This setting determines whether the local file server will attempt to use Kerberos Service-For-User-To-Self (S4U2Self) functionality to obtain a network client principal’s claims from the client’s account domain. This setting should only be set to enabled if the file server is using user claims to control access to files, and if the file server will support client principals whose accounts may be in a domain which has client computers and domain controllers running a version of Windows prior to Windows 8.

For further information how claims based identity works go here – http://www.windowsecurity.com/articles-tutorials/authentication_and_encryption/Claims-Based-Identity-What-does-Mean-You-Part1.html

To configure this policy setting on a single Windows 8 computer, open the Local Group Policy Editor snap-in by typing gpedit.msc in the Apps search text box and then clicking the gpedit App icon.

• Go to Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options node.
• Double click Microsoft network server: Attempt S4U2Self to obtain claim information.
• Choose an option from the drop-down list.
• Click Apply and OK.

The default setting is Automatic, however there are instances when it is not defined.

When Enabled – the Windows file server will examine the access token of an authenticated network client principal and determine if claim information is present. If claims are not present the file server will then use the Kerberos S4U2Self feature to attempt to contact a Windows Server 2012 domain controller in the client’s account domain, and obtain a claims-enabled access token for the client principal. A claims-enabled token may be needed to access files or folders which have claim-based access control policy applied.

When Disabled – the Windows file server will not attempt to obtain a claim-enabled access token for the client principal.

Program Compatibility can automatically detect and fix common problems that prevent older programs from installing or running correctly. To start the troubleshooter wizard type Program Compatibility in the Start menu search text box and click the Run programs made for previous versions of Windows link. You can also open the troubleshooter by right-clicking a program’s icon or shortcut, and then clicking Troubleshoot compatibility.

It is recommended to run the program using administrative privileges and you can do this from the first page of the wizard through the Advanced link. The troubleshooter tries to detect all programs installed on your system and presents a list of these, including an option to browse for an unlisted program.

It is also recommended to not use the troubleshooter on older antivirus programs, disk utilities, or other system programs, because using outdated programs of this type might cause data loss or create a security risk.

Read more about applications compatibility here – http://www.windows7library.com/blog/util/applications-compatibility-part-1/

Action Center – Users are encouraged to use ActionCenter (the item with the flag image next to the Network image in the taskbar) to make sure that the machine firewall is on, the antivirus software is up to date, and the computer is set up to install updates automatically. A red cross on this image indicates that user attention is needed!

Windows Defender – Users are encouraged to use Windows Defender to prevent malicious software, like spyware or viruses, from infecting your computer. This program is not a replacement for anti-virus software and it can be downloaded for free from here – http://www.microsoft.com/en-us/download/windows-defender-details.aspx

User Account Control – User are encouraged to enable this function which prompts for users permission before installing software or opening certain kinds of programs that could potentially harm the computer or make it vulnerable to security threats.

Backup and Restore – It’s important that users back up their files and settings regularly so that if a virus corrupts data or have any kind of hardware failure, they can recover this data.

Windows Update – Users are encouraged to set the Windows Update feature to download and install the latest updates automatically.

Windows Firewall – Users are encouraged to configure Windows Firewall to help prevent hackers and unwanted software from gaining access to their computers through the Internet.

The above 6 points can be integrated into an organizational security checklist that is used when checking that all Windows workstations are compliant to security best practices.

As in previous versions of Windows the system monitors the inactivity of a logon session, and if the amount of inactivity exceeds the set limit, then the screen saver will run, locking down the session.

To configure this policy setting on a single Windows 8 computer, open the Local Group Policy Editor snap-in by typing gpedit.msc in the Apps search text box and then clicking the gpedit App icon.

• Go to Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options node.
• Double click Interactive logon: Machine inactivity limit in the right hand side pane.
• Enter the number of seconds (inactivity period) the machine will wait before locking down the session.
• Click Apply and OK.

The set value can range between 1 and 999 and the value 0 means that the machine will never be locked out which is the default setting. Values from 1 to 3 will be interpreted as 4.

To configure this policy setting on a single Windows 8 computer, open the Local Group Policy Editor snap-in by typing gpedit.msc in the Apps search text box and then clicking the gpedit App icon.

• Go to Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options node.
• Double click Interactive logon: Machine account threshold in the right hand side pane.
• Enter the desired number of invalid logon attempts.
• Click Apply and OK.

Note: This policy applies only to machines that have BitLocker enabled while, it is recommended that the appropriate recovery password backup policies are enabled.

Apart from stopping users creating new Microsoft accounts on your computer this policy setting also allows you to blocks users from switching a local account to a Microsoft account or connect a domain account to a Microsoft account. This would help you limit the use of Microsoft accounts on your computer. A Microsoft account is an email address and password you use to sign in to services like SkyDrive, your Windows Phone, Xbox LIVE, or Outlook.

In addition, you could select a more stringent setting where existing Microsoft account users will not be able to log on to Windows but use option with caution as you may not be able to manage your system if you disallow an account such as the administrator account to log on.

• To configure this policy setting on a single Windows 8 computer, open the Local Group Policy Editor snap-in by typing gpedit.msc in the Apps search text box and then clicking the gpedit App icon.
• Go to Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options node.
• Double click Accounts: Block Microsoft accounts in the right hand side pane.
• Select Users can’t add Microsoft accounts from the drop down list
• Click Apply and OK.

Note: Microsoft recommends the use Microsoft accounts when signing in to your Windows 8 PC. This gives you the ability to connect to free online storage, mobile entertainment, thousands of apps in the Windows Store, and connecting your devices and accounts seamlessly.

PS C:\>$events = get-eventlog -logname system -newest 1000

PS C:\>$events | group-object -property source -noelement | sort-object -property

You can start by getting the 1,000 most recent entries from the System event log and store the list in a $events variable. Then, use the pipeline operator to send the events in $events to the Group-Object cmdlet, which groups the entries by the value of the Source property.

A second pipeline operator will allow you to send the grouped events to the Sort-Object cmdlet, which sorts the list in descending order, so the most frequently appearing source is listed first.

A good article series by Mitch Tullock about Data Tiering Strategies is worth reading as the articles include practical examples that will help you understand better data tiering best practices and concepts.

Read more here – http://www.windowsnetworking.com/articles-tutorials/common/data-tiering-strategies.html

A full list of new features and changes in Windows Server 2012 is provided at the link below. The list include changes in Active Directory Certificate Services (AD CS), Active Directory Domain Services (AD DS), Active Directory Rights Management Services (AD RMS), BitLocker, BranchCache, Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS) services, Failover clustering, File Server Resource Manager, Group Policy, Hyper-V functionality, IP Address Management (IPAM), Kerberos authentication, Managed Service Accounts, New networking technologies, Remote Desktop Services, Security auditing, Server Manager, Smart cards, Schannel SSP, Windows Deployment Services, and Windows PowerShell 3.0.

Check what’s new in Windows Server 2012 here – http://technet.microsoft.com/en-us/library/hh831769.aspx

Although, getting your local operating system edition is pretty straightforward from Windows 8 GUI (PC info link under Windows 8 Settings), this PowerShell cmdlet becomes handy when you need that information from Windows images residing on your local computer. In fact, you can specify the path of an offline Windows image to get the target OS edition as shown below:

To display the target edition of a Windows image residing at c:\image at the PowerShell prompt type:

Get-WindowsEdition  –Path c:\image  –Target

To display the name of the current edition of the running Windows Operating system on your local computer at the PowerShell prompt type:

Get-WindowsEdition  –Online

Note, to open the Windows PowerShell console with elevated permissions, right click the Windows PowerShell app shortcut and choose Run as Administrator.

I didn’t really like the reporting features on the server so with a bit of PowerShell – I extended it:

Here is the script:

========================================================================

Add-PSSnapin Quest.ActiveRoles.ADManagement

$Users = Get-EventLog -ComputerName SERVERNAME -LogName System -Source ntfs | where {$_.eventID -eq 36} |  Select-Object Username -Unique | Sort-Object Username

$Directory=”DIRECTORY”

$emailFrom = “SERVICE ACCOUNT”

$subject = “Your Largest Files”

$smtpServer = “MAILSERVER”

Foreach ($User in $Users) {

$emailto = get-qaduser $Name | Select-Object email | out-string

$Name = $User.UserName.TrimStart(“DOMAIN\”)

$body = “You are receiving this email because your U drive is nearly full. The attached document ($Name.Txt) lists your 25 largest files. If these files are not needed, please delete them and empty your Recycle Bin. For additional ways to regain space, please see the attached PowerPoint. <enter> ”

Get-ChildItem $Directory -recurse -file | ? {$($_ | Get-Acl).Owner -match $name } |

Sort-Object length -Descending |

Select-Object Directory,Name -first 25 |

format-table -AutoSize |

Out-String -Width 4096 |

Out-file “.\$name.txt”

Send-MailMessage -to $emailTo -from $emailFrom -Subject $subject -Body $body -Attachments “.\$name.txt”, “.\Managing Your Files.pptx” -SmtpServer $smtpServer

 }

=======================================================================

The end result is that any user that has hit their quota warning will get an automated email listing their top 25 files (sorted by size)!! Pretty nifty!

However, AD is a bit pokey in how this searching is done. You normally have to use the first name or the username.  The script below will prompt you for either the first, last, or user name of the user. It will then return all computers matching that description.

===============================================================

$User= read-host “What is the firstname,last name, or Username of the user?”

Get-QADComputer -ManagedBy (Get-QADUser $User) | Format-Table Name,Managedby

================================================================

Here is the output:

The tool is called Win+X Menu Editor and it is accessible by pressing the keyboard keys ‘Windows logo’  and X simultaneously (Win+X). It is also accessible through a mouse right-click at the bottom left corner of the desktop.  The tool is available for both x86 and x64 Windows systems and can be downloaded from here – http://winaero.com/comment.php?comment.news.30

Group Policy Files:

1. Normally, an update will create a file if it doesn’t exist and replace it if it does exist. In Files, this is not the case. An Update simply updates the file attributes (not the file itself). If you wish to create the file if it doesn’t exist and to replace it if it does exist, choose the replace option.
2. To copy all of the files in a single folder, ensure that your source ends with a \* and that your destination ends with a \

 Group Policy Printers:

1. Delete: To prevent computers from generating Event Log errors, set preference to Apply Once and Do Not Reapply. Also configure a Item Level Target to the printer’s location in the registry. This can either be HKLM or HKCU.

Third party software vendors took the opportunity to develop utilities to bring back the Start Menu.  I would like to share with you three of these tools which I briefly tested on my Windows 8 virtual machine. These are ViStart, Start8, and Windows 8 Tweaker.

Windows 8 Tweaker is a free utility that allows you to get Windows 7 styled Start Menu on Windows 8. However, the utility did not function as expected on my Windows 8 Enterprise virtual machine. SuperUtil.com website claims that the utility works on both x86 and x64 versions of Microsoft Windows 8!

ViStart is free tool and it achieves the intended purpose but I could not locate where to configure additional features while, the author allowed the community to create various start menu skins which you can download and install separately. The search functionality may not work as expected and  make sure you are not lured to install third-party software when installing this tool!

Start8 is a feature rich and stable utility but it comes with a small cost. It is worth the money, afterall it is a minimal cost. The search functionality works as good as Windows 7 and you should be able to find support from the vendor.

Download and try these tools from here – ViStart, Start8, or Windows 8 Tweaker.

To achieve this, you can use this script. You will need the Quest AD PowerShell Cmdlets.

==========================================================================

$SourceComputer= read-host “What is the source computer?”

$DestinationComputer= read-host “What is the destination computer?”

$Groups= Get-QADComputer $SourceComputer | Get-QADMemberof

Foreach ($Group in $Groups) {

Add-QADGroupMember $Group $DestinationComputer }

==========================================================================

LSDOU: Local, Site, Organizational Unit (OU). That is the order in which Group Policy applies. All local GPOs are applied first; this is followed by any applicable ones linked to a site. Next, GPOs linked at the domain are applied. Finally, GPOs linked to each OU are processed. These GPOs are applied in a top down approach. Higher OUs or levels such as a site or domain are applied first. Let’s look at a sample environment.

We have a computer named BR-01 that is in the Brunswick OU. Our domain only has a single site with no GPOs linked to it.  This computer would apply its local policy, Default Domain Policy, Domain Computers GPO, and finally the Brunswick GPO.

To simplify processing, we are going to enable “Turn off Local Group Policy Objects processing” in our Default Domain Policy.

Now, BR-01 will apply the Default Domain Policy, Domain Computers GPO, and finally the Brunswick GPO. We have a second computer named GA-01 in the Glynn Academy OU. Because it inherits settings from the Default Domain Policy, it will not apply Local GPOs as well. It will apply the Default Domain Policy, Domain Computers GPO, Brunswick GPO, and the Glynn Academy GPO.

A junior administrator edits our Brunswick GPO and sets “Turn off Local Group Policy Objects processing” to disabled.

The computer in the Glynn Academy OU (GA-01) will now process the Default Domain Policy first. This policy will say “Hey – Turn off Local GPO processing!”.  The computer will then process the Domain Computers GPO (which doesn’t have this setting configured). Next, it will process the Brunswick GPO. This policy will say “Hey – Turn on Local GPO processing!”. Because this GPO is closer to GA-01 than the Default Domain Policy, this policy will win (and “Turn off Local GPO processing will be set to disabled.)

If we configured the Glynn Academy GPO to contradict the Brunswick GPO, the Glynn Academy GPO would win because it is the closet OU to the computer.

This is all dandy except we still have a problem. We want “Turn off Local GPO processing” enabled for the entire domain (no matter what), and our junior administrator specifically ignored that. After talking to him, he agrees not to configure the “Turn off Local GPO processing” setting.

Blocked Inheritance

One day, you are looking around in the Group Policy Management Console and see this:

Someone has set Block Inheritance on the Brunswick OU! Because Block Inheritance is set, any normal GPO above the Brunswick OU will be ignored. Our default domain policy, which configures the “Turn off Local GPO processing” setting, will no longer be processed by computers at the Brunswick OU or below.

If we read the details of that setting, we see that if we “do not configure this policy setting, local GPOs continue to be applied.” By enabling Block Inheritance, our junior administrator was able to indirectly set “Turn off Local GPO processing” to disabled by setting it back to Not Configured.

Enforced

Lucky for us, Microsoft planned for junior administrators that HR won’t fire. They gave us the ability to enforce a GPO!

When enforcement is set on the Default Domain Policy, computers in the Domain Computers OU (and below) will apply the GPO even if Block Inheritance is enabled! If our junior administrator configures the Brunswick GPO and enforces it, the Default Domain Policy will still apply. When two policies are enforced, the highest policy will always win! This allows top level administrators to configure global settings without having to worry about those settings being overwritten.

Best Practice

Being heading off to enforce GPOs and block OU inheritance, stick with me for a few more minutes. As a general practice, do not enforce GPOs or block OU inheritance if you can help it. When you do either of these actions, you are adding complexity to your environment. And as every IT administrator knows, complexity = interrupted vacation time!

If all of this enabling and disabling “Turn Off Local GPO processing” was more confusing than Inception, check out 10 Ways to Troubleshoot Group Policy.

But something with UAC must have changed between Windows 7 and Windows 8. Suddenly, I seem to be hearing a lot more prompts. It may be because I am constantly using Server Manager and Hyper-V from my workstation but either way, the sound is now driving me crazy. The steps below show how to simply turn off that sound notification (or to change it to that pleasant new Office notification sound).

1. Search for “Change System Sound” or open up the Sound control panel applet.

2. Scroll all of the way day to Windows User Account Control. For me, it was right above the File Explorer Section. Change it to (None) or another more pleasant sound.

Enjoy the sound of silence!

Outlook, by default, sorts all email by date received. If you store email in your Inbox or are frequently CC’d, there is a better way of sorting! To make his life easier, Abbott clicked on the Arranged By: Date button  and selected Conversation.

 Outlook saw that all of his emails from Costello were in the same conversation and automatically grouped them together! Instead of 23 separate messages, Outlook combined them into 1 and put the newest one on top! He can even click the down arrow (next to the email subject) to see all of the previous messages individually.

 Now Abbott never overlooks a message, replies to an older one by accident, and can start explaining who is on second!

Start with the Scope

• The most common issue seen with Group Policy is a setting not being applied. The first place to check is the Scope Tab on the Group Policy Object (GPO). If you are configuring a computer side setting, make sure the GPO is linked to the Organization Unit (OU) that contains the computer. If the GPO configures a user side setting, it needs to be linked to the OU containing the correct user. Remember, GPOs cannot be linked to an OU that just contains security groups.
• Next, check the security filtering. Make sure that the computers or users needing the policy are in a group that is specified here. Remember that domain users includes all users, domain computers includes all computer, and authenticated users includes both users and computer.
• Some GPOs make use of WMI filters. These filters can dynamically apply GPOs based on a host of factors. You want a GPO to apply if a device is attached, use WMI. However, that WMI filter has to evaluate to True for the object processing the GPO. This means that if you have a WMI checking a user only setting, you can’t scope your GPO only to computers. You can use the WMI validator to check the status of a WMI filter.

This GPO is linked to an OU named Domain Sites, applies to Authenticated Users, and doesn’t have a WMI Filter linked to it.

Dive into Delegation

• In order for a GPO to apply, the object (a user or a computer) has to have two GPO permissions. It must have Read and Apply Group Policy permissions. By default, an object added to the scope tab receives both of these permissions. However, deny permission on the delegation tab would take precedence.

This GPO does not have any Deny permissions set (which show as Advanced settings).

Learn Your Links (and also Loopback)

• GPOs process is a very specific order. The acronym, LSDOU, shows that Local GPOs apply first. This is followed by Site, Domain, and finally OU GPOs. In a nutshell, the GPO closest to the object applies last. If you have a GPO linked at the domain that enables Offline Files and a Junior Admin disabled Offline files at the OU level, his GPO wins.
• When a GPO is created, it lives in the Group Policy Objects container. When you link a GPO to an OU, you are merely creating a shortcut. These links can be enabled or disabled very easily. In the picture below, the Configuration GPO link is disabled. Notice how the link arrow is greyed instead of black (like the Default Domain Policy).

• GPOs can also be set to Enforced. An Enforced GPO appears with a lock of the link icon. A GPO upstream (one linked to a higher OU or the domain) that is enforced can cause you problems. For example, if the Default Domain Policy was enforced, every setting in it would apply to every object in the domain. It does not matter if another GPO is linked an OU and is enforced. With enforcement, the highest GPO wins. 
• The final piece of trickery with Links is the Block Inheritance setting. When an OU is set to Block Inheritance, all GPOs (except those enforced) linked above that OU are ignored. In the example below, the Domain Sites OU will not process the Default Domain Policy.
• Honestly, I love Loopback Policy Processing. With Loopback, I can take a User Side Setting (like setting the homepage in IE) and apply it to a group of computers! However, loopback requires both the User and Computer objects to be added to the scope tab.

 Read Carefully

• Finally, make sure that the GPO is doing what you intend for it to do. When a setting says “Enable Turn Off Audio Mode”, it is very easy to get confused. Read carefully over any GPO descriptions when configuring your GPO.

 This post just covered the 10 most common problems with a GPO not applying. If you are still having issues (or if you have a tip to add), just let us know in the comments section!