Enterprise Microsoft Q&A: Hello for Buttprint

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Enterprise Microsoft Q&A: Hello for Buttprint

«‹›261 »

buffbus: Nov 19, 2012

MF_James posted:

Ugh going to go loving crazy trying to figure this out, wonder if maybe one of you guys could help.

I've got 2200 remote machines with ~10 LOCAL users each (they are all named the same across all the machines), and running server 2012 R2. 90% of these users have hosed up file associations for xls/doc type files, don't ask, it's awful and I'm pretty pissed the "project" team that caused this problem does not have to fix it. So, domain level USER GPOs are out of the question, which sucks because there's a group policy user preference item that would do exactly what I need. I've tried this: https://blogs.technet.microsoft.com...ailto-protocol/ and it did add a reg entry for the program I selected, but did not seem to actually do anything useful, unless I'm dumb and did it wrong. Server 2012 and on hashes user registry hives so I can't just load hives, delete keys, import and unload, it will just return to what it was before (kind of).

Anyone dealt with something like this have any ideas? I've got a microsoft ticket open, but uh they keep sending me "fixes" that are domain user GPOs. Switching to domain users is the end-game goal, but it's not a possibility at the moment.

I haven't had the misfortune of supporting local accounts in a domain setting but a possibility is applying the user side preference as a loop back gpo linked to the computer ou.

# ? Jun 22, 2016 04:56

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 00:06

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

buffbus posted:

I haven't had the misfortune of supporting local accounts in a domain setting but a possibility is applying the user side preference as a loop back gpo linked to the computer ou.

Hmm this sounds crazy enough to work, I'll give that a go, worst case I waste 30 minutes.

# ? Jun 22, 2016 05:52

Swink: Apr 18, 2006; Left Side <--- Many Whelps

I've got Domain Controllers running on HyperV 2012R2. The VM infrastructure cannot update group policy from the domain controllers, while physical infrastructure can.

This includes other virtualised domain controllers - sysvol replication doesnt occur.

Everything else is fine - DNS and AD objects replicates fine, all clients can use the DNS services with no issues. The problem is specifically with other virtual machines trying to update GP. This includes other VMs running on other HyperV hosts and even VMs running on my PC with virtualbox. (my Physical PC has no problem)

The clients get errors like this:

code:

The processing of Group Policy failed. Windows could not obtain the name of a domain controller. This could be caused by a name resolution failure. Verify your Domain Name System (DNS) is configured and working correctly.

The LDAP call to connect and bind to Active Directory completed. 
dc-1.domain.local
The call failed after 21015 milliseconds.

Group Policy failed to discover the Domain Controller details in 42828 milliseconds.

The only common thread is that virtualised boxes have the issue. What could it be?

# ? Jun 22, 2016 10:43

Potato Salad: Oct 23, 2014; nobody cares

Does a local account login process go looking for GPOs applying to its computer account?

# ? Jun 22, 2016 12:59

buffbus: Nov 19, 2012

Potato Salad posted:

Does a local account login process go looking for GPOs applying to its computer account?

Yes, computer side GPO settings will process before the user even logs in (aside for some async processing in the case of a very fast logon).

# ? Jun 22, 2016 14:27

Potato Salad: Oct 23, 2014; nobody cares

Then the real question is whether loopback will apply to a non domain account -- that is, whether loopback even matters if the system isn't looking for user policies in the first place. Unless..."Authenticated Users" or "Everyone" includes local accounts?

I need to learn this poo poo.

Time for me to read on exactly the sequence of events involved in a system searching for and electing to apply policies.

# ? Jun 22, 2016 14:53

mayodreams: Jul 4, 2003; Hello darkness,
my old friend

Swink posted:

I've got Domain Controllers running on HyperV 2012R2. The VM infrastructure cannot update group policy from the domain controllers, while physical infrastructure can.

This includes other virtualised domain controllers - sysvol replication doesnt occur.

Everything else is fine - DNS and AD objects replicates fine, all clients can use the DNS services with no issues. The problem is specifically with other virtual machines trying to update GP. This includes other VMs running on other HyperV hosts and even VMs running on my PC with virtualbox. (my Physical PC has no problem)

The clients get errors like this:

The only common thread is that virtualised boxes have the issue. What could it be?

Where the problematic domain controllers p2v'd? I"ve had issues with p2v corrupting or locking the SYSVOL, which requires rebuilding it.

# ? Jun 22, 2016 15:03

buffbus: Nov 19, 2012

mayodreams posted:

Where the problematic domain controllers p2v'd? I"ve had issues with p2v corrupting or locking the SYSVOL, which requires rebuilding it.

I can confirm, a p2p usually involves some sort of drive snapshot which can thoroughly piss off a domain controller.

# ? Jun 22, 2016 15:08

wyoak: Feb 14, 2005; a glass case of emotion; Fallen Rib

Swink posted:

I've got Domain Controllers running on HyperV 2012R2. The VM infrastructure cannot update group policy from the domain controllers, while physical infrastructure can.

This includes other virtualised domain controllers - sysvol replication doesnt occur.

Everything else is fine - DNS and AD objects replicates fine, all clients can use the DNS services with no issues. The problem is specifically with other virtual machines trying to update GP. This includes other VMs running on other HyperV hosts and even VMs running on my PC with virtualbox. (my Physical PC has no problem)

The clients get errors like this:

The only common thread is that virtualised boxes have the issue. What could it be?

Can your virtual box ping the virtual DC's or other virtual machines ping each other?

# ? Jun 22, 2016 20:55

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

Swink posted:

I've got Domain Controllers running on HyperV 2012R2. The VM infrastructure cannot update group policy from the domain controllers, while physical infrastructure can.

This includes other virtualised domain controllers - sysvol replication doesnt occur.

Everything else is fine - DNS and AD objects replicates fine, all clients can use the DNS services with no issues. The problem is specifically with other virtual machines trying to update GP. This includes other VMs running on other HyperV hosts and even VMs running on my PC with virtualbox. (my Physical PC has no problem)

The clients get errors like this:
code:
The processing of Group Policy failed. Windows could not obtain the name of a domain controller. This could be caused by a name resolution failure. Verify your Domain Name System (DNS) is configured and working correctly.

The LDAP call to connect and bind to Active Directory completed. 
dc-1.domain.local
The call failed after 21015 milliseconds.

Group Policy failed to discover the Domain Controller details in 42828 milliseconds.
The only common thread is that virtualised boxes have the issue. What could it be?

You are selecting the correct VLAN on the virtual switch, right? The NICs on your virtual machines are also configured correctly (domain suffixes etc), right?

# ? Jun 22, 2016 20:57

Swink: Apr 18, 2006; Left Side <--- Many Whelps

Everything can ping fine. They can all do nslookups fine. There are no VLANs on this network.

It's possible this DC was snapshotted or P2vd in the past. Ami going to be able to build a new DC without having to hose the whole domain?

# ? Jun 23, 2016 00:26

Internet Explorer: Jun 1, 2005

If the DCs are replicating, bringing up new DCs and migrating the roles should work. I think the issue everyone is concerned with is that maybe the DCs aren't replicating properly. Have you gone through dcdaig?

[Edit: And just in case... are you sure you're not getting bit by this? https://social.technet.microsoft.com/Forums/en-US/e2ebead9-b30d-4789-a151-5c7783dbbe34/patch-tuesday-kb3159398?forum=winserverGP ]

# ? Jun 23, 2016 01:08

Swink: Apr 18, 2006; Left Side <--- Many Whelps

No SYSVOL replication is happening though. Could I manually copy and share that folder on a new DC?

I'm severely lacking lab hardware to test all this

# ? Jun 23, 2016 02:41

mayodreams: Jul 4, 2003; Hello darkness,
my old friend

Swink posted:

No SYSVOL replication is happening though. Could I manually copy and share that folder on a new DC?

I'm severely lacking lab hardware to test all this

You can start here:

https://technet.microsoft.com/en-us/library/cc816596(v=ws.10).aspx

# ? Jun 23, 2016 03:15

Internet Explorer: Jun 1, 2005

Swink posted:

No SYSVOL replication is happening though. Could I manually copy and share that folder on a new DC?

I'm severely lacking lab hardware to test all this

Sorry, I forgot that you mentioned that. Yes, things are seriously broken and standing up a new DC is not going to help. You need to fix the problem.

# ? Jun 23, 2016 13:46

Swink: Apr 18, 2006; Left Side <--- Many Whelps

Any insights as to why it's just virtual infra with the problem? Could it be driver related? Clock?

Shits messed up.

# ? Jun 24, 2016 04:45

wyoak: Feb 14, 2005; a glass case of emotion; Fallen Rib

Swink posted:

Any insights as to why it's just virtual infra with the problem? Could it be driver related? Clock?

Shits messed up.

Anything in the DFS Replication or File Replication Service event logs on the DC's? Could be clock related, they're all set to the right time right (they should all be syncing from one master, which should be syncing from a real NTP server)

# ? Jun 24, 2016 21:28

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Christ, I posted in here about raising the functional level on our forest and domain from 2003 almost two months ago, and we still haven't done it yet, and we're still not going to do it until the middle of next month, because my loving boss is so ridiculously paranoid.

# ? Jun 28, 2016 18:08

BaseballPCHiker: Jan 16, 2006

anthonypants posted:

Christ, I posted in here about raising the functional level on our forest and domain from 2003 almost two months ago, and we still haven't done it yet, and we're still not going to do it until the middle of next month, because my loving boss is so ridiculously paranoid.

As long as you dont have any old oddball appliances like a firewall or email gateway that dont support a newer forest level you will be fine. Its super easy, like one line in powershell and another to confirm.

# ? Jun 28, 2016 19:09

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

BaseballPCHiker posted:

As long as you dont have any old oddball appliances like a firewall or email gateway that dont support a newer forest level you will be fine. Its super easy, like one line in powershell and another to confirm.

What would a firewall or email gateway have to do with the functional level? We have VPN and email gateways that use LDAP but I don't know how that would be affected, do you have something I could read up on?

# ? Jun 28, 2016 21:11

Wrath of the Bitch King: May 11, 2005; Research confirms that black is a color like silver is a color, and that beyond black is clarity.

Mr. Clark2 posted:

The version I got from MS tech bench seems to work but now I'm running into what looks to be driver problems. For those of you doing this, did you make a new deployment share just for Win10? I stuck my Win10 images/drivers/task sequences on the same deployment share as all my Win7 crap but I fear that may be causing me problems. All instructions that I'm finding online are starting clean in a lab environment, I'm not finding much about running it in production.

I advise following this model, if you can:

http://deploymentresearch.com/Research/Post/325/MDT-2013-Lite-Touch-Driver-Management

Generally you want your selection profiles to only pertain to drivers of a particular operating system from within the Task Sequence context. PnP is great, but it isn't infallible; I'm a big fan of "Option 3" from the link above.

# ? Jun 28, 2016 21:17

BaseballPCHiker: Jan 16, 2006

anthonypants posted:

What would a firewall or email gateway have to do with the functional level? We have VPN and email gateways that use LDAP but I don't know how that would be affected, do you have something I could read up on?

If those appliances have any sort of integration with AD for things like tracking users or using existing OUs for anything. For example we had a lovely old spam filter that used LDAP and AD but was only supported up to 2008. As soon as I could get rid of that spam filter I could raise the forest level past 2008.

Nothing I can really link to, it's going to be specific for device and appliance. If you dont have anything like that that integrates with AD or does something with LDAP you're probably fine, just make sure to double check first.

# ? Jun 29, 2016 17:02

Thanks Ants: May 21, 2004; #essereFerrari

Domain functional level only affects the minimum OS version for a DC though. LDAP isn't affected by it.

# ? Jun 29, 2016 17:15

Mr. Clark2: Sep 17, 2003; Rocco sez: Oh man, what a bummer. Woof.

Wrath of the Bitch King posted:

I advise following this model, if you can:

http://deploymentresearch.com/Research/Post/325/MDT-2013-Lite-Touch-Driver-Management

Generally you want your selection profiles to only pertain to drivers of a particular operating system from within the Task Sequence context. PnP is great, but it isn't infallible; I'm a big fan of "Option 3" from the link above.

Thanks, that got me sorted. I've gone ahead and ordered his "Deployment Fundamentals Volume 6".

# ? Jun 29, 2016 21:17

22 Eargesplitten: Oct 10, 2010

Has anyone seen Windows Update Standalone take 10-20 minutes to search for an update when you manually start the process by clicking an .msu file? They are the same files I used a dozen other times that took maybe 2 minutes.

Actually, I have 2 copies on here, could that cause it?

# ? Jun 29, 2016 22:50

Mr. Clark2: Sep 17, 2003; Rocco sez: Oh man, what a bummer. Woof.

How are you guys handling start menu layout in Win10 Pro?
I dont know who at MS thought it was a good idea to include a bunch of bullshit 'apps' (xbox, minecraft, twitter) in the default menu and then not give you a way of managing it via GPO. I know that there is a GPO to define a start menu layout, but that has it's own drawbacks...you have to set it up on a refernece machine, need a separate file for x86 and x64, users cant add items, etc.

# ? Jul 1, 2016 21:01

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Mr. Clark2 posted:

How are you guys handling start menu layout in Win10 Pro?
I dont know who at MS thought it was a good idea to include a bunch of bullshit 'apps' (xbox, minecraft, twitter) in the default menu and then not give you a way of managing it via GPO. I know that there is a GPO to define a start menu layout, but that has it's own drawbacks...you have to set it up on a refernece machine, need a separate file for x86 and x64, users cant add items, etc.

I think most people just pretend it's going to change, like Windows 8->8.1 didn't.

# ? Jul 1, 2016 21:05

GreenNight: Feb 19, 2006; Turning the light on the darkest places, you and I know we got to face this now. We got to face this now.

Mr. Clark2 posted:

How are you guys handling start menu layout in Win10 Pro?
I dont know who at MS thought it was a good idea to include a bunch of bullshit 'apps' (xbox, minecraft, twitter) in the default menu and then not give you a way of managing it via GPO. I know that there is a GPO to define a start menu layout, but that has it's own drawbacks...you have to set it up on a refernece machine, need a separate file for x86 and x64, users cant add items, etc.

I powershell them out in my capture image.

# ? Jul 1, 2016 21:12

Mr. Clark2: Sep 17, 2003; Rocco sez: Oh man, what a bummer. Woof.

GreenNight posted:

I powershell them out in my capture image.

Any scripts you'd care to share? Right now I'm doing in-place upgrades so I wish I had some way of doing it programmatically, but when I start doing clean installs some scripts would be helpful.

# ? Jul 1, 2016 21:36

GreenNight: Feb 19, 2006; Turning the light on the darkest places, you and I know we got to face this now. We got to face this now.

Mr. Clark2 posted:

Any scripts you'd care to share? Right now I'm doing in-place upgrades so I wish I had some way of doing it programmatically, but when I start doing clean installs some scripts would be helpful.

Basically this stuff.

http://www.howtogeek.com/224798/how-to-uninstall-windows-10s-built-in-apps-and-how-to-reinstall-them/

If you Google around, a few people built all in one powershell scripts and a few other cool commands.

# ? Jul 1, 2016 21:50

BaseballPCHiker: Jan 16, 2006

Mr. Clark2 posted:

Any scripts you'd care to share? Right now I'm doing in-place upgrades so I wish I had some way of doing it programmatically, but when I start doing clean installs some scripts would be helpful.

There are also a ton of Windows 10 specific GPOs that you can use to lock down the store, using metro apps, location services, etc.

# ? Jul 1, 2016 21:54

Mr. Clark2: Sep 17, 2003; Rocco sez: Oh man, what a bummer. Woof.

BaseballPCHiker posted:

There are also a ton of Windows 10 specific GPOs that you can use to lock down the store, using metro apps, location services, etc.

Yeah, I saw those while poking around yesterday but most of them are actually for Win10 Enterprise/Education editions only...even though there's no mention of that in the description of the GPO :\

# ? Jul 1, 2016 22:00

orange sky: May 7, 2007

Oh god this thread is triggering me I've been fighting with the Win10 apps in the Enterprise edition this is the dumbest loving thing who puts xbox apps in an enterprise software? Holy poo poo.

I uninstalled them in the reference machine, I'm using copyprofile with my unattend and the loving thing STILL INSTALLS everything when I create a new profile. I think it silently connects to Windows Update and downloads the stuff or something. We even tried the remove-appxprovisionedpackage thing but when we create a new profile there it is.

Who thought this was a good idea and made it so hard to get through? gently caress you buddy.

# ? Jul 1, 2016 22:05

Mr. Clark2: Sep 17, 2003; Rocco sez: Oh man, what a bummer. Woof.

orange sky posted:

Oh god this thread is triggering me I've been fighting with the Win10 apps in the Enterprise edition this is the dumbest loving thing who puts xbox apps in an enterprise software? Holy poo poo.

I uninstalled them in the reference machine, I'm using copyprofile with my unattend and the loving thing STILL INSTALLS everything when I create a new profile. I think it silently connects to Windows Update and downloads the stuff or something. We even tried the remove-appxprovisionedpackage thing but when we create a new profile there it is.

Who thought this was a good idea and made it so hard to get through? gently caress you buddy.

Glad to see it's not just me

*update*
Banged out a quick ps script to remove all the included apps and ran it as admin, success!
Reboot, log in as a standard user...they're all back. gently caress me :\

Mr. Clark2 fucked around with this message at 23:21 on Jul 1, 2016

# ? Jul 1, 2016 22:13

Wrath of the Bitch King: May 11, 2005; Research confirms that black is a color like silver is a color, and that beyond black is clarity.

Has anyone definitively figured out if LTSB or CBB is the best choice for your average office worker?

I'm failing to see the downside of LTSB other than losing Edge.

# ? Jul 2, 2016 17:40

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

If you have licenses for 10 Enterprise, why wouldn't you run LTSB?

# ? Jul 2, 2016 17:44

Wrath of the Bitch King: May 11, 2005; Research confirms that black is a color like silver is a color, and that beyond black is clarity.

anthonypants posted:

If you have licenses for 10 Enterprise, why wouldn't you run LTSB?

That's basically my question. It SEEMS obvious to me, but MS' stance on it is that CBB is what you should be going for for normal use cases while LTSB should be on your outliers. What I'm trying to determine is if there is a legitimate reason for using CBB or if this is just Microsoft trying to push the platform that will present and market their new features more readily.

# ? Jul 2, 2016 17:58

FISHMANPET: Mar 3, 2007; Sweet 'N Sour
Can't
Melt
Steel Beams

Deer Lourde do not run LTSB on regular staff machines. Windows and it's ecosystem moves fast now. Outdated ideas like waiting X years before moving products into production or running the previous version or whatever just don't cut it anymore. If you can't handle CB and CBB then you need to look at your business processes and figure out why.

# ? Jul 2, 2016 18:57

Swink: Apr 18, 2006; Left Side <--- Many Whelps

I threw out a preset start menu to staff. They couldn't change it so I had to ensure it had all the apps required.

It's sucks because it annoys the staff who know and want to customise their layout.

I had to do it this way because for some users, if it's not in the start menu, it doesn't exist.

If you have different software load outs on different machines then you're in a world of pain but it is doable.

# ? Jul 3, 2016 09:20

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 00:06

Mr. Clark2: Sep 17, 2003; Rocco sez: Oh man, what a bummer. Woof.

Swink posted:

I threw out a preset start menu to staff. They couldn't change it so I had to ensure it had all the apps required.

It's sucks because it annoys the staff who know and want to customise their layout.

I had to do it this way because for some users, if it's not in the start menu, it doesn't exist.

If you have different software load outs on different machines then you're in a world of pain but it is doable.

The current situation with managing the start menu in win10 is pretty much a mess. Hopefully MS will provide some more robust tools at some point but I'm not gonna hold my breath.

# ? Jul 3, 2016 18:25

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Enterprise Microsoft Q&A: Hello for Buttprint

«‹›261 »