Michael Kleef ::: MSFT

Group Policy Settings Spreadsheet Changes

2009-11-06T21:30:00Z

I notice online that there's a broken link to the Group Policy Settings Spreadsheet changes. What happened was that the content for this area got consolidated and unfortunately in the process the old links were broken.

So if you are looking for settings changes in Group Policy for:

Windows 7
Windows Server 2008 R2
Windows Vista SP1 and SP2
Windows Server 2008
Windows XP SP1, SP2 and SP3
Windows Server 2003
Any associated Service Packs

then the new link is here: http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=18c90c80-8b0a-4906-a4f5-ff24cc2030fb

Diagnostics and Recovery Toolset support for different OS's

2009-11-02T16:27:00Z

I was checking out my search link referrals today on a previous post announcing the availability of MDOP 2009 R2. I noticed an interesting search query that I think warrants clarification.

While we are producing new versions of DaRT, the successive versions arent backwards compatible. So lets make this one clear so everyone knows and understands why.

DaRT 5.0 only supports Windows XP and Windows Server 2003 (no x64 support and no plans to add it either)

DaRT 6.0 only supports Windows Vista and Windows Server 2008 (and x64 versions too)

DaRT 6.5 only supports Windows 7 and Windows Server 2008 R2 (and x64 versions too)

Something thats also very important to mention here is that while the DaRT 6.0 version will allow you to insert a Windows 7 DVD and indicate it can prepare the image, it actually cant and will not work as you expect. We make sure to prompt and warn you when you try to run DaRT 6.0 on Windows 7.

So the question in your mind probably is why?

The reason is the underlying servicing model and NTFS structures. Windows XP's servicing stack is old school. Windows Vista changed all that with a new component based model, if you want to look around your machine for manifest files (and then look up MSDN) youll get the idea how it works. Also look up a component servicing tool called DISM.exe if youre keen to understand more.

Windows 7 built on Windows Vista's component model but again the servicing stack changed incrementally. Other changes between Windows 7 and Windows Vista included some changes to BitLocker servicing that we had to support.

All this meant we needed to keep the versions very separate.

Any questions? :)

Terminal Server 2003 issues with Group Policy Preferences History Folder

2009-10-28T18:46:44Z

We have heard some customer issues around one of the underpinning areas of Group Policy Preferences – namely the History Folder.

Issue

On Windows Server 2003 Terminal Servers with a large number of users, the history folder grows so large it causes increasing slow logons for the users.

What does the History folder do anyway??

The history folder is there to maintain actions such as “Remove this item when it is no longer applied”. If we don’t do this then we can’t roll back correctly. So the short of it is that we expect the folder size to grow. What we don’t want occurring is that it slows down logons. The reason this issue is occurring is because of history management that is occurring at logon.

What are you gonna do about it?

The CSE update in KB974266 fixes this issue and removes the core customer impact issue of slow logon.

The second issue is the folder size itself growing. If you are finding it is growing excessively, the correct action to take on Terminal Servers is to periodically execute a script, say every six months, to purge out entries older than six months to keep the file size down – which really shouldn’t be getting that big anyway.

Hope this helps

HP CM1312 Printer still lacking Windows 7 drivers

2009-10-26T17:02:55Z

Got this in my mail from John Hathaway, who like me, laments the inability of hardware vendors to re-release/update their driver installers to work with Windows 7. I blogged about this some time ago but John has updated it further.

Here's his feedback:

“…Anyway, I put together a small instruction pack similar to yours, but will update Windows 7 to use the CM1312 as a network-only printer. HP CM1312 64bit Windows 7 Retail install.

1) Download: CM1312series_full_solution_v5.0_AM-EMEA.exe (306 MB)

http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang=en&cc=us&prodTypeId=18972&prodSeriesId=3558902&prodNameId=3562006&swEnvOID=2100&swLang=8&mode=2&taskId=135&swItem=ma-61238-3

http://h20000.www2.hp.com/bizsupport/TechSupport/DriverDownload.jsp?prodNameId=3562006&lang=en&cc=us&taskId=135&prodTypeId=18972&prodSeriesId=3558902

2) Use the full download from the website and it self extracts to your root directory.To run the self extracting file, first set the compatibility mode to Vista sp2 and run as admin.

3) The files remain and you can find them here:

C:\HP_CM1312_series_full_solution_v5.0_AM-EMEA\

4) Set the compatibility mode to Vista sp2 and run as admin on the Setup.exe.

5) Run the full install. Works for both usb or network.

6) Enjoy! =^_^=…”

Slow Link detection in Vista and Windows 7

2009-10-26T16:52:17Z

The ever irrepressible Mike Stephens has done an awesome blog post on slow link detection in Windows Vista and Windows 7. This mechanism changed in these versions from using ICMP Ping to NLA.

Mike speaks about it on the AskDS blog. Over to you Mike…

AGPM 4.0 and DaRT 6.5 (MDOP 2009 R2) now available

2009-10-20T17:57:20Z

Wahoo!

Its finally out and announced on the MDOP blog. MDOP 2009 R2 is now available at the MVLS site.

This means you get two of the products my teams worked on which were Advanced Group Policy Management 4.0 and Diagnostics and Recovery Toolset 6.5, both of which support Windows 7 and Windows Server 2008 R2.

The documentation for AGPM 4.0 and DaRT 6.5 is also live

Yeah baby yeah!

Group Policy Changes in XP SP3

2009-10-20T16:33:41Z

Im seeing tons of people on forums trying to find the Group Policy Changes in XP SP3 and Windows 7. It seems that both Google and Bing dont return the results if you search for “Group Policy Changes XP SP3” because of all the noise of people asking where they are…

So for your enjoyment they are all here: http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=18c90c80-8b0a-4906-a4f5-ff24cc2030fb

Enjoy!

System Center Online Desktop Manager beta is available soon

2009-10-14T19:06:00Z

We are excited to offer an exclusive opportunity for customers to participate in an upcoming Microsoft beta program. In the coming months, a new Microsoft desktop management service will be made available to a limited number of customers to obtain their feedback and input. We are seeking customers primarily in the core midmarket space, but are also interested in recruiting customers from the enterprise space as well. Prospective candidates must be based in the US, Canada, Mexico, or Puerto Rico.

Microsoft System Center Online Desktop Manager is a hosted IT management solution based on Microsoft System Center management technologies that provides the capability to secure, update, monitor, configure, troubleshoot and collect inventory from a single, Web-based console.

This new IT management service is designed for customers who want an integrated desktop management solution without the overhead associated with installing and maintaining an on-premises management infrastructure.

Features for this initial beta include:

· Anti-malware protection

· Microsoft updates management

· Desktop configuration

· IT asset inventory and software license management

Additional features and capabilities will be introduced in later beta releases. More information about System Center Online Desktop Manager can be found here (http://www.microsoft.com/online/system-center.mspx).

Participation Criteria:

If you are interested in applying for this opportunity and reside in North America, complete the following survey no later than October 26^th, 2009: https://connect.microsoft.com/InvitationUse.aspx?ProgramID=2418&InvitationID=SCO-DMYG-BYB6&SiteID=310

Customers selected to participate you will be notified via email no later than November 1, 2009. Selected participants should be prepared to deploy the SCODM client to a number of test machines, participate in newsgroup discussions, and provide feedback. We are accepting a limited number of participants, and an invitation into the program is not guaranteed. We want to ensure we get good coverage across our target market segments, geographically across NA, and are looking for people who are prepared to actively participate.

TechEd Europe - Windows Server 2008 R2 GP Changes Session

2009-10-13T22:50:02Z

I mentioned previously that I might be attending TechEd Europe this year to present on Windows Server 2008 R2 Group Policy changes. Well its confirmed. I am definitely coming! (Yeah!!)

So I started to think about what you might like to see from my sessions....and rather than me guess about what you want to see, Im going to turn it over to you to make the call. I want to hear from you!! If youre planning on attending TechEd Europe and youre interested in this session how about you just comment on this blog entry with what you want.

If your content idea makes it into my session, I promise to give you kudos for your idea and may even bring gifts along if I can get the marketing guys to give me stuff (no promises there as they are a pretty cheap bunch :) )

My current core ideas are:

A brief recap on the work done in Vista/WS08 (as many customers didnt deploy that and dont know about all the cool stuff we did in it)
Some GPP changes
The new GP Powershell work
Coverage of some of the new GP extensions
Any known impacts in moving from XP/2003 to W7/WS08R2

The details of each of these areas and any extra ideas I will leave up to you! (BTW - If I dont get any feedback I will just do what I had planned with my own ideas :) )

Let the feedback roll in!

Michael Kleef, Program Manager

AGPM: GPLinks are being destroyed each time I deploy

2009-10-05T21:34:01Z

A customer reported an issue to me recently where the customer reported that when using AGPM 3.0, each time they deployed out to production, their GPLinks were being destroyed.

Why is this occurring?

What’s probably relevant here is to outline what’s happening and why.

When AGPM manages GPO’s it performs all its editing offline. When you have finished editing your GPOs and “Deploy to Production”, what you're essentially doing is overwriting the GPO with the new information. It does this operation with everything that AGPM knows about including:

GPO settings
Access Control Lists (security filtering and management)
GPLinks

Anything that you do in the Production object before this occurs will be overwritten with AGPM deploys its new object information. This means if you make a GPLink change in production and then don't tell AGPM about it, the object AGPM has will overwrite those changes next time around and you will wonder what happened.

This problem is compounded by the fact that AGPM doesn’t offer any ability to manage GPLinks (or Security Filtering) within AGPM itself – this is all done with GPMC and Imported into AGPM later.

So how do you make sure AGPM knows about GPLink and Security Filter changes?

There are actually two ways to do this though the best way is to make the GPLink and Security Filtering changes to the Production object and then do an “Import from Production” operation. This essentially takes a copy of everything in production and pulls it into AGPM. Note that in this case the reverse can occur where changes in AGPM are overwritten by the production object. Heres a good way to make sure you capture everything you want:

Make your GPO changes (if necessary) in AGPM
Deploy to production
Make any necessary changes to GPLinks and Security Filtering
Import from Production

This ensures that the settings stay the way you want and the GPLinks and Security Filtering are preserved and known by AGPM for that particular object. From then on you can make all the settings changes you want and AGPM will continue to push out the correct GPLinks and Filtering (unless of course you want to change it again)

Hope this helps

Michael Kleef, Program Manager

Daylight Savings changes in Western Australia

2009-09-30T03:15:28Z

Got asked to blog this. Don’t get me started on how much money this “trial” cost everyday businesses in WA to see it just fail….that said I loved it while it lasted! I used my editorial liberties and “improved” elements of this article for the “Yes” voters :)

“…Daylight Savings time changes can have a significant impact on business performance if not dealt with proactively and sadly business now has to endure that cost all over again. Effects can range from the incorrect time display on the clock, to calendaring problems, to changes in business critical services that are time dependent. This year, certain Western Australians who shall remain nameless (including my Mum), rejected by costly referendum in these tough economic times a proposal to extend their trial of daylight savings. As a result small children not only get less time out in the skin cancer causing sun with their parents but there will be no daylight savings in WA this year or for the foreseeable future. The time change was scheduled for the 25th October, but will, sadly for many, no longer occur. This means football in the park gets cut shorter, weekend BBQ’s get less fun and your curtains will like…fade less.

We encourage customers to review their preparedness for these changes. See the Australia 2009 Daylight Saving Planning Guide….”

Free Microsoft Anti Virus product releases to the web

2009-09-29T23:37:59Z

Well I never thought Id see this. Microsoft releases something really useful for free!! :)

Microsoft Security Essentials released to the web today. I’ve actually been using at home for a few months now in beta and I have to say that I'm very impressed with the work this team has done.

It seems to have quite a low system overhead and did catch a couple of things that came through my browser – install was really easy. No brainer really…and even better…no cost to you!

Important note is that this is a consumer offering rather than a business offering – in a business package you really want centralized management and reporting which is more the realm of Forefront Client Security.

Nevertheless – great for home and family. Tell your friends!

Funny Security emails

2009-09-18T19:21:26Z

Sometimes I get emails that just make me laugh. This is one that our internal security team sent out yesterday…what was your first immediate thought?? :)

“…Possible cougar sighting – employees should exercise caution

Investigators with Microsoft Global Security have investigated the reported sighting of a suspected cougar in the vicinity of Building 35….”

ROFL!! :)

HTC Snap issues on Telstra

2009-09-17T21:46:00Z

From the desk of Don Kerr:

The HTC Snap has been out for a while now through Telstra. The default configuration is set to take advantage of the new flat rate data plans – know as Microsoft Mobile Enterprise Solution (MMES) http://www.telstraenterprise.com/productsservices/mobility/officemobility/Pages/MicrosoftMobileEnterpriseSolution.aspx

We’ve been hearing that some customers are experiencing “difficulty” in setting up e-mail with the SNAP, so here’s the guide to getting Exchange ActiveSync setup if you’re not on the new Telstra plans (MMES).

Setting ActiveSync to connect through the “Internet” Connection

Press Start
Select ActiveSync
Press Menu
Select Add Server Source
Enter your Email address
Press Next
Enter your User name, Password and Domain
Press Next

The device will automatically download the Settings from the Exchange Server

Proceed directly to Step 10 if the Auto Configuration is successfully

If the device cannot complete the Auto Configuration, Enter your Server address, ensure “This server requires an encrypted (SSL) connection” is checked and press Next
Press Menu
Select Advanced

Ensure the Connection: sliding panel is set to “Internet”

Press on OK if prompted and once you have read and understand the Warning Message

Press Save
Press Finish

By selecting Internet in Advanced Server Settings, ActiveSync will connect through the Connection which is defined in the Connection Settings of the device to Automatically Connect to the Internet.

Repost: AGPM 4.0 to Release in October

2009-09-16T03:07:00Z

Quick note...

Today I posted on the Group Policy blog, the new features in AGPM 4.0 which will be releasing in October. More details over there! :)