Windows Folder Redirection

Posted on 10/06/2017 by Migrated

KB ID 0000467

Problem

Q: What is Folder Redirection?

A: Essentially you can take folders that hold things like your “My documents” or your “Favorites” folder, and put them out on a network server, which is great if you want to back that sort of information up for disaster recovery.

Q: What’s the difference between this and a roaming / roving profile?

A: Folder redirection keeps information on a server and you access it remotely, Roaming profiles are designed to sync that information (and your WHOLE user profile) backwards and forwards to a network share as your users logon and log off.

Q: What folders can be redirected?

A: From Server 2008 onwards, and with Windows 7 clients and above, the following can be redirected.

AppData(Roaming)
Desktop
Start Menu
Documents
Pictures
Music
Videos
Favorites
Contacts
Downloads
Links
Searches
Saved Games

Solution

1. On a server create a folder to hold the redirected data, In this case you will notice I’ve called my share Redir$ (The dollar sign just means it’s a hidden share, and can’t be seen if people are network browsing).

Folder Redirection: Permissions for the Root Folder

2. Set the share permissions to Everyone: Full Control (Don’t worry we will secure it with NTFS permissions).

3. On the security tab of the folder click advanced.

4. For Server 2012 / 2016 you should see something like this;

For Server 2008 and older it should look more like this;

5. For server 2012 / 2016 Disable Inheritance and select ‘Convert’.

For 2008 and older, untick “Include Inheritable permissions from this objects parent” > At the warning click “Add”.

6. Select each User in turn (You will need to add the Everyone group) > Then Edit the permissions so that they are as follows.

CREATOR OWNER – Full Control (Apply onto: Subfolders and Files Only).
System – Full Control (Apply onto: This Folder, Subfolders and Files).
Domain Admins – Full Control (Apply onto: This Folder, Subfolders and Files).
Everyone – Traverse Folder/Execute File (Apply onto: This Folder Only).
Everyone – List Folder/Read Data (Apply onto: This Folder Only).
Everyone – Read Attributes (Apply onto: This Folder Only).
Everyone – Create Folder/Append Data (Apply onto: This Folder Only).

2012 / 2016

‘Show Advanced Permissions’

2008 and older.

7. Now REMOVE BOTH the entries for USERS > Apply > OK.

7. On your domain controller open the Group Policy Management Console, (Under Administrative Tools) and either create a new USER policy of edit one that already linked to the users you want to enforce this policy upon.

8. I prefer to create a new policy and call it something sensible so if there’s a problem it’s easy to find in the future.

9. Navigate to:

[box]User Configuration > Policies > Windows Settings > Folder Redirection[/box]

Locate the folder you want to redirect (In this case its just the documents folder) > Right click > Properties.

10. I’m going to redirect all my users documents to the one folder I created earlier, so I will choose basic.

Note: You can choose “Advanced” and redirect different groups folders to different locations.

Enter the path to the root folder AS A UNC PATH, DONT click the browse button and browse to it.

11. I’m going to accept the defaults on the settings tab, the option I’ve highlighted creates the folders with exclusive rights on the folders for the user in question and SYSTEM, so the domain admin had no access (this is OK, it’s the same way user profiles work, you can still back them up).

12. Now as your users log on their folders will be redirected to the share you setup.

Backing up Redirected Folders

13. Even with exclusive rights you can still back this data up:

Event ID 62464 ‘Source amdkmdag’

Posted on 17/11/2015 by Migrated

KB ID 0000613

Problem

My laptop has an annoying habit of ‘freezing” and requiring a manual power off and back on again to get it working (HP Probook 6560b).

A look in the system log yielded hundreds of event ID 62464 errors.

Log Name: System
Source: amdkmdag
Date: xx/xx/xxxx xx:xx:xx PM
Event ID: 62464
Task Category: DVD_OV
Level: Information
Keywords: Classic
User: N/A
Computer: xxxxxxxxx
Description:
UVD Information

Solution

It seems I’m not the only one, a quick internet search turned up a few people with the same problem. However all the other posts were advocating disabling the logging of the error. I’m not a fan of disabling error logging no matter how ‘Spammy’ it is.

It’s obviously being generated by my graphics driver, so a look there told me what version I was running. (Start > Run devmgmt.msc {Enter}).

I went to HP and downloaded the latest published AMD driver they had, and rebooted, problem solved.

Event ID 36888

Posted on 17/11/2015 by Migrated

KB ID 0000634

Problem

This was driving me nuts on my Windows 7 x64 Laptop.

Log Name: System
Source: Schannel
Event ID: 36888
Task Category: None
Level: Error
User: SYSTEM
Description:
The following fatal alert was generated: 10. The internal error state is 10.

I was getting a dozen of these an hour!

Solution

This error is caused (from what I can gather) by an error in certificate negotiation, your machine is trying to initiate communications with another machine/server using a certificate and TLS and the process is producing this error TLS1_ALERT_UNEXPECTED_MESSAGE (10).

1. If your browser is the cause of the problem, then simply open Internet Options > Advanced > Untick all the TLS options > Apply.

2. However this DID NOT WORK for me, so something is programmatically chatting from my laptop using TLS. The bottom line is, this problem is probably not even on your machine, so I’m simply going to disable SCHANNEL logging.

Note: If your Error does NOT say “The following fatal alert was generated: 10. The internal error state is 10“. then I would suggest NOT doing this.

3. In the search run box type regedit and navigate to the following key;

[box]
HKEY_LOCAL_MACHINE > System > CurrentControlSet > Control > SecurityProviders > SCHANNEL
[/box]

Change the EventLogging value from 1 to 0 (that’s a zero).

Windows Server – Setup Home Folders and Profile Folders

Posted on 17/11/2015 by Migrated

KB ID 0000739

Problem

A while back I got an email,

Message: Hallo Pete,

Can you make a tutorial for me for sharing a Home Folder or Profile Path folder for every user?
It’s hard to get one.

Thanks in advance.

Sincerely,
Matthew Wittenberg </br

Well it’s taken me a while (sorry!) But here you go,

Solution

Creating and Allocating Home Folders to Users

1. Create a folder that is on a drive or volume with plenty of room.

2. I’ve simply used ‘Home’ as the folder name, open the folder’s properties.

3. Sharing Tab > Advanced Sharing.

4. Tick to share > put a dollar ‘$’ symbol onto the end of the share name (this just stops the folder being visible to someone browsing the network) > Permissions.

5. Grant Everyone ‘Full Control’, Don’t worry we will lock it down with NTFS permissions (Remember permissions are cumulative, and most restrictive apply) > Apply > OK.

6. Security tab > Advanced.

7. Change Permissions.

8. Untick ‘Include inheritable permissions……’ > Add.

9. Select CREATOR OWNER > Edit > Permissions should apply to ‘Subfolders and files only’ > Full control.

10. Select SYSTEM > Edit > Permissions should apply to ‘This Folder, subfolders and files only’ > Full control.

11. Select DOMAINNAMEAdministrators > Edit > Permissions should apply to ‘This Folder, subfolders and files only’ > Full control.

12. Remove the Users (the one with Read & Execute).

13. Remove the Users (the one with Special).

14. Add.

15. Everyone > check Name (make sure it underlines Everyone) > OK

16. Sett Apply to = This folder only > Allow the following.

Traverse Folder / execute file
List Folder / read data
Read attributes
Create Folders / append data

Allocate the Home Folder to the Domain Users

1. From within Active Directory Users and Computers locate your users, (you can press Windows Key+A to select them all).

2. Open their properties.

3. Profile tab > You can connect a drive letter (I usually use H:) and connect that to the users home drive. Set the path like so;

[box]

\\Server-name\Folder-name\%username%
e.g.
\\PNL-DC\Home$\%username%

[/box]

4. This is what the users will see.

5. On the server the folders are all created straight away.

Creating and Allocating Roaming Profile Folders to Users

The process for setting up the folder is identical to the one above for the home folders.

1. Create a folder that is on a drive or volume with plenty of room.

2. I’ve simply used ‘Profile’ as the folder name, open the folder’s properties > Sharing Tab > Advanced Sharing > Tick to share > put a dollar ‘$’ symbol onto the end of the share name (this just stops the folder being visible to someone browsing the network) > Permissions.

3. Grant Everyone ‘Full Control’, Don’t worry we will lock it down with NTFS permissions (Remember permissions are cumulative, and most restrictive apply) > Apply > OK.

4. Security tab > Advanced.

5. Change Permissions > Untick ‘Include inheritable permissions..’ > Add.

6. Remove the Users (the one with Read & Execute).

7. Remove the Users (the one with Special).

8. Add.

9. Everyone > check Name (make sure it underlines Everyone) > OK.

10. Set Apply to = This folder only > Allow the following.

Traverse Folder / execute file
List Folder / read data
Read attributes
Create Folders / append data

Allocate the Roaming Profile Folder to the Domain Users

1. From within Active Directory Users and Computers locate your users, (you can press Windows Key+A to select them all).

2. Open their properties > Profile Tab > Tick ‘Profile path’ > Set the path as follows;

[box]

\\Server-name\Folder-name\%username%
e.g.
\\PNL-DC\Profiles$\%username%

[/box]

3. Unlike home folders, profile folders are only created when the users log onto the network, here you can see this profile has a V2 on the end of it (a version 2 profile means it has come from a Windows Vista or newer machine). For this reason if your users use Windows XP (or older) clients, AND Windows Vista (or newer) clients they will get TWO DIFFERENT profiles.

Windows Server – Fine Grained Password Policies

Posted on 17/11/2015 by Migrated

KB ID 0000765

Problem

Before server 2008 if you wanted more than one password policy, you had to create a sub domain just to do that! with Server 2008 we were given fine grained password policies, which were fine (if a little clunky), and involved you creating ‘Password Settings Objects’.

They were a pain if you were not used to them e.g. five minutes is entered as 00:00:05:00. But now Microsoft have made things a LOT EASIER (though they made a good job of hiding it!).

Solution

1. From Server Manager (ServerManager.exe) > Local Server > Tools > Active Directory Administrative Center.

2. System container.

3. Password Settings Container.

4. New > Password Settings > Configure as required > Add > Locate the Security group you want to apply the policy to > OK > OK.

Note: The Precedence dictates which policy will apply if the same user has multiple policies applied to them.

5. You can then create other policies to apply to different groups.

To See What Policies are Applying to a User

6. Locate the user (while still in Active Directory Administrative Center) Right click > View resultant password settings > If a policy is in place it will open.

7. If there is no policy in place you will see, “User does not have resultant fine grained password settings. Please check the user’s domain password settings”.

WDS – Unattended file – Removing /Formatting Drive Partitions

Posted on 17/11/2015 by Migrated

KB ID 0000490

Problem

Over the last couple of years I’ve done a lot of imaging of School PC’s I don’t know why but they come with a myriad of different drive and partition configurations. Even big vendors like HP and Dell ship their machines with recovery partitions these days.

If you are imaging with WDS this can cause a problem so what I usually want to do is remove all the partitions, create one big one that takes up all the drive, and format it as NTFS.

Solution

Before you begin make sure you are clued up on working with WDS unattended files, run through my instructions here.

The following procedure needs to be added to the WDS Unattended file NOT the unattended file for the image, (again run through KB0000180 if you are unsure.)

1. While editing your Unattended answerfile you need to locate, “Microsoft-Windows-Setup_neutral” and add “DiskConfiguration” to the “1 windowsPE” component.

2. Right click it and add a disk > Set Disk ID = 0 > Set WillWipeDisk = true.

3. Right Click > Create Partition > Set Extend = true > Set Order = 1 > Set Type = Primary.

4. Select Modify Partitions > Set Active = true > Set Extend = false > Set Format = NTFS > Set Label = SYSTEM > Set Letter = C > Set Order = 1 > Set Partition ID = 1.

5. This procedure will add the following to your unattended file.

Update Global Address List Error “WARNING: The recipient “xxxxxMicrosoft Exchange System Objects/xxxxx” is invalid and couldn’t be updated

Posted on 17/11/2015 by Migrated

KB ID 0000516

Problem

Seen when manually trying to update the Global Address List, with the following powershell command:

[box]Update-GlobalAddressList -identity ‘Default Global Address List'[/box]

Error: WARNING: The recipient “{your domain name}/Microsoft Exchange System Objects/{A Public Folder Name}” is invalid and couldn’t be updated.

Error: WARNING: The recipient “{your domain name}/Microsoft Exchange System Objects/OAB Version 2” is invalid and couldn’t be updated. WARNING: The recipient “{your domain name}/Microsoft Exchange System Objects/OAB Version 3a” is invalid and couldn’t be updated. WARNING: The recipient “{your domain name}/Microsoft Exchange System Objects/Offline Address Book – /o={your domain name}V/cn=addrlists/cn=oabs/cn=123” is invalid and couldn’t be updated.

This is commonly seen when an Exchange environment has been migrated from Exchange 2003. And it happens because the Alias names for the particular public folders have spaces in them (or a character that Exchange does not like).

Solution

1. On your Exchange 2007/2010 Server Launch the Exchange Management Console > Toolbox > Public Folder Management Console.

2. If you error is about OAB / Address books skip to step 5, If it’s to do with a public folder that your organisation has created, expand default public folders and locate one of them that’s causing the error (In the example above I’ve highlighted one called “1045 – Greengairs” > Select its parent > Then select it (in the central pane) and open its properties.

3. As soon as you select the “Exchange General” tab, you will get an error popup which indicates the problem, there is a problem with the Alias name, in this example there’s spaces in it remove them.

Error: The properties on this object have invalid data. If you click OK, default values will be used instead and will be saved if you do not change them before hitting Apply or OK on the property page. If you click cancel, the object will be displayed read-only and corrupted values will be retained.

4. Once removed apply the changes.

5. If your error references OAB or address books, expand system Public Folders > OFFLINE ADDRESS BOOK > Check the properties of ALL its child objects > and on the Exchange General tab remove any spaces or unusual characters.

Juniper SRX – ‘The Routing Subsystem Is Not Running’

Posted on 17/11/2015 by Migrated

KB ID 0001045

Problem

While trying to deploy Solarwinds to monitor a Juniper SRX failover cluster, we were having no joy connecting to the management interface of the secondary/standby firewall. The management (fxp0) interface on the primary (node0) firewall we could get to OK.

]

After jumping on the secondary firewall (via the console connection) we observed the following;

error: the routing subsystem is not running

Solution

As you can see (above) I couldn’t get the routing services started. And I soon found out, this is quite normal, the primary (active) firewall maintains the routing instance, the secondary firewall does not.

Well that fine but what about out Solarwinds box, what happens if the secondary firewall goes down? No one would know, and we also can’t take daily backups of its config.

To fix this problem you need to use the ‘backup-router’ command. This lets the appliance maintain some routes in the event that it is not hosting the live routing instance.

1. I’ll connect to to the primary firewall from this console session on the secondary firewall with the following command;

[box]request routing-engine login node0[/box]

2. Now I can add the backup-router routes, but assign them to the secondary (node1) firewall. Note: Where 192.168.100.1 is the next hop.

[box]

To get traffic back to the Solarwinds Management Server

set groups node1 system backup-router 192.168.100.1 destination 10.1.20.10/32

To get traffic back to the Cisco ACS Appliance

set groups node1 system backup-router 192.168.100.1 destination 10.1.20.10/32

[/box]

3. Don’t forget if the firewalls failover you will have the same problem (but the opposite way round), so I need the same to the primary node as well.

[box]

To get traffic back to the Solarwinds Management Server

set groups node0 system backup-router 192.168.100.1 destination 10.1.20.10/32

To get traffic back to the Cisco ACS Appliance

set groups node0 system backup-router 192.168.100.1 destination 10.1.20.10/32

[/box]

3. Save the config with a ‘commit’ command.

Update Cisco ASA – Directly from Cisco (via ASDM)

Posted on 17/11/2015 by Migrated

KB ID 0000636

Problem

Warning:

Before upgrading/updating the ASA to version 8.3 (or Higher) Check to see if you have the correct amount of RAM in the firewall (“show version” command will tell you). This is VERYIMPORTANT if your ASA was shipped before February 2010. See the link below for more information.

ASA – Memory Error (Post upgrade to version 8.3)

Warning 2:

Be aware, if you are upgrading to an OS of 8.4(2) or newer you can no longer access the device via SSH when using the default username of “pix” you need to enable AAA authentication for SSH, do this before you reboot/reload the firewall or you may lock yourself out.

ASA Enable AAA LOCAL Authentication for SSH

Its been a while since I wrote how to update the ASA by command line, and how to update the ASA from the ASDM. Now you can update the ASA directly from Cisco, providing you have a valid cisco CCO account.

Solution

1. Connect to the the ASDM on the ASA > Tools > Check for ASA/ASDM Updates.

2. Supply your Cisco CCO account information.

3. Next.

4. Decide if you want to update the OS of the ASA or the ASDM, or both.

5. Next.

6. The software will download. (The OS is downloading here), Note: it will get downloaded to the machine that the ASDM is running on first.

7. Then the ASDM software will download.

8. You may find that there is not enough room in flash memory, if so you will see this error. (if it does not error skip to step 11).

9. If you are stuck for room you can delete some items from your flash memory > Tools > File Management.

10. Here you can see I’m deleting and old version of the ASDM. Note you could delete the live version of the ASDM and Operating system if you had no choice (THOUGH DONT REBOOT THE FIREWALL until the new ones have uploaded, or you will be loading the files in in ROMMON mode!)

11. Once all the files have been downloaded to your location, they will be uploaded to the firewalls flash memory.

12. Next.

13. Finish.

Note: What happens now is the following commands are issued in the background automatically; (Note the versions numbers may be different in your case).

[box]

asdm image disk0:/asdm-649.bin
no boot system disk0:/asa843-k8.bin
boot system disk0:/asa844-1-k8.bin
boot system disk0:/asa843-k8.bin

[/box]

14. After the firewall reboots, it should come back up with the new OS and ASDM version.

PeteNetLive

Technology that 'Just Works'

Tag Archives: system

Event ID 62464 ‘Source amdkmdag’

Problem

Solution

Related Articles, References, Credits, or External Links

Event ID 36888

Problem

Solution

Related Articles, References, Credits, or External Links

Windows Server – Fine Grained Password Policies

Problem

Solution

To See What Policies are Applying to a User

Related Articles, References, Credits, or External Links

WDS – Unattended file – Removing /Formatting Drive Partitions

Problem

Solution

Related Articles, References, Credits, or External Links

Update Global Address List Error “WARNING: The recipient “xxxxxMicrosoft Exchange System Objects/xxxxx” is invalid and couldn’t be updated

Problem

Solution

Related Articles, References, Credits, or External Links

Juniper SRX – ‘The Routing Subsystem Is Not Running’

Problem

Solution

Related Articles, References, Credits, or External Links

Update Cisco ASA – Directly from Cisco (via ASDM)

Problem

Solution

Related Articles, References, Credits, or External Links