GPTalk Mailing List

[gptalk] Group Policy woes on Windows XP after SYSVOL issue.

JohnTennyson — Thu, 09 Sep 2010 22:06:04 GMT

I just fixed a sysvol issue on one of our domain controllers (it
stopped replicating with the rest of the domain controllers) and
everything seems to check out ok.

However I am getting some /weird/ Group Policy Issues:

gpotool reports all is well and the group policy replicates just fine
across all three domain controllers.

the below doesn't seem to matter which domain controller the PC is
logging into the behavior is the same.

Picture a domain with two created OUs X and Y, an XP machine and a
windows 7 machine have been a member of OU X for some time and received
several group policies (call them A B and C) for quite some time. I
link a new policy D into OU Y.

I then move both machines to OU Y, and execute gpupdate /force /wait:-1
they both complete with no errors.
GPRESULT (or GPRESULT /r on win 7) report that on the windows 7 machine
it is in the new OU and gets only policy D as expected. The windows XP
box reports that it is in the new OIT but only gets policy A B and C
none of which are linked to the new OU and doesn't even show D (not
filtered out, nothing). Policy D is set to Authenticated Users and no
WMI filter.

The same behavior seems to happen if I just link policy D to OU X
(windows 7 gets it, xp doesn't even show it in the RSOP data).

There are no errors in either of the PCs or the DCs event logs that
would shed any light on it.

I can't find enough clear info on how XP pulls data on which GPOs to run
vs how Windows 7 does it but something is odd.

Are there any databases that might need to get rebuilt because the DCs
were in an inconsistent state for so long (5 days) if so how do I do it,
or does anyone else have any other ideas. Note: rebuilding the domain
is NOT an option, this is a large-scale production domain.

Thanks in advance for any help or ideas!

--
John Tennyson
Senior Systems Infrastructure Administrator
ACSO/OIT - UMASS Amherst

T 413.545.3327
E jtennyson@oit.umass.edu

PGP/GPG or S/MIME Email Encouraged

[gptalk] Internet Explorer Zonemapping Failed (no data) 9/9/2010 11:15:51 AM

derekodiorne — Thu, 09 Sep 2010 17:56:05 GMT

The computer policy for trusted sites zones are not applying when normal
users logon, only admins. The error in the RsOP is below:

Internet Explorer Zonemapping

Failed (no data)

9/9/2010 11:15:51 AM

Internet Explorer Zonemapping failed due to the error listed below.

The parameter is incorrect.

Additional information may have been logged. Review the Policy Events
tab in the console or the application event log for events between
9/9/2010 11:15:51 AM and 9/9/2010 11:15:51 AM.

Derek Odiorne

Sr. Network Analyst
Loan Servicing Solutions

Fiserv
Office: 574-245-1487

Cell: 574.903.3122

www.fiserv.com <http://www.fiserv.com>

P Please consider the environment before printing this e-mail

[gptalk] IE8 enhanced security configuration

gturner — Wed, 08 Sep 2010 22:33:34 GMT

I am looking to manage with Group policy the Enhanced security
configuration (ESC) for IE8 running on a Windows 2008 R2 server running
Remote desktop services (Terminal server).

The server manager is indicating that these ESC settings;

On - Administrators

Off - Users

However as we launch the IE8 on the Terminal server the ESC is clearly
enabled for Users;

This suggests that some sort of (default ?) policy either machine or
user which I can't be sure of is over-riding the values reported by the
server manager.

I have been through the policy editor but unable to find any relevant
policy values, which seem to have moved from Windows 2003 days, so would
be thankful for suggestion in this.

Thanks. G

RE: [gptalk] Group Policy Preferences: Environment Variable Expansion and Circular References

DarraghOShaughnessy — Wed, 08 Sep 2010 11:38:53 GMT

Thanks Darren.

From: gptalk-owner@lists.gpoguy.com [mailto:gptalk-owner@lists.gpoguy.com]
On Behalf Of Darren Mar-Elia
Sent: 08 September 2010 03:14
To: gptalk@lists.gpoguy.com
Subject: RE: [gptalk] Group Policy Preferences: Environment Variable
Expansion and Circular References

Nothing back so far Darragh. Let me see if I can dig a little bit on my own
around this.

Darren

From: gptalk-owner@lists.gpoguy.com [mailto:gptalk-owner@lists.gpoguy.com]
On Behalf Of Darragh O'Shaughnessy
Sent: Monday, September 06, 2010 3:53 AM
To: gptalk@lists.gpoguy.com
Subject: RE: [gptalk] Group Policy Preferences: Environment Variable
Expansion and Circular References

Hi Darren,

I wonder did the product team have anything to say on this. Still observing
this behaviour in the wild.

Regards,

Darragh O'Shaughnessy

From: gptalk-owner@lists.gpoguy.com [mailto:gptalk-owner@lists.gpoguy.com]
On Behalf Of Darren Mar-Elia
Sent: 20 August 2010 16:25
To: gptalk@lists.gpoguy.com
Subject: RE: [gptalk] Group Policy Preferences: Environment Variable
Expansion and Circular References

Darragh-

I'll forward this to the product team. I agree with you that if this is
really how its working, this would indicate a bug in the code.

Darren

From: gptalk-owner@lists.gpoguy.com [mailto:gptalk-owner@lists.gpoguy.com]
On Behalf Of Darragh O'Shaughnessy
Sent: Friday, August 20, 2010 8:10 AM
To: gptalk@lists.gpoguy.com
Subject: [gptalk] Group Policy Preferences: Environment Variable Expansion
and Circular References

Hey guys,

I have an interesting case for you to ponder. I have had an issue lately
where users logging onto a machines will hand at 'Applying Settings'
infinitely and never get to the desktop. After a days worth of detailed
debugging using procmon/procexp/dbgview I was led to gpprefcl.dll. This
little library appears to be responsible for environment variables in group
policy preferences.

What I found is that some users have circular references in their
environment variables eg:

CLASSPATH=c:\libs;%CLASSPATH%

This would be a normal CLASSPATH setting if set from the command line and
any of you java nerds out there will be familiar with it :-)

Now, it appears that when gpprefcl.dll (to be exact the function therein
whose name I haven't figured out yet!) expands this environment variable we
get an infinite loop and processing of this client side extension never
completes. This can be observed using pslist.exe or the like. You will see a
thread running under winlogon that never exits and has a handles open to
this .dll and is calling several functions therein.

I've recreated it in my test vm lab. I'd be interested if anyone could add
some insight here. I don't have the source code for the .dll so I cant see
how it expands the variables or if it calls another native library to do
that.

If you look at the variables using the GUI i.e.

System->Advanced->Environment Variables

It would display as "CLASSPATH=c:\libs;c:\libs;%CLASSPATH%" which indicates
to me that the circular reference is cut off after one expansion on the
right hand side i.e. "%CLASSPATH%" is substituted with "c:\libs;%CLASSPATH%"
once here whereas the .dll seems to recursively expand this.

I'd love to bring this up with Microsoft's GPP Team but I have no idea how
to do it.

Regards,

Darragh O'Shaughnessy

RE: [gptalk] Group Policy Preferences: Environment Variable Expansion and Circular References

dmarelia — Wed, 08 Sep 2010 04:54:19 GMT

Nothing back so far Darragh. Let me see if I can dig a little bit on my own around this.

Darren

From: gptalk-owner@lists.gpoguy.com [mailto:gptalk-owner@lists.gpoguy.com] On Behalf Of Darragh O'Shaughnessy
Sent: Monday, September 06, 2010 3:53 AM
To: gptalk@lists.gpoguy.com
Subject: RE: [gptalk] Group Policy Preferences: Environment Variable Expansion and Circular References

Hi Darren,
I wonder did the product team have anything to say on this. Still observing this behaviour in the wild.

Regards,

Darragh O'Shaughnessy

From: gptalk-owner@lists.gpoguy.com [mailto:gptalk-owner@lists.gpoguy.com] On Behalf Of Darren Mar-Elia
Sent: 20 August 2010 16:25
To: gptalk@lists.gpoguy.com
Subject: RE: [gptalk] Group Policy Preferences: Environment Variable Expansion and Circular References

Darragh-
I'll forward this to the product team. I agree with you that if this is really how its working, this would indicate a bug in the code.

Darren

From: gptalk-owner@lists.gpoguy.com [mailto:gptalk-owner@lists.gpoguy.com] On Behalf Of Darragh O'Shaughnessy
Sent: Friday, August 20, 2010 8:10 AM
To: gptalk@lists.gpoguy.com
Subject: [gptalk] Group Policy Preferences: Environment Variable Expansion and Circular References

Hey guys,

I have an interesting case for you to ponder. I have had an issue lately where users logging onto a machines will hand at 'Applying Settings' infinitely and never get to the desktop. After a days worth of detailed debugging using procmon/procexp/dbgview I was led to gpprefcl.dll. This little library appears to be responsible for environment variables in group policy preferences.

What I found is that some users have circular references in their environment variables eg:

CLASSPATH=c:\libs;%CLASSPATH%

This would be a normal CLASSPATH setting if set from the command line and any of you java nerds out there will be familiar with it

Now, it appears that when gpprefcl.dll (to be exact the function therein whose name I haven't figured out yet!) expands this environment variable we get an infinite loop and processing of this client side extension never completes. This can be observed using pslist.exe or the like. You will see a thread running under winlogon that never exits and has a handles open to this .dll and is calling several functions therein.

I've recreated it in my test vm lab. I'd be interested if anyone could add some insight here. I don't have the source code for the .dll so I cant see how it expands the variables or if it calls another native library to do that.

If you look at the variables using the GUI i.e.

System->Advanced->Environment Variables

It would display as "CLASSPATH=c:\libs;c:\libs;%CLASSPATH%" which indicates to me that the circular reference is cut off after one expansion on the right hand side i.e. "%CLASSPATH%" is substituted with "c:\libs;%CLASSPATH%" once here whereas the .dll seems to recursively expand this.

I'd love to bring this up with Microsoft's GPP Team but I have no idea how to do it.

Regards,

Darragh O'Shaughnessy

RE: [gptalk] Group Policy Preferences: Environment Variable Expansion and Circular References

DarraghOShaughnessy — Mon, 06 Sep 2010 13:20:13 GMT

Hi Darren,

I wonder did the product team have anything to say on this. Still observing
this behaviour in the wild.

Regards,

Darragh O'Shaughnessy

From: gptalk-owner@lists.gpoguy.com [mailto:gptalk-owner@lists.gpoguy.com]
On Behalf Of Darren Mar-Elia
Sent: 20 August 2010 16:25
To: gptalk@lists.gpoguy.com
Subject: RE: [gptalk] Group Policy Preferences: Environment Variable
Expansion and Circular References

Darragh-

I'll forward this to the product team. I agree with you that if this is
really how its working, this would indicate a bug in the code.

Darren

From: gptalk-owner@lists.gpoguy.com [mailto:gptalk-owner@lists.gpoguy.com]
On Behalf Of Darragh O'Shaughnessy
Sent: Friday, August 20, 2010 8:10 AM
To: gptalk@lists.gpoguy.com
Subject: [gptalk] Group Policy Preferences: Environment Variable Expansion
and Circular References

Hey guys,

I have an interesting case for you to ponder. I have had an issue lately
where users logging onto a machines will hand at 'Applying Settings'
infinitely and never get to the desktop. After a days worth of detailed
debugging using procmon/procexp/dbgview I was led to gpprefcl.dll. This
little library appears to be responsible for environment variables in group
policy preferences.

What I found is that some users have circular references in their
environment variables eg:

CLASSPATH=c:\libs;%CLASSPATH%

This would be a normal CLASSPATH setting if set from the command line and
any of you java nerds out there will be familiar with it :-)

Now, it appears that when gpprefcl.dll (to be exact the function therein
whose name I haven't figured out yet!) expands this environment variable we
get an infinite loop and processing of this client side extension never
completes. This can be observed using pslist.exe or the like. You will see a
thread running under winlogon that never exits and has a handles open to
this .dll and is calling several functions therein.

I've recreated it in my test vm lab. I'd be interested if anyone could add
some insight here. I don't have the source code for the .dll so I cant see
how it expands the variables or if it calls another native library to do
that.

If you look at the variables using the GUI i.e.

System->Advanced->Environment Variables

It would display as "CLASSPATH=c:\libs;c:\libs;%CLASSPATH%" which indicates
to me that the circular reference is cut off after one expansion on the
right hand side i.e. "%CLASSPATH%" is substituted with "c:\libs;%CLASSPATH%"
once here whereas the .dll seems to recursively expand this.

I'd love to bring this up with Microsoft's GPP Team but I have no idea how
to do it.

Regards,

Darragh O'Shaughnessy

[gptalk] Wireless network policies

ray — Fri, 03 Sep 2010 14:43:38 GMT

Hi all,

Configuring a Wireless network policy via GPO seems pretty straight forward, but is there a way to populate the Network Security key too?

Current Policy is:
Authentication - WPA-PSK
Encryption - TKIP

Thanks in advance

Ray

RE: [gptalk] List dead/inactive Computer Accounts in Active Directory.

DaemonRoot — Fri, 03 Sep 2010 07:55:47 GMT

Yep, but I guess no one will grant Domain Admin rights to a folk that
doesn't think twice before pulling the trigger J

~D

From: gptalk-owner@lists.gpoguy.com [mailto:gptalk-owner@lists.gpoguy.com]
On Behalf Of Graeme Welsh
Sent: Thursday, September 02, 2010 11:01 PM
To: gptalk@lists.gpoguy.com
Subject: RE: [gptalk] List dead/inactive Computer Accounts in Active
Directory.

u need to be careful with that

it will delete cluster virtual server names if you arent careful !

_____

From: gptalk-owner@lists.gpoguy.com [mailto:gptalk-owner@lists.gpoguy.com]
On Behalf Of Castillo, Daniel (Directory Services)
Sent: Friday, 3 September 2010 02:56 PM
To: gptalk@lists.gpoguy.com
Subject: RE: [gptalk] List dead/inactive Computer Accounts in Active
Directory.

OldCMP from joe is what you need J

http://www.joeware.net/freetools/tools/oldcmp/index.htm

~D

From: gptalk-owner@lists.gpoguy.com [mailto:gptalk-owner@lists.gpoguy.com]
On Behalf Of Graeme Welsh
Sent: Thursday, September 02, 2010 10:48 PM
To: gptalk@lists.gpoguy.com
Subject: RE: [gptalk] List dead/inactive Computer Accounts in Active
Directory.

u can write a script to query the pwdlastset attribute

i have one if u want to email me

_____

From: gptalk-owner@lists.gpoguy.com [mailto:gptalk-owner@lists.gpoguy.com]
On Behalf Of Ananth Rajagopal
Sent: Friday, 3 September 2010 02:46 PM
To: gptalk@lists.gpoguy.com
Subject: [gptalk] List dead/inactive Computer Accounts in Active Directory.

Hi all,

Is there a script to get a list of inactive/dead computer accounts, like say
in the last 30days or last 60 days or more....

saw some appliactions to find and delete or move, we just need to a list and
we can manually remove them..

thanks
Ananth.
--------------------------------------------------------------------------
Security Statement

The information contained in this electronic mail message is
privileged and confidential, and is intended only for use of
the addressee. If you are not the intended recipient, you are
hereby notified that any disclosure, reproduction, distribution
or other use of this communication is strictly prohibited.
Confidentiality and legal privilege attached to this communication
are not waived or lost by reason of mistaken delivery to you.
If you have received this communication in error, please notify
the sender by reply transmission and delete the message without
copying or disclosing it.

Disclaimer

Any views expressed in this communication are those of the
individual sender, except where the sender specifically states them
to be the view of NSW Businesslink Pty. Ltd. Except as required by
law, NSW Businesslink Pty. Ltd. does not represent, warrant and/or
guarantee that the integrity of this communication has been
maintained nor that the communication is free of errors, virus,
interception, inference or interference.
--------------------------------------------------------------------------

--------------------------------------------------------------------------
Security Statement

The information contained in this electronic mail message is
privileged and confidential, and is intended only for use of
the addressee. If you are not the intended recipient, you are
hereby notified that any disclosure, reproduction, distribution
or other use of this communication is strictly prohibited.
Confidentiality and legal privilege attached to this communication
are not waived or lost by reason of mistaken delivery to you.
If you have received this communication in error, please notify
the sender by reply transmission and delete the message without
copying or disclosing it.

Disclaimer

Any views expressed in this communication are those of the
individual sender, except where the sender specifically states them
to be the view of NSW Businesslink Pty. Ltd. Except as required by
law, NSW Businesslink Pty. Ltd. does not represent, warrant and/or
guarantee that the integrity of this communication has been
maintained nor that the communication is free of errors, virus,
interception, inference or interference.
--------------------------------------------------------------------------

RE: [gptalk] List dead/inactive Computer Accounts in Active Directory.

DaemonRoot — Fri, 03 Sep 2010 07:29:26 GMT

OldCMP from joe is what you need J

http://www.joeware.net/freetools/tools/oldcmp/index.htm

~D

From: gptalk-owner@lists.gpoguy.com [mailto:gptalk-owner@lists.gpoguy.com]
On Behalf Of Graeme Welsh
Sent: Thursday, September 02, 2010 10:48 PM
To: gptalk@lists.gpoguy.com
Subject: RE: [gptalk] List dead/inactive Computer Accounts in Active
Directory.

u can write a script to query the pwdlastset attribute

i have one if u want to email me

_____

From: gptalk-owner@lists.gpoguy.com [mailto:gptalk-owner@lists.gpoguy.com]
On Behalf Of Ananth Rajagopal
Sent: Friday, 3 September 2010 02:46 PM
To: gptalk@lists.gpoguy.com
Subject: [gptalk] List dead/inactive Computer Accounts in Active Directory.

Hi all,

Is there a script to get a list of inactive/dead computer accounts, like say
in the last 30days or last 60 days or more....

saw some appliactions to find and delete or move, we just need to a list and
we can manually remove them..

thanks
Ananth.
--------------------------------------------------------------------------
Security Statement

The information contained in this electronic mail message is
privileged and confidential, and is intended only for use of
the addressee. If you are not the intended recipient, you are
hereby notified that any disclosure, reproduction, distribution
or other use of this communication is strictly prohibited.
Confidentiality and legal privilege attached to this communication
are not waived or lost by reason of mistaken delivery to you.
If you have received this communication in error, please notify
the sender by reply transmission and delete the message without
copying or disclosing it.

Disclaimer

Any views expressed in this communication are those of the
individual sender, except where the sender specifically states them
to be the view of NSW Businesslink Pty. Ltd. Except as required by
law, NSW Businesslink Pty. Ltd. does not represent, warrant and/or
guarantee that the integrity of this communication has been
maintained nor that the communication is free of errors, virus,
interception, inference or interference.
--------------------------------------------------------------------------

[gptalk] List dead/inactive Computer Accounts in Active Directory.

ananthrg — Fri, 03 Sep 2010 07:10:36 GMT

Hi all,

Is there a script to get a list of inactive/dead computer accounts, like say
in the last 30days or last 60 days or more....

saw some appliactions to find and delete or move, we just need to a list and
we can manually remove them..

thanks
Ananth.