Automatic Radio Mangement, which automatically configures adjacenet APs to be on different channels. You might also like to try deleting the wireless connection on the laptop you are doing the tests with and set it up again (Windows tends up cache wireless information, which may not be helpful in your tests). I hope that this helps. Bruce. *I can't recall what channels are non-overalpping but 1 and 6 sound OK.

Probably too obvious but have you checked what channels the APs are on (and tried changing them to see what happens)? Also, try setting off a ping -t when moving around to see what happens to IP connectivity as you roam as it could be an application issue, rather than a network issue.

My guess is just as you said, though I wouldn't call it backup, resiliance is a better term to use (analogy being multiple drives in RAID are there for resiliance rather than backup). There could be another reason, if the school is split across >1 sites with slow inter-site connectivity, having a DFS replica at each site would allow the home drive to automatically connect to the DFS replica on the local LAN (rather than going over the slow WAN link). They could then logon at any other site and continue working (as long as the changes to files replicate in the time it takes for them to get over there and logon). One problem with DFS replicas is that opening a file from one replica doesn't lock it on the others. Should be OK for home drives (if the user doesn't logon at more than one site at the same time), but is no good for shared folders. I agree that replication works best when the replica is meant as a read-only copy. Regards, Bruce.

We use DFS for all our staff shared folders, one network drive/DFS Root with DFS links to 4 different servers, very useful and simple. Haven't used replication part of DFS (then call FRS) for a while (yes it broke but the servers were W2K and apparently DFS is more reliable with 2008 R2). We actually used it for roaming profiles to speed up logins (4 sites and one replica per site).

OK if one of your DCs goes down. But what would you do if your ADS database is corrupted and gets replicated to all DCs? You will need a (recent) backup of ADS in order to perform a Disaster Recovery to recover your domain. Two examples of how this might happen: A Hacker removes all users from Domain Admins/Administrators, resets the password for the domain administrator account, then deletes all other accounts. Or a worm/program goes berserk and corrupts ADS. You still need to take regular backups of ADS to deal with these types of scenarios, no matter how many DCs you have it won't help. And... A) If all of your DCs are on one site you should keep the backups "off-site" from where your DCs are. B) Store them offline (e.g. a USB drive or tape) to prevent the said hacker from wiping your backup at the same time as the DCs. In my opinion Windows Server Backup (2008/2008 R2) is good for ADS backups. Microsoft trusts it to perform ADS backups for DPM. Regards, Bruce.

Duke5a is right, GP scripts/settings won't apply to unless the client's IP is in a range defined in AD Sites and Services.

We use City and Guilds E-Volve, via a proxy but on just plain Windows XP. Seems to work (mostly), not sure if the auto-updates will work (as I am not sure that ordinary users will have write permissions to the All Users\...... install folder, assuming of course that's where they are downloaded to). Deploying is a bit of a pain, as we have to install manually so that we can type in the proxy username/password. On testing, had some instances reported of it failing to download the exams, there are some suggestions that this may be due to a combination of low bandwidth to the Internet and the short timeout set on their server. Only had one live exam so far (15 candidates), it went ok apart from a couple of glitches; one of the PCs had US keyboard set (our fault) so the user had to type "pound" instead of using "£". The other issue related to the candidate being asked to press the tab to move the address lines to the right, on a letter the candidate was asked to type, Pressing tab just moved the cursor to the next text window. Reported this to C&G / E-volve. Bruce.

When did you purchase the 755s? The early models (around circa 2007-??) suffered from a NIC firmware issue which causes intermittent disconnections/reconnections from the network (at layer 1/2). Most applications can cope, so you wouldn't necessarily notice it (Sage crashes though). This might explain the problem with playing video off the network, and maybe even playing from CD/DVD. To check if a 755 has this problem, look in the System event log for yellow warnings relating to the NIC (a disconnect then reconnect within a few seconds). To fix this issue download and apply the latest firmware from Dell's website (e.g. A12, not sure what the current version is though). The only other thing you also might want to check is what CODEC used for MPG2 playback (e.g. if you're playing DVDs), Windows XP doesn't come with an MPG2 CODEC (licensing issue), so it must have come with 3rd party software. We've tended use the MPG2 playback CODEC which came with PowerDVD (we paid £2 extra for one PowerDVD CD for each 755 that we orderd). Thanks, Bruce.

Hi, I just wondered what type of disk people use for their Hyper V VMs. Fixed or Dynamically Expanding? On reading up on it, I can see what the main advantages/disadvantages are. Dynamically expanding + VE More efficient use of disk space in the area used to store the VHDs - VE As disk expands the VHD file can become fragmented on the disk used to store it and the disk IO on the VM can be adversely affected, if it keeps having to expand. Once the pre-configured "max size" is reached you cannot seem to expand it further? But the main issue I have with the fixed disk type is the space it uses when backing up the VM (at the host level) to DPM 2010. For the VMs that we have setup with a fixed disk the space allocated for the replica on the DPM storage pool is the full size of the VHD file (e.g. if you have allocated 200GB as a fixed disk DPM will backup the entire file). The first replica can therefore take ages, but after that only changes to the VHD are replicated. It is quite inefficient use of D2D backup disk space but that's not a main problem as disk space is cheap and I'd rather backup at the host level rather than Guest so we can restore the entire VM in a disaster recovery scenario. We use D2D2T and the problem is that backing up all of our physical and virtual servers is just not quite fitting onto one tape. We have an LTO5 autochanger (1.5TB Uncompressed/3TB Compressed) and it's backing up 2.9TB of data, running of space and and then backing up the remaining 80GB to another spare tape. Good compression... which I am assuming is because it's compressing the unused part of the VHD file very well (because it's all zeros!). There is also the matter of whether to convert the disk type within the Guest OS Disk Management to Basic or Dynamic; we've kept them as Basic because I found out from someone who posts to these forums that having any Dynamic disks on a Guest OS will cause DPM to backup the VM in Saved state mode (the VM goes offline while it is being backed up). It is listed in one of Microsoft's articles as a requirement for doing online backups of VMs, but they should really be more open about this. The VMs that I am referring to are file servers so I would prefer the fixed disk type for performane. Any advice, experiences appreciated. Thanks, Bruce.

Thank you both for replying to my query. I did a search and found a Seagate 300GB SAS drive for around £130 and almost placed and order for before noticing that it was 2.5" whereas the ones in the server are 3.5", so rather than risk any further spec mismatches/mistakes (and given there is a slight chance it may not be compatible - e.g. non dell Firmware), I decided to go ahead with Dell's quotation. The order is for 600GB SAS 6Gb/s 15K (£359 inc VAT) The actual failed drive is 300GB SAS 3/Gbit 10K. So it' off spec in 3 ways, but it must be OK if Dell specified it (and I informed them of the Asset Tag of the server). Thanks, Bruce.