Had an interesting question from a reader in response to setting a default printer with Group Policy Preferences that I thought I would share.

Question was:
If you set a user general default printer like the main office copier but also set a location printer preference like the library copier using the loop back policy will it over ride the general default printer preference?

Do I merge or replace?

I decided to test this out as I have not come across this. Here is what I found, if you have a User Policy that is creating a printer connection and setting it as the default and you also have, using Loopback Policy Processing in Merge Mode, another User Policy being applied, this will override the first User Policy Settings. Both printers will be installed, but the default printer will be set to the one specified in the policy that has the loopback.

Note: I tested this on a client that has no printers installed

If Loopback Processing is in Replace Mode then the User Settings in that policy will “Replace” the settings in the other policy. Therefore only one printer will be installed and it will be set as default.

Hope that helps.

Simple scenario, we have a group of Media students that need a drive mapped to a different “Media Backup Server”, so what I have done is put these students into and Active Directory Group called “Media Students”.

So in my Students GPO I simply went to User Configuration > Preferences > Windows Settings > Drive Maps

Right Click Drive Maps and select New > Mapped Drive Select Create from the drop down menu, enter the path to the share (eg. \\server\share ), I have created folders that relate to the students username therefore I used the %username% variable, select the Drive Letter.

Then from the Common tab up the top tick Item Level Targeting, from the New Item Menu select Security Group, make sure User In Group is selected in the bottom window and browse for the Security Group that the user must be a member of.

All Done, now all students that are a member of the Media Security Group will get an M Drive Mapped.

Cheers

Daniel Anderson
Loving Group Policy Preferences

Use Group Policy Preferences !!!

In the past I have used the Print Management Console to deploy the printers via Group Policy, now that did work very well, but there was still the “overlooked” problem of being able to set the default printer. To get around this what I used to do was to name the computers in a certain way and then have a vbs script that would get the name of the printer and then set the default based on the computer name.

I was reading an article by GPO Guru Derek Melber about the new Group Policy Preferences that come with Windows Server 2008 and Windows Vista and thought I would explore this option.

To start off your client will need the Group Policy Preference Client Side Extensions both XP and Vista Clients need these. Now you can manually download these and install via a computer startup script via Group Policy or if you have a WSUS Server then you can make this “Feature Pack” available via Windows Updates (this is the option I took, less work!).

Now that you have the Group Policy Preference Client Side Extensions installed on the clients, you can go ahead and play with the GPO’s. If you open up the Group Policy Management snap in and edit a GPO object you will see “Preferences”

After expanding “Preferences” you will notice an options there that says PRINTERS. If you right click on Printers and select New > Shared Printer, the New Shared Printer Dialog Box will appear.

From here we can enter in the path to the shared printer and from the Action drop down menu select “Create”, but the best part is that you can place a tick in the “Set this printer as the default printer” box and it will make that printer the default. Interesting thing to note here though is that this check box is only available under a User Configuration and not the Computer Configuration. This is not what I wanted, I need to set a default printer for computers in a specific room.

So what I have done in enable User Group Policy Loop Back Processing under the Computer Configuration > Policies > Admin Templates > System > Group Policy, you can either set that to Merge or Replace. Now what that does is enable you to apply User Configurations to users that log onto those computers that this policy applies to.

This is the Good Part

Once you have created a shared printer to deploy there is a tab on the properties of that called “Common” , if you click on that and place a tick in the “Item Level Targeting” and click on the Targeting Button a whole new world opens up!

Click on the New Item and just have a look at the possibilities there. The one I was interested in was the Organisational Units option. Because what I want to happen is if a computer is in a specific OU install and make printer X the default.

With this option I was able to achieve just that. Just select the OU that the Computer should belong to by using the Browse Button and select the Computer in OU radio box.

Job Done……

For More Tips on how you can use Group Policy Preferences make sure you SUBSCRIBE to my RSS Feed so you don’t miss out on making your life as a Network Administrator an easier one !!!

The first thing that needed to be done was an export of the current server configuration using, as Microsoft calls it, “cloned configuration tasks”. There is a folder located in the install directory of Exchange, generally C:\Program Files\Microsoft\Exchange Server\ called “Scripts”. Inside there are 2 Powershell Scripts that you will need.

They are ExportEdgeConfig.ps1 and ImportEdgeConfig.ps1.

To capture the configuration we need to run the ExportEdgeConfig.ps1 script in the Exchange Management Shell like so:

./ExportEdgeConfig -CloneConfigData:”C:\CloneConfigData.xml”

NOTE: Make Sure you run the Exchange Management Shell as Administrator (right click > Run As Administrator)

Now I am going to be keeping the same computer name on the new Virtual Edge Server, so I did this next.

Shutdown the current Exchange Server and then Reset the Computer Account in Active Directory. Next was to start up the NEW Exchange Server, rename it and join it to the domain. You MUST make sure that the drive letter configuration is the same as the OLD Server.

Next Install Exchange, I did this by running trying to run this command:

Setup.com /Role:Edge

This is where it all fell apart. I got an error and decided to try again by running the setup.exe file. Sure enough it was No Good and I received this Error “The Exchange Server is in an inconsistant state”. Then I tried to run the install in Recovery Mode by using this command:

setup.com /m:RecoverServer

Guess what? Failed again. Things were looking pretty grim. Considering this was a virtual machine and only hosting the Edge Transport Role I copied across a sysprepped Windows Server 2008 VHD that I created earlier and started from scratch.

While the Server was starting up I reset the Computer Account in Active Directory and I also need to get brutal and use ADSi Edit and remove the entry in the following location:

CN=Configuration, DC= Domain Name, DC=com, CN=Services, CN=Microsoft Exchange, CN=, CN=Administrative Groups, CN= , CN=Servers, CN=

and also remove the entry in the Exchange Servers and Exchange Install Domain Servers Security Groups.

The Server was now up and running and joined to the domain so I tried again to install Exchange 2007 and the Edge Transport Role, and all seemed to go through fantastically!

After Exchange was installed I then need to run the New-EdgeSubscription CMDLET on the Edge Server:

New-EdgeSubscription -FileName “c:\EdgeServerSubscription.xml”

Then import that XML File on the Server that is running the Hub Transport Role. To to that you can use the Exchange Management Console and navigate to this spot.

Organisation Configuration > Hub Transport > and then click the Edge Subscription Tab.

After that was completed I gave the Edge Server a Restart and the mail started flowing in again…….There seemed to be a few people that have had a similar issue so I hope this sheds some light on a procedure on how to get around this issue. Another bonus to virtualization !!!!.

To kick things off you first of all need a PKI Infrustructure and enable autoenrollment so that all your wireless clients obtain the correct certificates for the authentication process.

1. Install the Active Directory Certificate Services (ADCS) Role to the server and just use the default settings here.

2. Next Open up the Group Policy Management Console and either edit a policy or create a new one to apply the wireless settings to your clients. The section we want is Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Policies. In the details pane now you need to right click the Certificate Services Client – Autoenrollment and then select properties. In the Properties dialog box select enabled from the rop down box and then place a tick in the other boxes, which is optional.

Let’s now install and configure the Radius Server to handle the authentication. Install the Network Policy and Access Services Role. Once install you need to then navigate to the NPS Node in Server Manager, under Roles\Network Policy and Access Services.

1. In the Details Pane, from the drop down list under Standard Configuration select RADIUS server for 802.1x Wireless or Wired Connections and click Configure 802.1X Hyperlink.

2. Select the top radio button “Secure Wireless Connections” click next

3. On the Specify 802.1X Swtiches Page Add your Wireless Access Points and Radius Clients. You need to do this for each Access Point you have. When you click the add button fill out the Friendly Name, IP Address. For the Shared Seceret you can either enter one in manually or have one generated (which will then need to be entered into the AP’s), once all AP’s have been entered click next.

4. Next up Configure an authentication method. From the Drop Down list select the method you want to use. We were currently using Smart Card or Other Certificate and I wanted to change to Microsoft: Protected EAP (PEAP).

NOTE: This method requires a Computer Certificate and the Radius Server and either a computer or user certificate on the client machine. The best way to do this is to use a Domain PKI see above.

5. Select the groups you would like to give wireless access to.

6. Next configure VLAN Settings. You can use this to restrict Wireless users to specific network resources. Then click Finish.

7. You then need to Reegister the server with Active Directory. Right Click the NPS Node and select Register Server.

Configure Wirelss Clients to Connect Automatically……

1. There are a couple of Group Policy settings that you will need to adjust here to get your wireless clients to automatically connect to your network. Open up your Group Policy Management Console and navigate and right click Computer Configuration\Policies\Windows Settings\Security Settings\Wireless Network (IEEE 802.11) and select Create A New XP Policy. If you have both XP and Vista Clients then you will need to select this option as if there is no Vista Policy, Vista Clients will use the XP one.

2. Give the Policy a Name and Description and then click the Preferred Networks Tab. Click the Add Button and select Infrastructure.

3. Enter the SSID of your Wireless Network, then from the Authentication drop down box select WPA2 and from the enryption drop down box select TKIP.

4. Then click on the IEEE 802.1X Tab leave the EAP Type and PEAP and under Authentication Mode selct Computer Only. This means that the authentication will take place prior to the Computer getting to the Login Screen. This is what I wanted.

Auto Enrolling Computer Certificates Via Group Policy

The process above regarding the PKI Infrastrucure will auto enroll the Root Cert. But we also need to auto enroll a computer certificate which can be done like this.

1. Open up your Group Policy Management Console and navigate to Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Policies\Automatic Certificate Request Settings.

2. Right Click in the details pane and select New > Automatic Certificate Request.

3. This will open up a wizard and you can select a Computer Certificate.

Now do a policy update on your client machines and they SHOULD automatically connect to your newly secured wireless network.

Hope this helps you out. Cheers

Daniel
Securing My Wireless Network

How To Migrate Windows 2003 DHCP to Windows 2008 DHCP Server

Next up was migrating the DHCP from the old Windows 2003 Server to this new box, below is how I did this:

First export the DHCP Database from the 2003 Server with the following command:

netsh dhcp server export C:\dhcp.txt all

Then copy that file to the new 2008 Server. Add the DHCP Server Role on the new box via Server Manager. Then with the following command import the dhcp database:

netsh dhcp server import C:\dhcp.txt all

Now when I did this I got this error “Error while importing option “6.” “This option conflicts with the existing option “” An Internal Error Occurred.”.

This was to do with the fact that while adding the DHCP Server Role to the new machine there were entries in the Server Options that were done automatically, once I went in and removed these options “006 DNS Servers” and “015 DNS Domain Name” and then re did the import with the string above everything went fine.

Next up Print Server. Subscribe to my RSS Feed so you can see how I managed this.

By the way there is a great article and script from John Howard that enables you to Configure Hyper-V Remote Management in Seconds.