Life of an IT Pro Advisor @ Microsoft Canada : Windows XP SP2

As-tu des problèmes avec un erreur « [strings] section is too long » quand tu travailles avec un GPO?

rclaus — Wed, 16 Feb 2005 20:20:00 GMT

J’avais beaucoup de questions dans mon courriel électronique au sujet d’intégrer les nouveaux *.ADM fichier qui sont en place avec Windows XP SP2 dans une environnement Active Directory. Peut-être j’aurai beaucoup d’autre question maintenant que les personnes travaillent avec Windows Server 2003 SP1. Les deux systèmes changes la longueur des « strings » au point qu’ils sont incompatibles avec un MMC qui est utilisé sur un system au niveau précédent de Windows XP SP2.

J’ai déjà écrit un article qui explique la méthode que les *.ADM fichier se mis a niveau automatiquement dans un environnement d’Active Directory et comment tu as besoin d’évaluer et choisir la procédure qui est correct pour votre environnement. (La manière défaut fonctionne pour presque tous les gents)

Pour essayer de répondre au question la plus simple et le plus court que possible :
Si tu crée ou change un GPO avec un MMC sur un system de Windows XP SP2 ou Windows Server 2003 SP1, la réaction défaut est que les fichiers seront télécharger au Domain Controllers et en effet remplace les versions plus ancienne. Pour éviter les erreurs de « [strings] too long », toutes les systèmes utilisés pour gérer les GPO a besoin d’un patch pour mettre a niveau un DLL qui est utiliser par le MMC.

(Cette réponse est simple et court?)

Regarder l’article KB842933. Il est trouvé ici. Tu n’as pas besoin beaucoup d’analyse pour cette patch. Les systèmes n’ont pas besoin d’être redémarré après l’application du patch si tu fermes le MMC avant de commencer. Seulement les systèmes utilisés pour gérer les GPO on a besoin du patch. Les systèmes au niveau de :

Windows XP sans SP2
Tous les systèmes Windows 2000 Professional
Windows Server 2003 sans SP1
Tous les systèmes Windows 2000 Server

Si tu décide de ne pas appliquer le patch – c’est OK – tu ne casse pas ton GPO si tu les changes avec un MMC plus ancien. Tu dois tous simplement « clicker » un vingtaine fois sur le « ok » bouton. ;-)

Perplexed with a "[strings] section is too long" error when editing a GPO?

rclaus — Fri, 11 Feb 2005 16:23:00 GMT

I've had a number of questions around the *.ADM templates that come with a Windows XP Service Pack 2 machine and what they do to the GPOs in an Active Directory Domain. With people using Server 2003 SP1 systems, I might get more questions being asked. Both systems increase the length of strings beyond what the MMC console can take on a older OS (by older I mean PRE-XP-SP2).

I've already wirtten an article outlining the ADM template update process, how they get copied up to the domain controllers AND about how you need to choose the right process for your organization - default works great for almost all situations.

To make a long blog post shorter and to come to the point:
If you edit a GPO with an XP-SP2 or Server 2003 SP1 management console with the updated *.ADM templates, the default action is that the templates will be copied up to the Domain Controllers and overwrite the old ones. As a result of this action - all admin workstations (and servers) that are NOT XP-SP2 or Server 2003 SP1 need to be patched with the appropriate patch if they are going to be used to manage GPOs.

(that was short?)

You might want to read the details contained in Knowledge Base article 842933. It can be found here. Not to worry - no major testing require of this patch. No reboots are required (unless the GPO MMC or GPMC is open at the time of the patch - in which case, close it and patch again). Only the systems used to manage GPOs need to be patched. They apply to workstations that are running:

Windows XP PRIOR to Service Pack 2
All Windows 2000 Pro systems
Windows Server 2003 PRIOR to SP1
All Windows Server 2000 systems

If you don't patch them - don't worry - you won't "break" your GPO by editing it with an older version of the console. You'll just have to be proficient at clicking 20 or so times on the OK button. ;-)

Follow up to some questions regarding XP-SP2 .ADM template files

rclaus — Sat, 20 Nov 2004 05:33:00 GMT

I’ve gotten a number of requests for the location of the ADM templates that I use in the XP-SP2 sessions I deliver. I’ve posted on this before – but I thought it would be worth posting this information a second time….

First off – you’ll probably need to apply a patch to your servers / systems that you use to manage GPOs. Make sure to read the following Q article to get the right patch for the operating system you are using.

http://support.microsoft.com/default.aspx?scid=KB;[LN];842933

This will prevent the following nasty looking error message

"The following entry in the [strings] section is too long and has been truncated" error message when you try to modify or to view GPOs in Windows Server 2003, Windows XP Professional, or Windows 2000."

Once you are patched up, you can simply launch your group policy editor of choice from an XP-SP2 system. It should have the proper ADM files installed as part of the service pack. if you prefer to be absolutely sure you have the latest ones - you can download them manually from here and then copy them into the %windir%\inf directory of the system you use to manage group policy. The default behaviour of the group policy console is to check the date/time stamp of the local ADM files and compare it to the server copy. If the local is newer, it is used and copied up to the server.

Have you edited the original .ADM templates? As a best practice, you should always leave the original ones alone and create your own. This will prevent the long hard work you spent customizing the template from going down the drain when it gets overwritten by a newer .ADM template with the same name being copied up to the server automatically.

As I mention in my sessions - no worries about older versions of OSs using the latest version (XP-SP2) of the .ADM files - everything is cumulative. You won't be damaing your Windows 2000 gpo setting when you use the newer ADM templates.

Happy GPO editing!

.ADM templates for XP-SP2 GPO settings

rclaus — Wed, 06 Oct 2004 18:28:00 GMT

One of the questions that came up at last night’s TechNet session was .ADM template files and where to get them. JohnM from EDS pointed me to the download page for current ADM templates. Thanks for making my job easier John!

Here’s the link
http://www.microsoft.com/downloads/details.aspx?FamilyId=92759D4B-7112-4B6C-AD4A-BBF3802A5C9B&displaylang=en#filelist

Some related information about ADM templates for managing group policy also turned up in my research. Before you download these files and start using them, you should be aware of the impact they might have in your environment first.

Hun? Impact? They’re just files, what impact can they have? Replication my friend is blowing in the wind. The .adm files are 3.17 megs in size. Updated files = replication using FRS to all your DCs = WAN traffic.

Check out this KB article 816662 (http://support.microsoft.com/default.aspx?scid=kb;en-us;816662) To summarize the major points:

The default behaviour for .adm templates and GPEDIT.MSC (group policy MMC) is to use the local admin workstation copy from %windir%\inf.
If the local copy is newer then the copy on the SYSVOL GPT (GroupPolicyTemplate) then it is copied up to the GPT folder on the server.
It uses the Date and Timestamp of the adm file to determine which one is newer. Because of this, if you want to modify the ADM template, it is recommended that you create your own NEW one for your specific settings – leave the system ones alone.
Entries are Cumulative. If you have W2K SP4 and bring in Win XP-SP2, a bunch of .adm files will be updated. This will NOT mess up your W2K SP4 settings.
You can turn off the auto-upload process if you want to manage your own version of files on local admin workstations.

That last statement is powerful. Why would you want to do that? Have you thought about language? If your co-worker works with a French admin workstation (which is quite possible in our bilingual culture here in Canada), his/her adm templates will upload overtop of the server based ones if they have a newer date and time stamp. You can prevent this from happening if you establish a policy (human policy, not Group Policy <g>) that states all ADM templates are stored in a central location and should be copied down to the local admin workstation (or server) where GPEdit is launched. That way you can control which templates are used and what versions / language you want to work in.

Have a good read of that KB816662… It’s worth the time to investigate your options and establish a proper .adm template process. This is something that you might have overlooked in your planning exercise for managing AD.

Lastly, here is a link to the Windows 2003 Online technical reference that deals with Administrative Template Extension Technical Reference. It has links to three areas of information on ADM template and how they work in the GPO process. It also has some additional planning excel spreadsheets for GPO settings. It's a good read.
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/techref/en-us/Default.asp?url=/resources/documentation/windowsServ/2003/all/techref/en-us/W2K3TR_gpadm_intro.asp

Ottawa TechNet Event - Windows XP SP2 Take 2 - Deployment

rclaus — Wed, 06 Oct 2004 05:14:00 GMT

Tonight I delivered the deployment piece to Windows XP Service Pack 2 TechNet Canada events in Ottawa. It was a record crowd with a lot of return attendees. Once again - great participation and dialogue by everyone. I had a lot of fun.

As promised, here are the links that I mentioned during the session.

Windows XP Service Pack 2 Deployment Information
http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/xpsp2dep.mspx

Deploying Windows XP SP2 in Enterprise Environments (awesome document!)
http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/sp2entdp.mspx

Application compatibility testing and mitigation guide for Windows XP SP2
http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/sp2apcom.mspx

Deployment tools found on the support/tools/deploy/deploy.cab
http://support.microsoft.com/default.aspx?kbid=838080&product=windowsxpsp2

How to install Windows XP SP2 by using Systems Management Server
http://support.microsoft.com/default.aspx?kbid=842844&product=windowsxpsp2

Using group policy to deploy Windows XP Service Pack2
http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/gpdepsp2.mspx

And by request - "Temporarily Disabling Delivery of Windows XP Service Pack 2 through Windows Update and Automatic Updates". This should be used with caution and is designed to be used for people who keep Windows Update and Automatic Updates available to their clients but are also in the process of deploying XP-SP2 in some other manner as part of a larger project and want to control it's deployment.
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2aumng.mspx

Before I forget - a couple of questions came up around specific ADM templates for Group Policy and their settings. I will post a more detailed entry about these templates, where to get them and point out some interesting settings that might be relevant to your situation. Stay tuned!

For those of you that attended – thanks so much for making this a great session. I look forward to making the next TechNet event even better. Hang on a second - this is a two way street. How about some input?

What suggestions do you have for some additional content or subject matter that you would like to see in Ottawa? What would you do to improve the sessions? Are you interested in participating by presenting or co-presenting? Click on the feedback link at the end of this post and drop me a line.

I am looking forward to hearing from you.

Slide decks will be posted soon - hang in there.

Domain Profile or Standard Profile? Hummm...

rclaus — Mon, 04 Oct 2004 23:42:00 GMT

I had a couple of follow up questions relating to the XP-SP2 security technologies presentation I did on November 30th that relate to how workstations determine when to flip from Domain profile to Standard profile and back again when required. This was a little too deep for the session itself, so I decided to post the information up here.

A really good question came from DavidF from Industry Canada. He asked if the workstation queried GCs (global catalog servers) or DCs (Domain Controllers) to determine the appropriate profile and what would happen in a multiple domain environment in a forest - with different DNS name spaces. It is actually simpler then a custom query and does not rely on network connectivity at the time. Lets take a look at the following scenarios:

I have a managed laptop that is part of the Corp network. I login to corp.example.com and get group policy applied to my system (this could even be a basic domain policy with no additional settings). An entry is put into my registry that indicates that the GPO came from the corp.example.com. My connection specific DHCP managed IP address while at work has a DNS suffix of corp.example.com. The two pieces of info are compared. If they match, I am switched to domain profile. If they don’t – I am in standard profile. Sound easy? Read on.

The next step is if I use my wireless laptop while I am at home or a hotspot suckin’ back some Java (and I don’t mean J2EE). What profile state am I in? My registry will say I last got a GPO from corp.example.com. My internet connection at the hotspot says hotspot.bridgehead.ca. They are compared and result in a miss-match. Because of that – I do NOT get domain profile status, but standard status instead.

The next level of complexity is when I travel with my laptop. I go to our European office with a DNS suffix of eu.example.com. – how does it work now? If it was a complete boot process, my system and I would have authenticated to the domain in the forest. Based on the group policy update interval, I could have my registry reflecting either corp.example.com or eu.example.com. For now lets say my registry entry for the last GPO application says corp.example.com (a different DNS namespace in the example.com DNS hierarchy). My connection specific DNS suffix says eu.example.ca. - they don’t match so I go into standard mode, even though I am in a managed network. But don’t worry – because I am in the managed network, I am still able to get my GPO updates and my registry will eventually reflect that I got an update while connected with eu.example.com. Once this takes place – I will switch to the domain profile.

So as you can see, multiple domain forests with different names spaces don’t throw a wrench into the mix. What does is a manually applied connection specific DNS suffix at the client. Why? Don’t forget DHCP settings are overridden by Manual entries. If you hard code your connection specific DNS suffix to be corp.example.com then I will still be using the domain profile no matter where I am - having that second cup of Java at the café or working in the Europe office. This can be good or bad – What entries for ports and applications are open in the domain profile vs the standard profile?

I don’t know… You created the profiles with adequate planning and testing, didn’t you? < g >

If you would like some more in depth information on this, check out The Cable Guy on Microsoft.com TechNet site. http://www.microsoft.com/technet/community/columns/cableguy/cg0504.mspx

Ottawa TechNet Event - Windows XP-SP2 take 1

rclaus — Fri, 01 Oct 2004 05:20:00 GMT

I just got home from presenting the first TechNet targeted event in Ottawa, Canada for 2004. One down. How many more to go? I admit it - I was nervous - but I had a great time!

The subject matter was a slightly modified “Microsoft Windows XP Service Pack 2 Security Technologies” session that included additional demos and interaction time with the group. The modifications and event as a whole seemed to be well received from the IT Pro community that showed up – FANTASTIC! That is what this is all about. My main take away from this session - setup earlier and ensure all the network drops are live ;)

During the break, I had the opportunity to talk about TechNet Canada, my team and the worldwide initiative of community outreach to IT Pros that Microsoft is undertaking. It feels great to be part of this - I can’t wait to engage some more people at the next event.

I promised to include some reference links to content that I found helpful while researching for this session. Here they are…

Main Windows XP-SP2 info page for IT Pros
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/winxpsp2.mspx

Top articles of interest for XP-SP2 IT Pros
http://support.microsoft.com/default.aspx?pr=windowsxpsp2it

Great doc to roll up your sleeves and get down and dirty with “Changes in functionality in Windows XP Service pack 2”
http://www.microsoft.com/downloads/details.aspx?FamilyID=7bd948d7-b791-40b6-8364-685b84158c78&DisplayLang=en#filelist

The ADM Template Excel file useful in planning GroupPolicyObjects
http://www.microsoft.com/downloads/details.aspx?FamilyID=7821c32f-da15-438d-8e48-45915cd2bc14&displaylang=en

…and some shameless plugs for the TechNet community in Canada

Overall community starting point for TechNet Canada.
http://www.microsoft.ca/technet

TechNet Canada Events - One stop shop for events across Canada
http://www.microsoft.com/technet/canada/events

TechNet Canada Flash email localized content. Have you signed up? (I have) Localized Canadian content.
http://www.microsoft.com/technet/canada/flash

As I mentioned during the presentation, please feel free to submit feedback here or directly to my email / contact information. I am looking forward to seeing you all at the next event!