PowerShell: Create a manual System Restore point

Overview:

1.  Ensure that System Restore is turned on. Control Panel > System > System Protection.
2.  Run PowerShell as Administrator
3. Type Checkpoint-Computer -Description then Enter
4.  You will see the progress of the restore
5.  Once complete you will be able to view your System Restore Points. Control Panel > System > System Protection > System Restore button > Check "Choose a different restore point" and click Next.

Note:  If you get an error message "Access Denied" when running the command, ensure that you are running PowerShell window as Administrator.

HOWTO: Enable AppLocker cmdlet in PowerShell

To use the AppLocker cmdlets, you must first import the AppLocker module by using the following command at the PowerShell command prompt:

C:\PS> Import-Module AppLocker

Note: Scripting must be enabled on the computer.

That's it!

How to Reset Local Group Policy to Default in Vista, Windows 7, and Windows 8

To Reset "Local Group Policy" to Default in a Command Prompt at Boot


1. Logon as local Administrator

2. Open an elevated command prompt ("Run as Administrator")

3. In the command prompt, type the command below, and press Enter.

RD /S /Q "C:\Windows\System32\GroupPolicy"

4. In the command prompt, type the command below, and press Enter.

RD /S /Q "C:\Windows\System32\GroupPolicyUsers"

5. Restart the computer.

All done. The Local Group Policy Editor has now been reset back to default.


Source: http://www.sevenforums.com/tutorials/214461-local-group-policy-reset-default.html

How to: Apply Active Directory Group Policy to Citrix XenApp servers

This may seem straight forward but it's taken some time to get this to work like a charm.

Scenario:

XenApp (XA) 6.x farm with multiple servers. You have settings that need to be applied to the servers as well as settings for Users.

This is how I configured it.  I came to this conclusion because Group Policy wasn't applying the correct Intranet Zone sites in Internet Explorer (although the same settings worked flawlessly on their desktop)

1.  Create and move all servers to an OU containing XA Servers only.

XenApp Computer object location

my.company.com
       |
       __ Computer Accounts
                                |
                                _ XenApp
                                        |
                                        |- XENAPP01
                                        |- XENAPP02
                                        |- XENAPP03

Therefore: OU=XenApp,OU=Computer Accounts,dc=my,dc=company,dc=com

User Accounts object location

Create or use an existing group containing your users.


my.company.com
       |
       __ User Accounts
                                |
                                _ Location
                                        |
                                        |- USER1
                                        |- USER2
                                        |- USER3


2.  Create and AD group eg. 'All XenApp Servers' containing all your XA servers .  This is important to allow the computer configuration settings to apply to the servers.

3. Three group policies required.
           A.  Name: Policy XenApp Loopback
                 Purpose: This invokes Loopback processing
                 Settings: Computer Configuration > Policies > Administrative Templates > System /
                 Group Policy
                     Policy:  User Group Policy loopback processing mode
                     Mode: Replace
                 GPO Status: User Configuration settings disabled
                 Link Order: 3 (Apply this first)
       
           B.  Name: Policy XenApp Server Configuration
                 Purpose: Contains computer configuration settings which will apply to all your XA servers
                 Settings:  Computer configuration > As required.
                 GPO Status: User Configuration settings disabled
                 Links:  OU=XenApp,OU=Computer Accounts,dc=my,dc=company,dc=com
                 Security Filtering: All XenApp Servers
                 Link Order: 2 (Apply second)

           C.  Name: Policy XenApp User Configuration
                 Purpose: Contains users configuration settings which will apply to all your XA users
                 Settings:  User Configuration > As required.
                 GPO Status:  Computer Configuration settings disabled

                 Links:  OU=XenApp,OU=Computer Accounts,dc=my,dc=company,dc=com
                 Security Filtering: 'All XenApp Users' or Authenticated Users
                 Link Order: 1 (Apply last)


That's it.

:)

JJ

Administering the ActiveX Installer Service in Windows 7

The below link contains details on configuring the ActiveX Installer Service to automatically install ActiveX controls silently for Windows 7 PCs.

Reference:

http://technet.microsoft.com/en-us/library/dd631688(v=ws.10)

AnyConnect removes "Connections" tab from IE Settings

Overview:
If enabled in policy AnyConnect disables and re-enables the Connections tab on a graceful disconnect of the VPN client.  The trouble arises when a user abruptly closes the AnyConnect VPN client. The "Connections" tab is left hidden and subsequent connect/disconnects of the VPN client do not restore it.  

Solution:
Delete the registry key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel]
"ConnectionsTab"=dword:00000001

HOWTO: Generate and import an SSL certificate on VMware View Connection Server

To generate and import an SSL certificate on the View Connection Server:

Notes:

• Certificates are required only for client-facing systems, such as Standard, Replica, or Security servers.
• Information appearing within represents variable information. Do not include the brackets when typing commands.

1. Add keytool to the system path:
   1. In your View Connection Server or Security Server host, right-click My Computer and click Properties.
   2. Click the Advanced tab.
   3. Click Environment Variables.
   4. In the System variables group, select Path and click Edit.
   5. Type the path to the JRE directory in the Variable Value text box. For example,\VMware\VMware View\Server\jre\bin.
      
      Note: Use a semicolon (;) to separate each entry from the other entries in the text box.
2. Generate a Keystore and Certificate:
   1. Open a command prompt and run this command using keytool to generate a Keystore file:keytool -genkey -keyalg "RSA" -keystore -storetype pkcs12 -validity 360To generate a 2048-bit key, run this command:keytool -genkey -keyalg "RSA" -keystore -storetype pkcs12 -validity 360 -keysize 2048
   2. When keytool prompts you for the first and last name, type the fully qualified domain name (FQDN) that the client computers use to connect to the host.
   3. Enter all other information to complete the keystore file.
   4. After keytool creates the Keystore file in the current directory, back up the file.
3. Obtain a Signed Certificate from a CA:
   1. Open a command prompt and run this command using keytool to create a CSR:keytool -certreq -keyalg "RSA" -file -keystore -storetype pkcs12 -storepass
      Notes:
      • keytool creates the CSR file in the current directory.
      • The keystore password must be at least 6 characters and cannot be left blank.
   2. Send the CSR to the CA according to the CA's enrollment process and request a certificate in PKCS#format.
      
      Some CAs provide certificates only in PKCS#12 format. If you download a certificate in the PKCS#12 format, you must convert it to PKCS#7 format.  Some vendors may use type rather than file type.  In this case request a Tomcat certificate.
      
      To convert a PKCS#12 certificate to PKCS#7 format:
      1. Open the certificate file in Internet Explorer.
         
         
         Note: Verify that the certificate chain is complete, including root and intermediate certificates.
      2. In the Details tab, click Copy to File. The Certificate Export wizard appears.
      3. Specify PKCS#7 format, include all certificates in the certification path, and then click Next.
      4. Specify a filename and click Next.
      5. Click Finish to export the file in PKCS#7 format. The file is saved with a .P7B extension.
4. Import the Signed Certificate into a Keystore file.
   
   To import the Signed Certificate into a keystore file, open a command prompt and run this command using keytool:keytool -import -keystore -storetype pkcs12 -storepass -keyalg "RSA" -trustcacerts -file
   
   Note: The storepass must be the same password that was used to generate the CSR in step 3.
5. Configure the View Security Server to use the new certificate:
   1. Copy the Keystore file that contains your certificate to the SSL gateway configuration directory on the View Connection Server or security server host. For example, install_directory\VMware\VMware View\Server\sslgateway\conf\keys.p12.
   2. Add the keyfile and keypass properties to the locked.properties file in the SSL gateway configuration directory on the View Connection Server or security server host.
      
      Note: If the locked.properties file does not exist, you must create it.
   3. Set the keyfile property to the name of your Keystore file.
   4. Set the keypass property to the password for your Keystore file. For example:keyfile=keys.p12
      keypass=MY_PASS
6. Restart the View Connection Server service or Security Server service for the changes take effect.
7. Ensure that the certificate is being used by checking the debug log on the server.

Source: Original Article

MDT 2010 created an IMGMGR folder that can't be deleted, and it's huge!

From an elevated command prompt (if OS is Windows Server 2008), try running "dism.exe /cleanup-wim" to clean up the mounted image.

That's it!! Thanks Michael Niehaus

Source:

Disable Legal Notice during Windows 7 Deployment

Solution:
Open the unattend.xml file using a Text Editor and add the following Synchronous Command to the unattend.xml File in the corresponding Task Sequence Folder (\\%DistributionServer%\DistributionShare\Control\%TSId%\unattend.xml)

------------------------------------------------------------------------------------

Disable Legal Notice
3
cmd /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}" /v NoMachinePolicy /t REG_DWORD /d 1 /f

------------------------------------------------------------------------------------

There are also steps for when using MDT for Deployment in the URL attached.

Source:
http://www.microtom.net/?p=675

VBScript Blog

Great site with useful scripts!

http://vbscriptblog.com/

Dude: Where have my folders gone??? .... Windows 7

You knew where everything was in Windows XP but where have they moved them to in Windows 7 (and Vista)

New locations are:

User Profiles: C:\Users\
All users desktop: C:\Users\Public\Desktop\
All users start menu: C:\ProgramData\Microsoft\Windows\Start Menu\

Error: MAPI32.DLL when launching Outlook 2003

Issue:
When launching Outlook 2003 the below error is displayed:

Cannot start Microsoft Office Outlook. MAPI32.DLL is corrupt or the wrong
version. This could have been caused by installing other messaging software.
Please reinstall Outlook.

Solution:
Rename the C:\Program Files\Common Files\System\MSMAPI\1033\MSMAPI32.DLL to MSMAPI32.old. Then try starting Outlook.

Citrix: Internet Explorer Intranet Zones

It appears that Citrix and Terminal Services does not allow Internet Explorer Security Zones to be modified from inside a Citrix Session. We used to have a Group Policy that set our Zone settings, but for some reason did not apply to our Citrix or RDP sessions.

There was a fix I found on the net that uses a Group Policy Object to resolve this.

The setting is in Administrative Templates | Windows Components | Internet Explorer | Internet Control Panel | Security Page | Site to Zone Assignment List

Enable that policy and fill it with the sites you need.

1 = Intranet Zone
2 = Trusted Zone
3 = Internet Zone
4 = Restricted Zone

eg. http://soeteam.blogspot.com Value 1.
Means http://soeteam.blogspot.com will be added the the Intranet Zone. You will be able to see this within IE.

After I applied this Group Policy I needed to log onto the console of the Citrix servers and run 'gupdate /force'

Source: http://www.trevorprokop.com/?p=11

Telstra Ultimate USB modem using Ciscos VPN Win 7

Install Latest firmware then install drivers.

http://www.sierrawireless.com/en/sitecore/content/Sierra%20Wireless/Support/Downloads/AirCard/USB_Modems/Telstra_Ultimate_AC312U.aspx

Disable “Windows 7 Mobile Broadband” in the telstra Watcher "user options"

Ref

http://forums.whirlpool.net.au/archive/1709121

Lync 2010: Migrate OCS 2007 R2 user to Lync 2010

The below process shows how to migrate an OCS 2007 R2 user to Lync 2010. This cannot be done using any GUI driven tools (at time of writing)

Note: Lync users cannot use the Microsoft Office Communicator 2007 client to log into Lync 2010. If the user to be migrated is logged in and using the Communicator client they will be automatically logged out and an error message informing the user to upgrade their client.

1. Launch the Lync Server Management Shell from your Lync Server

2. Type command: Move-CsLegacyUser -Identity username -Target lyncserver.yourdomain

3. Confirm the user move.

4. You're done.

Install the Lync 2010 client and enjoy. :)

ERROR: A temporary profile is loaded after you log on to a Windows 7-based system

To resolve this problem, follow these steps:
1. Log on to the system by using an administrative user account other than the user account that is experiencing the problem.
2. Back up all data in the current user's profile folder if the profile folder still exists, and then delete the profile folder. By default, the profile resides in the following location:%SystemDrive%\Users\UserName
3. Click Start, type regedit in the Start Search box, and then press ENTER.

If you are prompted for an administrator password or for confirmation, type your password, or click Continue.
4. Locate the following registry subkey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
5. Under the ProfileList subkey, delete the subkey that is named SID.bak. 

Note SID is a placeholder for the security identifier (SID) of the user account that is experiencing the problem. The SID.bak subkey should contain a ProfileImagePath registry entry that points to the original profile folder of the user account that is experiencing the problem.
6. Exit Registry Editor.
7. Log off the system.
8. Log on to the system again.
After you log on to the system, the profile folder is re-created.

Source:
http://support.microsoft.com/kb/947242/en-au

ERROR: Microsoft Lync 2010 must be installed by running the appropriate Lync setup executable

Issue:

You experience the following symptoms:

• A local Windows Installer (MSI) installation for Microsoft Lync 2010 can fail, and the following warning is displayed in the Microsoft Lync 2010 Setup dialog box:Microsoft Lync 2010 must be installed by running the appropriate Lync setup executable


Resolution:

Use the Lync 2010 UseMSIForLyncInstallation Group Policy setting to enable or block MSI deployments for Lync.msi as follows:

Name: UseMSIForLyncInstallation

Default: 0

Range: 1 or 0

Registry Location:HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Communicator

To do this, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.

2. Locate and then click the following registry subkey HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Communicator

3. On the Edit menu, point to New, and then click DWORD Value.

4. Type UseMSIForLyncInstallation, and then press ENTER to name the registry entry.

5. Right-click UseMSIForLyncInstallation, and then click Modify.

6. In the Value data box, type 1 if that value is not already displayed, and then click OK.

7. Exit Registry Editor.

8. Restart the Windows client.

Source:

http://support.microsoft.com/kb/2477965

Error 53: When trying to map to server using net use

Scenario:

You receive "status 53" when running net view or net use to attach or map to a Windows server.

eg. You type the command:

C:\>net view \\server

Results

Shared resources on \\server

Share Name Type Used as Comment

------------------------------------------------------------------------------------------------

Command failed: status 53

C:\>

Resolution

Your Windows Server you are trying to connect to does not have any WINS addresses entries listed in Advanced TCP/IP Settings. Add at least one entry and apply settings.

TIP: Office 2010 Volume Activation Tips and Tricks

Ospp.vbs

This handy script is helpful for performing local and remote licensing operations for Microsoft Office 2010. You can find it in the “%ProgramFiles%\Microsoft Office\Office14” folder. For 32-bit installs of Office on 64-bit operating systems, look for it under the “Program Files (x86)” folder. Keep in mind ospp.vbs is the script to configure the Office 2010 client, while slmgr.vbs is used to configure the KMS host and Windows installations.

To run this script, open an elevated command prompt by clicking the Start button and searching for “cmd” in the search box. Right click on the command prompt window and select “Run as administrator.” Go to the directory with this command:

cd “%ProgramFiles%\Microsoft Office\Office14”

You can see the options that are available by typing:

cscript ospp.vbs -?

Richard Moloney, the developer of this script, says a useful benefit after setting up a KMS host is using the -act and -dhistory commands to verify the Office client is finding the KMS host and successfully activating. He suggests, “If you’re setting up a KMS host, you can manually trigger and verify successful activation. You don’t need to wait 25 days until notification dialogs start popping up to start troubleshooting.”

Trigger activation and view the KMS activation history by running:

cscript ospp.vbs –act

cscript ospp.vbs –dhistory

For MAK activation, one common task would be to check the status of your computer, install a Professional Plus Beta MAK key, and trigger activation. Run these commands (if you’re pasting these commands, you may need to change the long dash to a short dash). In this example, note that when you run the –act command, you’ll be triggering MAK activation, which goes to Microsoft’s activation servers, not your KMS host.

cscript ospp.vbs –dstatus

cscript ospp.vbs –inpkey:22HGX-728MX-BBWX9-7BB8X-J96B4

cscript ospp.vbs –act

cscript ospp.vbs –dstatus

What if you got an error code? You can easily get the error description with this command specifying the error code:

cscript ospp.vbs –ddescr:0xC0020017

You can even run this script to check the status or trigger activation of a remote computer. Just provide the computer name and login credentials:

cscript ospp.vbs –act

Source: http://blogs.technet.com/b/office2010/archive/2009/12/18/volume-activation-tips-and-tricks.aspx

ERROR: When you log on to Microsoft Office Communicator: "Cannot Synchronize Address Book"

Note This issue occurs on the client-side. However, you have to configure the settings on the server that is running Microsoft Office Communications Server to resolve the issue. If you are not familiar with Office Communications Server, contact the server administrator.

To resolve this issue, you must have the Administrator permission on the server that is running Microsoft Office Communications Server.

Windows Server 2003-based server

Method 1: If the Address Book Files folder is on the computer that is running Communications Server

1. Click Start, click Run, type inetmgr, and then click OK.
2. Expand ServerName, expand Web Sites, expand Default Web sites, and then expandAbs.
3. Right-click Ext, and then click Properties.
4. In the Ext Properties dialog box, click to select the A directory located on this computer check box on the Virtual Directory tab, click Browse to select the Address Book Files folder, and then click OK.
5. Repeat steps 3 and 4 for Int in the Abs node.

Windows Server 2008-based server

Method 1: If the Address Book Files folder is on the computer that is running Communications Server

1. Click Start, click Run, type inetmgr, and then click OK.
2. Expand ServerName, expand Sites, expand Default Web sites, and then expand Abs.
3. Expand Ext and click on Files, in the Actions pane click on Basic Settings
4. Using the Physical path setting browse to the Address Book Files folder.
5. Click OK twice and close the IIS 7.0 Management console
6. Repeat steps 3 through 5 for Int in the Abs node.

Source: http://support.microsoft.com/kb/938286