Install printer drivers without being a local administrator.

To enable a normal user to be able to point to a network printer, install the drivers and print.  the follow will need to be in place.

1.  Enable the following group policies:  Computer Configuration | Administrative Templates | System | Driver Installation | Allow non-administrators to install drivers for these devices setup classes.

2.  Printer Classes GUID would be :  {4d36e979-e325-11ce-bfc1-08002be10318}
 A list of classes can be found here.

3.  Computer Configuration | Administrative Templates | Printers | Point and Print Restriction.  Disable this setting.

When the policy setting is disabled: 
-Windows Vista client computers can create a printer connection to any server using Point and Print.
-Windows Vista computers will not show a warning or an elevated command prompt when users create a printer connection to any server using Point and Print.
-Windows Vista computers will not show a warning or an elevated command prompt when an existing printer connection driver needs to be updated.


Reference:  http://social.technet.microsoft.com/Forums/en-US/w7itprosecurity/thread/df21d2c2-c2d4-4107-bfe3-bf8c5a1cd946/

Windows 7 Deployment with SCCM OSD (Reference)

I came across a lot of articles about building Windows 7 with SCCM OSD.    Here are a few good ones... and I think the authors have done an excellent work documenting them and sharing those knowledge.

Building Windows 7 with SCCM OSD Step by step
http://www.windows-noob.com/forums/index.php?/topic/667-deploy-windows-7/

http://blogs.technet.com/b/configurationmgr/archive/2009/07/27/a-step-by-step-for-using-osd-through-system-center-configuration-manager-2007.aspx


Customizing Windows 7 deployment Part 1 - How can I change the regional, keyboard, locale etc in Windows 7
http://www.windows-noob.com/forums/index.php?/topic/1660-customising-windows-7-deployments-art-1/

Customizing Windows 7 deployment Part 2 - Creating collection variable
http://www.windows-noob.com/forums/index.php?/topic/1685-customising-windows-7-deployments-part-2/

Customizing Windows 7 deployment Part 3 - Power management settings
http://www.windows-noob.com/forums/index.php?/topic/2283-customising-windows-7-deployments-part-3/

Customizing Windows 7 deployment Part 4 - Language Pack
http://www.windows-noob.com/forums/index.php?/topic/3251-customising-windows-7-deployments-part-4/

Customizing Windows 7 deployment Part 5 - Getting Bitlocker to work
http://www.windows-noob.com/forums/index.php?/topic/3875-customising-windows-7-deployments-part-5/

Setting computer name during deployment.
http://www.windows-noob.com/forums/index.php?/topic/3875-customising-windows-7-deployments-part-5/
http://osdeploy.wordpress.com/2008/08/05/easy-way-to-change-pc-name-during-deployment/
http://t3chn1ck.wordpress.com/2009/04/24/script-to-prompt-for-system-name-in-sccm-osd/

Basic troubleshooting guide and location of the log files.
http://hayesjupe.wordpress.com/sccm-osd-basic-troubleshooting/

Troubleshooting the PXE point and WDS in Windows 7
http://blogs.technet.com/b/system_center_configuration_manager_operating_system_deployment_support_blog/archive/2011/10/14/troubleshooting-the-pxe-service-point-and-wds-in-configuration-manager-2007.aspx

SCCM : "the self signed certificate can not be created sucessfully"

Came across this problem the other day.  When I tried to create a Task Sequence Media, I get this message "the self signed certificate can not be created successfully".  Hmm... make no sense at all.  Looking at the log file (CreateTsMedia.log) which is located at C:\Program Files\Microsoft Configuration Manager Console\AdminUI\AdminUILog.  There is this error about "Cannot acquire crypt context".  You wonder what that means...

After doing more research on Internet, the error was caused by a PXE certificate which was created previously and not removed automatically when PXE point was reinstalled.  The certificate needs to be remove manually..  The folder is location is at:   C:\Users\<UserID>\AppData\Roaming\Microsoft\Crypto\RSA.
Once I removed the folder under RSA, things go smoothly again...  

Working with Windows 7 laptops, folder redirection and offline files - my experience

Working with Folder Redirection on laptops with offline files can be very challenging because laptops can be in a few different scenarios and they are need to be taken care of.  They can be:

1.  docked in the office and connected to LAN.
2.  undocked in the office and connected to wireless network at work
3.  undocked, lid close, brought it home, connect to home wireless and VPN into work.
4.  undocked, shutdown and VPN from home.

Let's look at each scenario closely.

Scenario 1:  docked in the office and connected to LAN.
Well, this one is easy.  Nothing really needs to be changed to make this work.  When laptop is connected to a fast network, the offline files should be online. 
The following group policy settings in Administrative Templates | Network | Offline Files should be set:
- Allow or Disallow use of Offline Files feature = Enable
- Configure Background Sync = (it varies, set to suit your environment)
- Enable Transparent Caching = 60ms  (varies, we set to 60ms in our situation)

Scenario 2:  Undocked in the office and connected to wireless network at work.
Okay, depending on your internal wifi setup, this one could be a bit tricky./  In our situation, this one would pretty much falls into scenario because our wifi setup is pretty good and the latency is very low.

Scenario 3:  Undocked, lid close, brought it home, open lid,  connect to home wireless and VPN into work.
In this situation, user is not log off when they bring their laptop home.  So, most likely the offline file status would show Offline (Not connected) when they open the lid.  User will launch their VPN application and establish a connection back to work.  As soon as the connection is established, the status will go 'online'.  Okay, this is going to be an issue, because your home Internet connection might be slow especially if you are using wireless at home and when you try to copy something to your local desktop, guess what?  slow as hell... because everything you copy to the desktop is actually being redirected to the network share.  So, to get around this problem, we need to configure the 'Slowlink mode' settings..  The trick is to figure out what is the right value for latency or bandwidth..  In our case, we utilize 'latency' to distinguish between an acceptable network connection and a slow network connection.  This is a good article for determining the latency of the network.  The following group policies are applied to Laptops OU.  Anything about 60ms will be considered as slow link.
Computer Configuration | Administrative Templates | Network | Offline Files
- Configure slow-link mode.  UNC = \\server1\share1\*    Value = Latency=60

Scenario 4: undocked, shutdown and VPN from home.
This scenario would be very similar to scenario 3.  The only difference is that user has the laptop shutdown and bring it home.  So, when user start it up at home, user will login with their cache credential.  At this stage the offline file status would be "Offline (Not connected)", user will initiate the VPN session and connect to the network, once it is connected to the network, depending on the speed, if latency is set correctly (see Scenario 3) and falls above 60ms, the offline status will change to "Offline (Slow-link)", otherwise it will stay online if the latency is less than 60ms.

Another option to explore is to define the throughput (bits per second).  E.g.  Throughput=10000
or even a combination of both.  Value Name="*" Value="Throughput=10000, Latency=50

Userenvlog for Windows 7

User Environment Log is useful in troubleshooting login issues.  UserEnvLog is not enable by default, this is how you enable it:

1.  Create this folder if it does not exist:  %windir%\debug\usermode
2.  Create a registry subkey "Diagnostics" under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
3.  Create a new DWORD key  GPSvcDebugLevel
4.  Enter the value 30002 (hex)   http://blogs.technet.com/b/instan/archive/2008/04/17/troubleshooting-the-intermittent-slow-logon-or-slow-startup.aspx

5.  Reboot your machine and login, you should be able to find the Gpsvc.log in the folder %windir%debug\usermode directory.

Enabling winlogon.log
1.  Navigate to the this registry key.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}.
2.  Edit this value :  ExtensionDebugLevel   DWORD    2
3.  Reboot
4.  Log file will be located at %systemroot%\security\logs

Resetting Offline File Cache in Windows 7

When you enabled Folder Redirection with offline files, one of the benefits is that user do not have to wait for the files to be copied over to the network before they are able to access their desktop.  When you have offline files enabled, during the logon process, the files in your folders will be copied to local cache (c:\windows\csc), once completed, it will create the folder structures on the network and users will have access to the desktop.  The background sync will happen shortly after and the local cache will sync the files to the redirected folders. 

However, there are times where your local offline cache is corrupted due to various reason and you will run into all sorts of sync issues.  The only way to fix this is to blow away the local cache and have folder redirection sync the files from local folders again.  The way to do this is:

-  With admin privillege, start Registry editor.
-  Navigate to  HKLM | System | CurrentControlSet | Services | CSC | Parameters
-  Create a new key of "FormatDatabase"   REG_DWORD
-  Assign the value "1"
-  Reboot the machine.

After the reboot, check the "Offline files" in the Sync Center, it should be empty.  Also, the above key should be removed after the reboot. 

You will not have a fresh empty copy of the local cache database and the sync issue would be resolved (hopefully...)

Location of My Documents Folder - Folder Redirection

The path to the My Documents folder is stored in the following registry key, where path is the complete path to your storage location:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Value Name: Personal
Value Type: REG_SZ
Value Data: path

Any modification from the default is recorded in the following location and the path listed earlier is also updated:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Value Name: Personal
Value Type: REG_SZ
Value Data: path

If the administrator redirects My Documents by using group policy folder redirection, the path is present in this value and the option to modify the location of the My Documents folder is not available when you view properties of the My Documents folder.

Rebuilding User Profiles in Windows 7

Time comes when you need to rebuild user profile locally on the system.  Things are a bit different with Windows 7.  Renaming the user directory in c:\users is not sufficient, you need to delete one of the registry key associate with the image path.

Steps involved:

1. Rename the user profile under c:\users\
2.  Go to the following registry and delete the correct key base on ProfileImagePath.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ProfileList

Restart your system and whola!!!!

Re-initialize offline file cache and database

There are times when the offiline file cache gets corrupted and you will need to rebuild or re-initialise the cache database.  Microsoft has published a KB Article regarding to this.

http://support.microsoft.com/kb/230738

Running Powershell Interactively

When you run a powershell script locally in a powershell box, you will get error message like "Script cannot be loaded because execution of script is disabled on the the system.."

This is in fact what it says, execution of script is prohibited.  This is the default settings:  To run script interactively on the box, execute this command:

"Set-ExecutionPolicy RemoteSigned"

You will be fine after that.

Viewing MSS: GPO settings in GPMC.

Ever wonder how you can view the MSS settings in the management console to look at those FDCC group policy settings from NIST?

1.  Download the Windows 7 Security Compliance Management Toolkit.  This tool replaces the previous version called GPO Accelerator

2.  Install the Windows 7 SCM Toolkit with elevated admin privillege. 

3.  Install the LocalGPO from Start Menu | All Programs | Microsoft Security Compliance Manager | Local GPO

4.  Once installed, go to Start Menu | All Programs | LocalGPO | LocalGPO command-line and Run as Administrator

5.  Execute this command "cscript LocalGPO.wsf /ConfigSCE"

6.  Wait for "Security Configuration Editor has been modified successfully" message.

Launch your GPMC and you should see the MSS settings. i.e. Computer Configuration | Windows Settings | Security Settings | Local Policies | Security Options

Mounting WIM with ImageX

It's been a while since I need to do one of this.  I think I better document this here for my reference.  This is no rocket science.

To mount a WIM file so that you can deploy some custom settings such as additional folders and stuff as part of the OS installation.  This is what you do:

1.  Install Microsoft Windows AIK.
2.  Run a command prompt with elevated privillege in Windows 7
3.  Create a directory c:\mounted_images
4.  Change directory to c:\Program files\Windows AIK\Tools\x86
5.  Imagex.exe /mount Z:\Windows7_Source\Sources\install.wim 1 c:\mounted_images

Once mounted, you should be able to make modification.

6.  Imagex.exe /unmount /commit c:\mounted_images

http://technet.microsoft.com/en-us/library/cc766067(WS.10).aspx

Event 4110 CAPI2 Failed to add certificate to Third-Party Root Certification Authorities store with error: A certificate chain could not be built to a trusted root authority.

We have been noticing a lot of Event 4110 CAPI2 " Failed to add certificate to Third-Party Root Certification Authorities store with error: A certificate chain could not be built to a trusted root authority." errors in the eventlog of Windows 7 workstations lately.

After some thorough investigation, all these Windows 7 systems are in fact having issues with their Trusted Root Certificate updates.  It worked differently from Windows XP where their CA store doesn't get updated from Software Updates from Microsoft Software Updates, WSUS or SCCM Software Updates etc.  In Windows Vista or Windows 7, the update root certificates feature automatically check the list of trusted authorities on the Windows Update Website when the check is needed by a user's application.  The Event 4110 was generated when the certificate chains cannot be verified due to missing CAs.

So, in an enterprise environment where proxy servers and firewall are used, default Windows 7 (or Vista) will have problem requesting the updates of CAs.  There are a few ways to move forward.

1.  If you have one proxy server and very unlikely it will get changed, you can direct all Windows 7 systems to go through the proxy when requesting an update for CAs.  The following command will do just that.  When you restart the Cryptographic Service, you can see some actions happening.  Go to the Windows | Cryto Logs and make sure you enable the log before you do so.

To Set Proxy = netsh winhttp set proxy http://proxy:8080/
To Reset = netsh winhttp reset proxy


2.  Update the trusted root CAs by installing this file.  http://download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/rootsupd.exe

The rootsupd.exe can be run with a "/q" switch and it will get installed silently if you are thinking of deploying it using SCCM or something.

The problem with this option is that, you might need to do this every couple of months and also the risks of application acquiring certificates which are new and not found in this rootsupd.exe


3.  Use Group Policy to import certificates into the Trusted Root CA store.
Computer Configuration | Windows Settings | Security Settings | Public Key Policies

A lot of manual work for admins and also they will have a difficult time figuring out what trusted CA are being used by applications.


4.  Punch holes in your firewall and allow Windows 7 systems to connect directly to Microsoft for CAs.

5. Implement your own certificate domain services.  E.g.  PKI.



Articles:

Managing Trusted Root Certificates
http://technet.microsoft.com/en-us/library/cc754841.aspx#BKMK_adddomain


Certificate Support and Resulting Internet Communication in Windows Vista
http://technet.microsoft.com/en-us/library/cc749331%28WS.10%29.aspx


Dreamslayer:
http://dreamlayers.blogspot.com/2009/12/windows-7-cant-always-automatically.html

One way to get around desktop shortcuts missing ...

So, there is this scheduled maintenance task in Windows 7 which runs every Sunday at 1:00am and  removes broken desktop shortcuts if more than 4 are found.  (I am still a bit puzzled about the word "Broken".  In my tests I created some shortcuts which points to some network shares, they are legitimate desktop shortcuts but when the maintenance scheduled task ran, it found them to be broken for whatever reasons and removed them.  I am guessing that it might not have permission to access those files/shares and thefefore classified them as broken???)

The maintenance task actually runs some powershell scripts located at c:\windows\diagnosis\scheduled\maintenance which performs several maintenance tasks.  However, the one which we are interested in is called "TS_BrokenShortcuts.ps1"

This is my idea and I am yet to cofirm this.

The TS_BrokenShortcuts.ps1 is owned by "TrustedInstaller", so even the administrators will not have permission to modify it.  So, we will have to take ownership of the file.

- Bring up an elevated command prompt and issue this command:  What this will do is to change the owner of the file to Administrators.
"Takeown /f C:\Windows\diagnostics\scheduled\Maintenance\TS_BrokenShortcuts.ps1 /A"

- Copy this file to a source location and change the number 4 to let say 50, which the maintenance task will only delete the broken shortcuts if  over 50 are found.  Come on..  50?  You got to be kidding me!!
(Get-ListLength $brokenStartupShortcuts)) -gt 4))

- Now, being the owner doesn't mean you will have permission to write/modify this file.  So, we will have to change the ACL (Access Control List) of this file.  Issue the following command will grant Administrators to have Full Control over the file.
icacls c:\windows\diagnostics\scheduled\Maintenance\TS_BrokenShortcuts.ps1 /grant Administrators:F

- The final step would be to copy the modified  TS_BrokenShortcuts.ps1 file and override the original file. 
xcopy TS_BrokenShortcuts.ps1 c:\windows\diagnostics\scheduled\Maintenance\TS_Brokenshortcuts.ps1 /y

Depending on what you want to do, you might want to consider deleting this file so that this particular task will never execute again. (Again, I am yet to confirm this!)

Now, the challenge is, how do I accomplish all these in SCCM OSD Task Sequence.  My quest continues...

[Updates  Feb 11th 2011]
I implemented the above findings to SCCM OSD Task Sequence with the following and it works like a charm.  The TS_Brokenshortcuts.ps1 is deleted and the Maintenance Task will not remove anymore broken shortcuts from now on.

1.  Run command Line "Takeown /f C:\Windows\diagnostics\scheduled\Maintenance\TS_BrokenShortcuts.ps1 /A"

2.  Run Command Line "icacls c:\windows\diagnostics\scheduled\Maintenance\TS_BrokenShortcuts.ps1 /grant Administrators:F"

3.  Run Command Line "cmd.exe /c del c:\windows\diagnostics\scheduled\Maintenance\TS_BrokenShortcuts.ps1 /q"

(Note that when running OS command, such as "Del, Ren" etc, make sure you do the "cmd.exe /c <command>")

Deskop shotcuts gone missing after Windows 7.

I been hearing a lot of the complains from users about their desktop shortcuts gone missing in Windows 7 especially over the weekend.  Digging around the internet concludes that it is a known behavior of the System Maintenance Troubleshooter which runs every Sunday at 1am.  (The name of the task is called  Scheduled under Diagnosis in Task Scheduler).  If it finds more than 4 broken shortcuts, it will removes all the broken shortcuts.

As detail in http://support.microsoft.com/kb/978980/

The System Maintenance Troubleshooter runs a few maintenance tasks (powershell script) which can be found in C:\Windows\diagnostics\scheduled\Maintenance.

There are a few ways to deal with this:

1.  Keep broken shortcuts to less than 4.  (I think this is going to be a challenge for some users)

2.  Take ownership of the powershell script "TS_brokenshortcuts.ps1" and modify | rename | delete it.

3.  Disable the task in the task scheduler which is not a good idea as it runs other maintenance tasks as well.

It took me a while to work out how to use the schtask.exe command to find the right tasks for this one.
When you use "schtasks.exe /query", you will see the "Scheduled" task name which  System Maintenance Troubleshooter runs.   However, if you do a -- schtasks.exe /change /disable /TN "Scheduled"--, it will return an error because it couldn't find a task name called "Scheduled".

The Syntax is actually -- schtasks /change /disable  /TN "\Microsoft\Windows\Diagnosis\Scheduled" --

Windows 7 RDP session randomly disconnected. (Part 2)

More researches lead me to this Microsoft KB article.
http://support.microsoft.com/kb/2083411

The above article make sense because users are being disconnected from RDP session randomly which match the interval of group policy refresh.

I have adjust the registry key to set to "0" manually and doing a final test to confirm the resolution.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
fDenyTSConnections.

This article is also useful.

http://setspn.blogspot.com/2010/12/remote-desktop-session-disconnection.html

Windows 7 RDP session randomly disconnected. (Part 1)

Users are experiencing RDP session disconnected randomly when connected remotely to servers via RDP session.  Checking at the event log.  You will see the following errors:
EventID 56 : Source TermDD
The Terminal Server security layer detected an error in the protocol stream and has disconnected the client. Client IP:  X.X.X.X
EventID 50 : Source TermDD
The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client
I did some research and found the following:


http://blogs.technet.com/b/askperf/archive/2010/03/25/the-curious-case-of-event-id-56-with-source-termdd.aspx


http://social.technet.microsoft.com/Forums/en-US/winserverTS/thread/ab950c6e-847a-4f51-bc15-b9f54793787c


Suggested cause of actions are:
1.  Disable Autotunning in the TCP to determine any improvement:    Open up an elevated command prompt and issue the following command.

netsh interface tcp set global autotuninglevel=disabled
netsh interface tcp set global autotuninglevel=normal 
(this will reverse the change if you find it has adverse effects.)
netsh interface tcp show global
(to show the TCP settings)


2. Set the MTU to 1300 (Default is 1500)

netsh interface ipv4 show interface
netsh interface ipv4 set subinterface "Local Area Connection" mtu=1300 store=persistent
I carried out with some test and couldn’t come to a conclusion with this. After adjusting the MTU size, I managed to keep the RDP connection for over 2 days now without disconnection.  I will have to keep monitoring this one.