Enterprise Microsoft Q&A: Hello for Buttprint

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Enterprise Microsoft Q&A: Hello for Buttprint

«‹›261 »

GreenNight: Feb 19, 2006; Turning the light on the darkest places, you and I know we got to face this now. We got to face this now.

I was excited until I read that Device Manager is exclusively for thin clients.

# ? Jun 2, 2016 03:13

Adbot: ADBOT LOVES YOU

# ? May 13, 2024 22:01

BaseballPCHiker: Jan 16, 2006

Has anyone had any experience with deploying software printers through a GPO or startup script?

I've got these drat software printers that just do not want to play nicely. All of the other printers in the company work fine through GPOs but I cant get these to install correctly with the right settings. They're some drat crystal reports print overlays that work through an ancient cobol monstrosity of a program. I'm ready to just give up at this point and have helpdesk install them manually when needed.

EDIT: The answer was a good old fashioned batch script. I can add it to the end of my task sequence or just have the helpdesk guys comment out what printers they dont need and run it once. An imperfect fix but a workaround nonetheless.

BaseballPCHiker fucked around with this message at 16:38 on Jun 2, 2016

# ? Jun 2, 2016 15:34

Weedle: May 31, 2006

I use a domain administrator account called simply "Administrator." Apparently Windows 10 thinks this is the built-in administrator account and won't let me run apps when logged in. Is there a way to lift this restriction? I tried Googling but only found stuff about enabling the built-in admin account.

# ? Jun 2, 2016 17:14

CLAM DOWN: Feb 13, 2007

Weedle posted:

I use a domain administrator account called simply "Administrator." Apparently Windows 10 thinks this is the built-in administrator account and won't let me run apps when logged in. Is there a way to lift this restriction? I tried Googling but only found stuff about enabling the built-in admin account.

....rename that domain admin account? How are you auditing who is using it and performing what actions if it's just called "Administrator"? Common accounts used for admin purposes are not a good idea.

# ? Jun 2, 2016 17:25

Methanar: Sep 26, 2013; by the sex ghost

Weedle posted:

I use a domain administrator account called simply "Administrator." Apparently Windows 10 thinks this is the built-in administrator account and won't let me run apps when logged in. Is there a way to lift this restriction? I tried Googling but only found stuff about enabling the built-in admin account.

Are you specifying the account is a domain admin like domain\administrator

# ? Jun 2, 2016 17:44

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Weedle posted:

I use a domain administrator account called simply "Administrator." Apparently Windows 10 thinks this is the built-in administrator account and won't let me run apps when logged in. Is there a way to lift this restriction? I tried Googling but only found stuff about enabling the built-in admin account.

secpol.msc -> Local Policies -> Security Options -> User Account Control Admin Approval Mode for the Built-in Administrator account

# ? Jun 2, 2016 19:20

Weedle: May 31, 2006

Methanar posted:

Are you specifying the account is a domain admin like domain\administrator

Yes.

anthonypants posted:

secpol.msc -> Local Policies -> Security Options -> User Account Control Admin Approval Mode for the Built-in Administrator account

Thanks!

# ? Jun 2, 2016 19:47

incoherent: Apr 24, 2004; 01010100011010000111001
00110100101101100011011
000110010101110010

welp, don't throw out that "convenience update" just yet

http://www.theregister.co.uk/2016/06/01/vmware_says_windows_7_update_breaks_networking_tool/

# ? Jun 2, 2016 20:27

ElGroucho: Nov 1, 2005; We already - What about sticking our middle fingers up... That was insane; Fun Shoe

What's best practice on getting rid of Windows 10 default apps, removing them from the wim or through GPO? Removing them from the wim has proven to be quite the problem.

# ? Jun 6, 2016 22:51

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

ElGroucho posted:

What's best practice on getting rid of Windows 10 default apps, removing them from the wim or through GPO? Removing them from the wim has proven to be quite the problem.

I think you can mount the wim and run Get-AppxPackage *xbox* | Remove-AppxPackage in addition to the dism /Remove-Package

e: Or, maybe you can't, and you'll have to run those PowerShell commands before you capture the image.

anthonypants fucked around with this message at 23:11 on Jun 6, 2016

# ? Jun 6, 2016 23:08

peak debt: Mar 11, 2001; b& :(; Nap Ghost

I think most people use a variation of this script

code:

$appsToRemove = @("*3dbuilder*", "*Appconnector*", "*windowscommunicationsapps*", "*CandyCrushSaga*", "*officehub*", "*skypeapp*", "*getstarted*", "*zunemusic*", `
                    "*windowsmaps*", "*Messaging*", "*solitairecollection*", "*ConnectivityStore*", "*bingfinance*", "*zunevideo*", "*bingnews*", "*onenote*", `
                    "*people*", "*CommsPhone*", "*windowsphone*", "*WindowsScan*", "*bingsports*", "*Office.Sway*", "*Twitter*", "*soundrecorder*", "*xboxapp*", "*XboxOneSmartGlass*")

Get-AppxPackage -AllUsers | % {
    $app = $_
    $appsToRemove | % {
        if ($app.PackageFullName -like $_) {
            "- $($app.PackageFullName)"
            Remove-AppxPackage $app
        }
    }
}

Get-AppxProvisionedPackage �Online | % {
    $app = $_
    $appsToRemove | % {
        if ($app.PackageName -like $_) {
            "- $($app.PackageName)"
            $app | Remove-AppxProvisionedPackage �Online
        }
    }
}

That removes everything that can be removed.

# ? Jun 7, 2016 13:35

ZetsurinPower: Dec 14, 2003; I looooove leftovers!

I might bother doing this if our users weren't local admins :suicide:

# ? Jun 8, 2016 14:23

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Don't forget that all that poo poo might reinstall itself once the Anniversary Update comes to town.

# ? Jun 8, 2016 16:05

GreenNight: Feb 19, 2006; Turning the light on the darkest places, you and I know we got to face this now. We got to face this now.

anthonypants posted:

Don't forget that all that poo poo might reinstall itself once the Anniversary Update comes to town.

I'm pretty sure this is a new build and cannot be installed via Windows Update or WSUS.

# ? Jun 8, 2016 16:08

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

GreenNight posted:

I'm pretty sure this is a new build and cannot be installed via Windows Update or WSUS.

All the insider builds are available on Windows Update, and the November Update/1511 is on WSUS, so I don't know why you think this one would be different.

# ? Jun 8, 2016 16:12

GreenNight: Feb 19, 2006; Turning the light on the darkest places, you and I know we got to face this now. We got to face this now.

anthonypants posted:

All the insider builds are available on Windows Update, and the November Update/1511 is on WSUS, so I don't know why you think this one would be different.

Yeah I'm an insider, but you have to specifically choose to be one, the November Update has never gotten autoloaded on any computer that I've used, I had to manually update it.

I use WSUS all the time at work and I don't see 1511 available for it. Enterprise only maybe? We're Pro.

# ? Jun 8, 2016 16:14

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

GreenNight posted:

Yeah I'm an insider, but you have to specifically choose to be one, the November Update has never gotten autoloaded on any computer that I've used, I had to manually update it.

I use WSUS all the time at work and I don't see 1511 available for it. Enterprise only maybe? We're Pro.

You need to apply KB3095113 to your WSUS server first.

# ? Jun 8, 2016 16:17

GreenNight: Feb 19, 2006; Turning the light on the darkest places, you and I know we got to face this now. We got to face this now.

anthonypants posted:

You need to apply KB3095113 to your WSUS server first.

Thank you very much.

# ? Jun 8, 2016 16:22

Bob Morales: Aug 18, 2006; ~~Just wear the fucking mask, Bob~~

I don't care how many people I probably infected with COVID-19 while refusing to wear a mask, my comfort is far more important than the health and safety of everyone around me!

What do you guys do when one person in one department needs to access a single folder 3 levels deep in some other department?

SALES_DUDE wants to access S:\Engineering\Products\Drawings\Foobartron v2

Pain in the butt.

Or like the HR intern needs all the folders in the Human Resources folder, but not the Payroll folder. And as a bonus, one person in Accounting needs access to NONE of the folders in the Human Resources folder, except the Payroll folder.

# ? Jun 8, 2016 19:31

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Bob Morales posted:

What do you guys do when one person in one department needs to access a single folder 3 levels deep in some other department?

SALES_DUDE wants to access S:\Engineering\Products\Drawings\Foobartron v2

Pain in the butt.

Or like the HR intern needs all the folders in the Human Resources folder, but not the Payroll folder. And as a bonus, one person in Accounting needs access to NONE of the folders in the Human Resources folder, except the Payroll folder.

S:\Shortcut to Foobartron v2.lnk => \\server\share\Engineering\Products\Drawings\Foobartron v2\

e: or a mapped drive, but that is a BAD solution that leads to Problems

# ? Jun 8, 2016 19:47

Bob Morales: Aug 18, 2006; ~~Just wear the fucking mask, Bob~~

I don't care how many people I probably infected with COVID-19 while refusing to wear a mask, my comfort is far more important than the health and safety of everyone around me!

anthonypants posted:

S:\Shortcut to Foobartron v2.lnk => \\server\share\Engineering\Products\Drawings\Foobartron v2\

Leads to shortcut city, gets deleted and nobody knows where the gently caress it pointed, etc

Really want to get these people to understand we're not the FBI and we don't need or poo poo locked down so much.

# ? Jun 8, 2016 19:55

vanity slug: Jul 20, 2010

I'd just go for List Folder Contents, or some permission fuckery (Access Based Enumeration plus explicit permission on folder objects leading to the location). Either way it sucks.

# ? Jun 8, 2016 20:03

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Shortcut City is, imo, a better destination than Mapped Drives Junction or Custom Permissions Sinkhole, and that's the only thing I can think of apart from moving the Foobartron v2 folder somewhere else, or just granting them blanket permissions to the parent folder/s.

Speaking of network share permissions, what's the best way to audit permissions on a folder structure? I'm not interested in quotas or anything right now, I just want to know what security groups have control over what folders. I hope there's a tool I can do this with, because I'm not looking forward to writing a PowerShell script for it, but I will if I have to.

# ? Jun 8, 2016 20:08

GreenNight: Feb 19, 2006; Turning the light on the darkest places, you and I know we got to face this now. We got to face this now.

anthonypants posted:

Shortcut City is, imo, a better destination than Mapped Drives Junction or Custom Permissions Sinkhole, and that's the only thing I can think of apart from moving the Foobartron v2 folder somewhere else, or just granting them blanket permissions to the parent folder/s.

Speaking of network share permissions, what's the best way to audit permissions on a folder structure? I'm not interested in quotas or anything right now, I just want to know what security groups have control over what folders. I hope there's a tool I can do this with, because I'm not looking forward to writing a PowerShell script for it, but I will if I have to.

http://www.cjwdev.com/Software/NtfsReports/Info.html

# ? Jun 8, 2016 21:35

Thanks Ants: May 21, 2004; #essereFerrari

Bob Morales posted:

What do you guys do when one person in one department needs to access a single folder 3 levels deep in some other department?

SALES_DUDE wants to access S:\Engineering\Products\Drawings\Foobartron v2

Pain in the butt.

Or like the HR intern needs all the folders in the Human Resources folder, but not the Payroll folder. And as a bonus, one person in Accounting needs access to NONE of the folders in the Human Resources folder, except the Payroll folder.

Honestly it's not a quick answer but if sales need to access something buried in an share for engineering then either that share is defined wrong or that person isn't sales. Like if sales want to present a render of a product then that render isn't a technical drawing and is likely in the wrong place.

Alternatively, https://technet.microsoft.com/en-GB/library/hh831717.aspx

# ? Jun 8, 2016 21:57

hihifellow: Jun 17, 2005; seriously where the fuck did this genre come from

Bob Morales posted:

What do you guys do when one person in one department needs to access a single folder 3 levels deep in some other department?

SALES_DUDE wants to access S:\Engineering\Products\Drawings\Foobartron v2

Pain in the butt.

Or like the HR intern needs all the folders in the Human Resources folder, but not the Payroll folder. And as a bonus, one person in Accounting needs access to NONE of the folders in the Human Resources folder, except the Payroll folder.

This is a massive pain in NTFS world and any time I got a request like that I offered to do a shared folder on an org-wide share with the access rights they wanted instead. Fortunately they all said okay instead of being stubborn.

# ? Jun 8, 2016 23:26

Canine Blues Arooo: Jan 7, 2008; when you think about it...i'm the first girl you ever spent the night with; Grimey Drawer

Certainly someone has tried this before, but I can't find documentation on anyone's attempt to do this.

I want to make an SSD with an installation of Windows 10 on it that I can just shift from computer to computer. In reality, I have maybe 10 common hardware configs, so even if I could create an installation that works with these 10 configs, that'd be enough.

I don't really understand the whole process, but my plan (which includes a lot of MAGIC right now) would be this:

1. Create my 'master' installation with a bunch of different hal.dlls from my common configs.
2. Somehow point the installation to the correct hal.dll file depending on what hardware I want to start it on with Bcdedit.
3. ???
4. I now have one universal installation of Windows I can just float around the office as I need.

Is The Dream� even possible? Has someone done this before?

# ? Jun 9, 2016 00:07

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

I don't even think Windows To Go supports multiple hardware configs.

# ? Jun 9, 2016 00:14

Bob Morales: Aug 18, 2006; ~~Just wear the fucking mask, Bob~~

I don't care how many people I probably infected with COVID-19 while refusing to wear a mask, my comfort is far more important than the health and safety of everyone around me!

Thanks Ants posted:

Honestly it's not a quick answer but if sales need to access something buried in an share for engineering then either that share is defined wrong or that person isn't sales. Like if sales want to present a render of a product then that render isn't a technical drawing and is likely in the wrong place

Preach it brother.

# ? Jun 9, 2016 00:18

lol internet.: Sep 4, 2007; the internet makes you stupid

Question about SCCM 2016 and SCCM vNext.

What really is the benefit of one over the other?

- When "SCCM 2021" releases, vNext can automatically upgrade I through the update package so there would be no need for a side by side upgrade between major releases going forward?

- SCCM vNext will have a more aggressive upgrade cycle?

- SCCM vNext will support Windows 10 in place upgrade? Why can't SCCM 2012 do this with a CU update from MS?

Strangely information seems to be all over the place on this.

# ? Jun 9, 2016 02:18

FISHMANPET: Mar 3, 2007; Sweet 'N Sour
Can't
Melt
Steel Beams

vNext is just the code name for the next version. System Center 2016 is just going to be a branding thing, the product is just going to be 1607 (I'm assuming 2016 everything is dropping with the Anniversary edition of Windows 10 on July 29, including Server 2016, Server 2016, Windows 1607, SCCM 1607, etc etc) and a part of the System Center 2016 suite. So that answers the first two questions, there's no comparison between the two products because they're the same product.

As for the third, they're not doing it because they don't want you running Configuration Manager 2012 R2 SP1 CU2 LOL4, they want you running the current whatever reason.

Unless I'm wrong about everything, this is the vibe I got from MMS 2015 in November but I didn't go to MMS 2016 because it was last month so all my hot takes from Microsoft Insiders are out of date.

# ? Jun 9, 2016 05:25

evil_bunnY: Apr 2, 2003

hihifellow posted:

This is a massive pain in NTFS world and any time I got a request like that I offered to do a shared folder on an org-wide share with the access rights they wanted instead. Fortunately they all said okay instead of being stubborn.

In most flexible/project-based organizations where the structure makes sense instead of being mapped to the org structure, you have personal folders and project folders for basically each project. It's much easier to manage, and there'd be a folder per project in the department shares anyway.

# ? Jun 9, 2016 09:15

orange sky: May 7, 2007

Oh my loving god I've been having this problem for two days and I don't know what else to do.

I have two VMs in Hyper-V, one is MDT another is a normal VM to install Windows 10. I created an ISO using MDT, and booting it up I always get this poo poo:

Always. I have tried changing and removing credentials from bootstrap.ini and customsettings.ini, tried changing virtual switches, tried everything (yes, always after regenerating the ISOs and replacing them). This is really pissing me off, nothing usually takes me this long to get through.

E: I called it SRVSCCM01 but it's an MDT server.

orange sky fucked around with this message at 10:42 on Jun 9, 2016

# ? Jun 9, 2016 10:38

Dr. Arbitrary: Mar 15, 2006; Bleak Gremlin

I've got a service that keeps getting stopped and disabled. I found out the trigger is when group policy updates.

Anyone know any policies that would do that? There's just a zillion of GPOs to look through and nothing seems to match.

# ? Jun 9, 2016 17:21

FISHMANPET: Mar 3, 2007; Sweet 'N Sour
Can't
Melt
Steel Beams

orange sky posted:

Oh my loving god I've been having this problem for two days and I don't know what else to do.

I have two VMs in Hyper-V, one is MDT another is a normal VM to install Windows 10. I created an ISO using MDT, and booting it up I always get this poo poo:

Always. I have tried changing and removing credentials from bootstrap.ini and customsettings.ini, tried changing virtual switches, tried everything (yes, always after regenerating the ISOs and replacing them). This is really pissing me off, nothing usually takes me this long to get through.

E: I called it SRVSCCM01 but it's an MDT server.

So dumb question, but does the user you're using have access to the share? Are you defining it properly in your bootstrap.ini?
Looking at how I've got mine setup, I made an account local to the machine, and it's in the Users group on the machine. The Users group has read access to my Deployment Share. In Bootstrap.ini I have:

code:

DeployRoot=\\mdtserver\HydrationSC2012R2$
SkipBDDWelcome=Yes
UserID=mdt-readonly
UserPassword=<password>
UserDomain=mdtserver

# ? Jun 9, 2016 17:41

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

Dr. Arbitrary posted:

I've got a service that keeps getting stopped and disabled. I found out the trigger is when group policy updates.

Anyone know any policies that would do that? There's just a zillion of GPOs to look through and nothing seems to match.

Well sounds like you've got a GPO that sets that service as disabled. Pick whatever OU in GPM you're having issues with and start looking at the details of each GPO and ctrl-f for the service you're looking for. You created your own policies, we can't tell you what is doing it.

# ? Jun 9, 2016 18:53

Internet Explorer: Jun 1, 2005

Or run GP modeling / GP results in Group Policy Management. Or gpresult /h on the server you are troubleshooting.

# ? Jun 9, 2016 20:20

lol internet.: Sep 4, 2007; the internet makes you stupid

FISHMANPET posted:

vNext is just the code name for the next version. System Center 2016 is just going to be a branding thing, the product is just going to be 1607 (I'm assuming 2016 everything is dropping with the Anniversary edition of Windows 10 on July 29, including Server 2016, Server 2016, Windows 1607, SCCM 1607, etc etc) and a part of the System Center 2016 suite. So that answers the first two questions, there's no comparison between the two products because they're the same product.

As for the third, they're not doing it because they don't want you running Configuration Manager 2012 R2 SP1 CU2 LOL4, they want you running the current whatever reason.

Unless I'm wrong about everything, this is the vibe I got from MMS 2015 in November but I didn't go to MMS 2016 because it was last month so all my hot takes from Microsoft Insiders are out of date.

Thanks for clarifying some things up. With SCCM 2016 being able to run in the cloud, any idea if PXE services would somehow work through the cloud VM?

# ? Jun 9, 2016 21:02

Dr. Arbitrary: Mar 15, 2006; Bleak Gremlin

MF_James posted:

Well sounds like you've got a GPO that sets that service as disabled. Pick whatever OU in GPM you're having issues with and start looking at the details of each GPO and ctrl-f for the service you're looking for. You created your own policies, we can't tell you what is doing it.

What's crazy is that it's not a normal service like the spooler, it's a custom one.

My understanding is that with group policy, you have to go out of your way to specifically disable services.

I don't see it in the GPOs, it's really twisting my brain up.

Maybe some devious architect made a policy to disable this service years ago on the off chance that we'd one day buy this product, install it and *trap sprung!*

# ? Jun 9, 2016 21:26

Adbot: ADBOT LOVES YOU

# ? May 13, 2024 22:01

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

Dr. Arbitrary posted:

What's crazy is that it's not a normal service like the spooler, it's a custom one.

My understanding is that with group policy, you have to go out of your way to specifically disable services.

I don't see it in the GPOs, it's really twisting my brain up.

Maybe some devious architect made a policy to disable this service years ago on the off chance that we'd one day buy this product, install it and *trap sprung!*

Do you have a test environment experiencing the same problem? Disable GPOs 1 at a time, or all at once and see what happens.

# ? Jun 9, 2016 21:30

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Enterprise Microsoft Q&A: Hello for Buttprint

«‹›261 »