Deploy MSI-package from GPO

To deploy msi package to from GPO.

1. Create GPO DeployPackage

a. User Configuration>Policies>Software Settings>Software Installation

b. Create new package, choose msi to deploy. Must be located on a shared folder that has read permissions for authenticated users (to include all domain computers).

c. Choose Published

d. Choose newly created package, Change Deployment>Deployment Type to Assigned and Check Deployment options>Install this application at logon

2. Deploy this GPO to an OU where the User object is located.

3. GPUpdate /force on both server and client.

4. If all works, the client will notice the policy and request a restart.

5. Package should deploy as soon as logged in.

Autodiscover pains in my side.

Problem: When setting up Outlook 2007 on a Server 2003 R2 a certificate error is shown every time Outlook starts. Exchange server is 2013 and Autodiscovery is pretty much mandatory.

Cannot connect to proxy server. Error code 10.

Symptom:s

Certificate error is shown at startup.

In the Outlook Anywhere settings, the proxyserver settings is set to the internal servername, like myserver.mydomain.local instead of the external mail.mydomain.com. The certificate is set to the external name so its no wonder Outlook complains.

When we alter the name in Outlook Anywhere settings the Proxyerror disappears. Though after restarting outlook once or twice, the settings returns.

Now the issue here is that these settings are only incorrect if the server (or computer) is a member of the domain. If a external Outlook puts up a user, everything looks fine in the Outlook Anywhere settings.

Cause:

Then looking for autodiscover settings, Outlook always looks to the domains SCP before the dns.

Now this can be amended by changing the parameters of cmdlet set-outlookprovider

Like : set-outlookprovider expr –server mail.mydomain.com –certprincipalname msstd:mail.mydomain.com and then restarting both mailserver and clientcomputer.

People usually solve the problem when doing that, but not in my case. I blame a very old server that probably upgraded Office one time to many.

Solution:

In my case I had to completely bypass the Active Directory to fool the Terminal Server to look towards the DNS, where everything worked dandy.

These are the magic settings.

Navigate to HKEY_CURRENT_USER\Software\Microsoft\Office\12.0 14.0 for Outlook 2010\Outlook\AutoDiscover and create these DWORD

"PreferLocalXML"=dword:0
"ExcludeHttpRedirect"=dword:0
"ExcludeHttpsAutodiscoverDomain"=dword:0
"ExcludeHttpsRootDomain"=dword:1
"ExcludeScpLookup"=dword:1 (forces Outlook to exclude SCP object check)
"ExcludeSrvLookup"=dword:1
"ExcludeSrvRecord"=dword:1

All cred for the fix goes to hosting.intermedia.net link below. Still pasting it here just in case they drop it.

On a side note, I also installed a brand new Server 2008 R2 with Outlook 2010 and didn’t see the issue there at all. So either something broke or Outlook 2007/Server 2003 bugged out.

References:

http://blogs.technet.com/b/umutg/archive/2011/01/31/all-about-set-outlookprovider.aspx

http://ilantz.com/2009/06/18/prevent-outlook-anywhere-aka-rpc-over-http-from-being-automaticly-configured-in-exchange-2007-with-autodiscover/

https://hosting.intermedia.net/support/kb/default.asp?id=2445

Previous Version stopped working on network share

Environment: Server 2003 R2

Symptoms:

No previous versions of files are found when looking from client computer on network share. Seems to be set up ok, but when looking at Task Scheduler the job shows error “Could not Start”

Event Viewer shows no related errors at the latest runtime.

Solution:

1. Disable shadow copy and delete all scheduled jobs.
2. Delete or move files starting with “d42” from folder “C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18”
3. Enable shadow copy on disks and verify that task now can be started manually.

Cause:

Might be the account originally used to create the job doesn’t exist anymore.

References:

http://support.microsoft.com/kb/822904 - 0x800700d data is invalid.

http://blogs.technet.com/b/jhoward/archive/2006/06/22/shadow-copy-failures-scheduled-task-fails-with-general-page-initialization-failed-error-0x8007000d.aspx -

http://blog.mpecsinc.ca/2007/03/windows-server-2003-attempt-to-retrieve.html

 

 

 

Lockscreen shortcut

When bouncing about on different desktops, virtual and otherwise physical its easy to leave a computer unlocked sometimes. This isn’t so good, but shortcuts tends to flip out when accessing remote systems. A good security practice is to create a desktop shortcut that can lock the computer very easily.

So,

1. Create a shortcut

2. Enter: rundll32.exe user32.dll,LockWorkStation

3. Save and change icon to a padlock or something more logical. This among other icons can be found in Shell32.dll under system32

References:

http://www.sevenforums.com/tutorials/13278-lock-computer-create-shortcut.html

http://ask-leo.com/how_do_i_change_the_icon_of_a_desktop_shortcut.html

Upgrade to IE8 forces Enhanced Security for all Terminal Server users

Major headache.

Scenario: Users on Server 2003 R2 SP2 Terminal Server experience crashes in Internet Explorer. In an effort to kill these problems the browser is upgraded to IE8. This is done while the users are logged on, in past situations this hasn’t been any problems. Changes doesn’t push through until server is rebooted. Not so this time.

30 minutes after IE is upgraded users call in and report that they can’t mark formfields in IE. For example they can’t input text in google searchfield. Strange I think. Probably some locked files, easy done we’ll reboot the server. And yes, this issue disappeared. But instead Internet Enhanced Security is now enforced for all Terminal Server users and they don’t want to allow every single page they're gonna visit. How did this happen? IEES is disabled, both for users and admins in Windows Components.

1.5hours later we finally solved it, but it wasn’t a pretty solution.

Tried and did not succeed :

• Change IEHarden = 0 in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\InternetSettings\ZoneMap]
• Changed GPO to lower security settings

Success:

Deployed DisableIIEES.bat through GPO. Cudos to BrentgMS for the solution. Link to orginal below.

----------------------- DisableIEES.bat -----------------------------

::START

ECHO OFF
REM  IEHarden Removal Project
REM  HasVersionInfo: Yes
REM  Author: Axelr
REM  Productname: Remove IE Enhanced Security
REM  Comments: Helps remove the IE Enhanced Security Component of Windows 2003 and 2008(including R2)
REM  IEHarden Removal Project End
ECHO ON
::Related Article
::933991 Standard users cannot turn off the Internet Explorer Enhanced Security feature on a Windows Server 2003-based terminal server
::http://support.microsoft.com/default.aspx?scid=kb;EN-US;933991

:: Rem out if you like to Backup the registry keys
::REG EXPORT "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" "%TEMP%.HKEY_LOCAL_MACHINE.SOFTWARE.Microsoft.Active Setup.Installed Components.A509B1A7-37EF-4b3f-8CFC-4F3A74704073.reg"
::REG EXPORT "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" "%TEMP%.HKEY_LOCAL_MACHINE.SOFTWARE.Microsoft.Active Setup.Installed Components.A509B1A8-37EF-4b3f-8CFC-4F3A74704073.reg"

REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" /v "IsInstalled" /t REG_DWORD /d 0 /f
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}" /v "IsInstalled" /t REG_DWORD /d 0 /f

::Removing line below as it is not needed for Windows 2003 scenarios. You may need to enable it for Windows 2008 scenarios
::Rundll32 iesetup.dll,IEHardenLMSettings
Rundll32 iesetup.dll,IEHardenUser
Rundll32 iesetup.dll,IEHardenAdmin
Rundll32 iesetup.dll,IEHardenMachineNow

::This apply to Windows 2003 Servers
REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OC Manager\Subcomponents" /v "iehardenadmin" /f /va
REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OC Manager\Subcomponents" /v "iehardenuser" /f /va

REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OC Manager\Subcomponents" /v "iehardenadmin" /t REG_DWORD /d 0 /f
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OC Manager\Subcomponents" /v "iehardenuser" /t REG_DWORD /d 0 /f

::REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" /f /va
::REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}" /f /va

:: Optional to remove warning on first IE Run and set home page to blank. remove the :: from lines below
:: 32-bit HKCU Keys
REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "First Home Page" /f
REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Default_Page_URL" /t REG_SZ /d "about:blank" /f
REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "about:blank" /f
:: This will disable a warning the user may get regarding Protected Mode being disable for intranet, which is the default.
:: See article http://social.technet.microsoft.com/Forums/lv-LV/winserverTS/thread/34719084-5bdb-4590-9ebf-e190e8784ec7
:: Intranet Protected mode is disable. Warning should not appear and this key will disable the warning
REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "NoProtectedModeBanner" /t REG_DWORD /d 1 /f

:: Removing Terminal Server Shadowing x86 32bit
REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" /v "IEHarden" /f
::  Removing Terminal Server Shadowing Wow6432Node
REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" /v "IEHarden" /f

::END

Se link from msdn below for original blogpost for the issue

 

References:

http://serverfault.com/questions/379123/windows-server-2003-r2-terminal-server-internet-explorer-enhanced-security-won

http://blogs.msdn.com/b/askie/archive/2009/06/23/how-to-disable-ie-enhanced-security-on-windows-2003-server-silently.aspx