Powershell: Test Domain Controller Certificates

When replacing Domain Controller certificates for Active Directory with a valid 3rd party certificate I use this script to quickly test my domain and all my domain controllers directly to make sure they are serving out the certificate.

### -----------------------------------------------------------------
### Written by Matt Brown
###
### Description: This Grabs a list of all the Domain Controllers and tries to connect to them via SSL over Port 636
###
### -----------------------------------------------------------------

$DCList = @(
"dc1.domain.com",
"dc2.domain.com",
"dc3.domain.com",
"dc4.domain.com",
"domain.com"
)

$DCList | foreach {
 $DC = $_
 $LDAPS = [ADSI]"LDAP://$($DC):636"
 try {
  $Connection = [adsi]($LDAPS)
 } Catch {
 }
 if ($Connection.Path) {
  Write-Host "Active Directory server correctly configured for SSL, test connection to $($LDAPS.Path) completed." -foregroundcolor Green
 } else {
  Write-Host "Active Directory server not configured for SSL, test connection to LDAP://$($DC):636 did not work." -ForegroundColor Yellow
 }
}

PowerShell: Add Computer to Domain directly to OU

Here's a PowerShell script to add computers to the Domain to a specific OU (Organizational Unit) and allows you to select the OU Location. I did not use the AD modules as they are not pre-installed on most desktops, even though it would of been much easier to write with them.

### -----------------------------------------------------------------
### Written by Matt Brown
### - http://universitytechnology.blogspot.com/
### PowerShell script to search OU Structure and add computer to domain
###
### -----------------------------------------------------------------

Param(
 $user = $(Get-Credential -Credential "domain\user"), # Prompts user for credentials
 $filter = "(objectClass=organizationalUnit)",  # Do not change
 $ouLocatoin = "LDAP://OU=Departments,DC=domain,DC=com", # Starting Organizational Unit
 $mydomain = "domain.com",    # FQDN of Domain
 $whatif = "-WhatIf"      # change to "" to actually run
)

#--------------------------------------------------------------------
Function GetSecurePass ($SecurePassword) {
  $Ptr = [System.Runtime.InteropServices.Marshal]::SecureStringToCoTaskMemUnicode($SecurePassword)
  $password = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($Ptr)
  [System.Runtime.InteropServices.Marshal]::ZeroFreeCoTaskMemUnicode($Ptr)
  $password
}   
#--------------------------------------------------------------------
Function AddTabs($mystring,[int]$numtabs=5) {
 for([int]$len = (([string]$mystring).length / 8.9); $len -lt $numtabs; $len++) { $mystring += "`t" }
 return $mystring
}
#--------------------------------------------------------------------
Function SelectOU($dn,$up) {

 Clear-Host
 Write-Host "### -----------------------------------------------------------------" -ForegroundColor Green
 Write-Host "### Select OU and Add Computer to Domain                             " -ForegroundColor Green
 Write-Host "### Written by Matt Brown                                            " -ForegroundColor Green
 Write-Host "###  - http://universitytechnology.blogspot.com/                     " -ForegroundColor Green
 Write-Host "### PowerShell v.2 (Windows 7 / Server 2008 R2)                      " -ForegroundColor Green
 Write-Host "### -----------------------------------------------------------------" -ForegroundColor Green
 Write-Host "`nThe Number in the Select column adds the computer to the OU, where the List column will list Sub-OU's of the OU." -ForegroundColor Green
 Write-Host $dn
 Write-Host $up
 Write-Host "`n"
 Write-Host ("List Of " + (([string]$dn).split("/"))[2]) -ForegroundColor Yellow
 Write-Host " Select  List`tOU"
 Write-Host " ----------------------------------------------------"
 Write-Host "   0`t  L0   <- Up a Level"
 #$ou = Get-ADOrganizationalUnit -SearchBase $dn -SearchScope OneLevel -Filter 'Name -like "*"'
 
 $auth = [System.DirectoryServices.AuthenticationTypes]::FastBind
 $de = New-Object System.DirectoryServices.DirectoryEntry($dn,$user.UserName,(GetSecurePass $user.Password),$auth)
 $ds = New-Object system.DirectoryServices.DirectorySearcher($de,$filter)
 $ds.SearchScope = "OneLevel"
 $ou=($ds.Findall()) | Sort-Object -Property Name
 $sel = $null
 $selectList = @("0","L0","C")
 
 for($x=1; $ou.count -ge $x; $x++) {
  # output line, decide if it needs to be in yellow or white
  $selectList += $x
  $selectList += ("L"+$x)
  $outname = (AddTabs ($ou[$x-1].Properties['name']))
  $lineout = ("   " + $x + "`t  " + ("L"+$x) + "`t" + $outname)
  if($x % 2 -eq 0) {
   Write-Host $lineout -BackgroundColor White -ForegroundColor Black
  } else { 
   Write-Host $lineout -BackgroundColor Gray -ForegroundColor Black
  }
 }
 Write-Host "   C`t  C    -- Cancel & Exit"
 Write-Host "`n"
 while($selectList -notcontains $sel) {
  $sel = Read-Host "   Select OU or List Sub-OUs"
 }
 
 ## Figure out what the user selected
 if ( $sel[0] -eq "L") {
  ## Users Selected List Mode
  $y = ($sel.split("Ll")[1])
  if([int]$y -eq 0) { 
   $newup = ("LDAP://" + ($up -replace (($up -split ",")[0] + ",")))
   SelectOU $up $newup
  } else { 
   SelectOU $ou[$y-1].Properties['adspath'] $dn 
  }
 } elseif ($sel -eq "c") {
  ## User Selected Cancel
  return $false
 } else {
  ## User Selected the OU
  if([int]$sel -eq 0) {
   return ([string]$dn).split("//")[2] 
  } elseif([int]$sel -le [int]$ou.count)  { 
   return $ou[$sel-1].Properties['distinguishedname']
  } else { 
   SelectOU $dn $up 
  }
  
 }
} 
#--------------------------------------------------------------------

#--------------------------------------------------------------------
## Main
#--------------------------------------------------------------------

## Select / View OU
while($ou = (SelectOU $ouLocatoin $ouLocatoin)) {
 ## Add to Domain
 Write-Host ("  Will add computer (" + $env:computername + ") to:") -ForegroundColor Yellow
 Write-Host ("    " + $ou + "`n") -ForegroundColor Green
 $continue = Read-Host "  Continue (y | n)"
 if($continue -eq "y") {
  ## Now Add the Computer to the Domain
  add-computer -domainname $mydomain -OUPath $ou -Credential $user $whatif
  break
 } 
}

Powershell: Get AD Users from Group with Email Address

Here's a handy script I use to Generate a list of all "Users" with email addresses within a group. It's a recursive function so it will dig through nested groups to make sure all users are picked up. It does not do checking for duplicates as I normally just open the output in Excel and run the Remove Duplicates command.

### -----------------------------------------------------------------
### Written by Matt Brown
###
### Description: Get Username / Email from All Users in AD Group
###
### Requires: ActiveDirectory Module
### -----------------------------------------------------------------

Import-Module ActiveDirectory
$group = "Employees"
$outfile = ("c:\" + $group + "_output.csv")

function RecurseMyGroup($group,$outfile) {

 Write-Host ("Checking Group " + $group)
 (Get-ADGroup $group -properties members).members | foreach {
  $object = Get-ADObject $_ -Properties mail,samaccountname
  if($object.objectClass -eq "Group") {
   RecurseMyGroup $object.DistinguishedName $outfile
  } else {
   ($object.samaccountname + "," + $object.mail) | Out-File -FilePath $outfile -Append
  }
 }
 
}

RecurseMyGroup $group $outfile

Remove Terminated User from GAL - Powershell

Quick Powershell script to remove disabled users from the Exchange 2007 Global Address List (GAL) without deleting the account / mailbox. This uses the Quest Active Roles powershell extensions for Active Directory.

### -----------------------------------------------------------------
### Written by Matt Brown
###
### Name: Remove Terminated Employees from GAL
###
### Version: v1.0, 02/2010
###
### Info: This script Finds Disabled Users and removes them from the GAL
###
### Requires: 1. Quest Powershell extensions for AD
###
### Note: If you are using Resource Mailboxes that are disabled you
###   will want to directly specify your staff OU.
### -----------------------------------------------------------------
$mydomain = 'domain.company.com/Staff'
get-qaduser -SearchRoot $mydomain -SizeLimit 3000 -Enabled:$false | set-qaduser -objectAttributes @{showinaddressbook=@()}

Powershell - Terminate Employee in Active Directory

Here's a quick little script to terminate an employee in Active Directory. I'm using the quest AD Powershell command-lets in this script. This uses powershell to disable the AD Account, Change the AD password to a random password, set the description of the account and remove all the group membership from the account.

Input text file looks like this:
empID
08791
08792

Powershell Script:

# ---------------------------
# Add Quest AD Snapin
# ---------------------------
if(-not (Get-PSSnapin | where { $_.Name -match 'quest.activeroles.admanagement' })) {
  add-PSSnapin quest.activeroles.admanagement
}
# Load Assembly so we can easily generate a random password.[Reflection.Assembly]::LoadWithPartialName(”System.Web”)

$s = get-credential
connect-qadservice -credential $s -Service "mydomain.com"

Import-Csv "employeeIDList.txt" | foreach {
  $user = get-QADObject -SearchRoot 'mydomain.com/People' -Type User -ldapFilter "(employeeID=$_.empID)"
  if($user) {
    write-host "Disabling " $user.samAccountName
    # generate random password
    $ranpassword = [System.Web.Security.Membership]::GeneratePassword(10,2)
    # Disable User Account
    $user | Disable-QADUser
    # Set User's Description to Terminated and set a random password
    $user | set-QADUser -Description "Terminated" -UserPassword $ranpassword
    # Remove User from all Groups (does not include domain users)
    $user.memberof | Get-QADGroup | Remove-QADGroupMember -member $user
    # Move user to Terminated OU
    $user | Move-QADUser -NewParentContainer 'mydomain.com/Terminated'
  } else {
    write-host $_.empID "not found in Active Directory"
  }
  $user = $False
}

Powershell: Monitor IIS Application Pool or Site

We have an exchange IIS Application Pool stopping every so often because of some Entourage client problems. It would cause the Application Pool to stop and therefore break owa access, which was a problem.

So while we are working with Microsoft on a permanent solution I quickly put together a powershell script to run every 30 seconds and check the state of the application pool. If the MSExchangeOWAAppPool is stopped, then the script starts it. It uses the IIS Provider Tools snapin for powershell.

### -----------------------------------------------
### Written by Matt Brown - 12:46 PM 11/3/2008
### Powershell script to check MSExchangeOWAAppPool
### Requires IIS Administration Provider Tools
### -----------------------------------------------

### Make sure Snapin is loaded
$add = 1
get-PSSnapin * | foreach {
 if($_.Name -match 'IIsProviderSnapIn') {
  $add = 0
 }
}
if($add) {
 add-PSSnapin IIsProviderSnapIn
}

#######################################
######## Check AppPool State ##########
#######################################
Write-Host "`n"
Write-Host "#####################################"
Write-Host "Running check on MSExchangeOWAAppPool"
Write-Host "#####################################"
while($true) {

 $state = Get-WebItemState IIS:\AppPools\MSExchangeOWAAppPool
 if($state -eq "Stopped") {
  Start-WebItem IIS:\AppPools\MSExchangeOWAAppPool
  $now = Get-Date –f "yyyy-MM-dd HH:mm:ss"
  $MsgBody = "CAS01 AppPool needed a restart " + $now
  Write-Host $MsgBody
 }
 Start-Sleep -s 30
}

Powershell: New Active Directory Objects Report

Here's a quick Powershell script to send you a report of the most recent additions to Active Directory.

### --------------------------------------------
### Written by Matt Brown - 12:13 PM 10/22/2008
###
### AD Report on new objects created in the
### last 24 hours
### Requires Quest Powershell extenstions for AD
### --------------------------------------------

#######################################
####### Load Required Snapin's ########
#######################################
## Add Quest AD Snapin Tool
$addAD = 1
get-PSSnapin * | foreach {
  if($_.Name -match 'quest.activeroles.admanagement') {
    $addAD = 0
  }
}
if($addAD) { add-PSSnapin quest.activeroles.admanagement }

#######################################
########### Setup Log File ############
#######################################
$Today=get-date
$filename="NewADObjects_"+($Today.year).ToString()+"_"
$filename+=($Today.month).ToString()+"_"+($Today.day).ToString()+".txt"

#######################################
### Get AD Formated Date 24 hrs ago ###
#######################################
$currentDate = [System.DateTime]::Now
$currentDateUtc = $currentDate.ToUniversalTime()
$creationDate = $currentDateUtc.AddHours(- 24)
$YYYY = $creationDate.Year.ToString()
$MM = $creationDate.Month.ToString();
if ($MM.Length -eq 1) {$MM="0" + $MM};
$DD = $creationDate.Day.ToString();
if ($DD.Length -eq 1) {$DD="0" + $DD};
$creationDateStr = $YYYY + $MM + $DD + '000000.0Z'

$MsgBody = "###################`n"
$MsgBody += " New AD Objects`n"
$MsgBody += "###################`n`n"

write-host $creationDateStr
$newobjects = Get-QADObject -ldapfilter "(whenCreated>=$creationDateStr)" 
                -SizeLimit 30000 | sort type

if($newobjects) {
  $newobjects | out-file $filename
  $type = ""
  $newobjects | foreach {
    if($_.Type -eq $type) {
      $MsgBody += " " + $_.Name + "`n"
    } else {
      $type = $_.Type
      $MsgBody += "`nNew " + $_.Type + "(s)`n"
      $MsgBody += "===================================`n"
      $MsgBody += " " + $_.Name + "`n"
    }
  }
}

#######################################
############ Email Report #############
#######################################

function SendEmail($body) {
  $message = New-Object System.Net.Mail.MailMessage
  $message.From = "myemail@domain.com"
  $message.To.Add("myeamail@domain.com")
  $message.Subject = "Active Directory - new object report"
  $message.Body = $body

  $smtp = New-Object System.net.Mail.SmtpClient
  $smtp.Host = "smtp.mailserver.com"
  $smtp.UseDefaultCredentials = $true
  $smtp.Send($message)
}

SendEmail($MsgBody)

Update GAL Display Name - powershell

We recently decided to change on how our Global Address list is displayed from using the format to the , format.

Powershell made quick work of this task and took about 10 minutes with 2500 users. Here's the script.

###=====================================
### Update Exchange Global Address List Display
### - Matt Brown, 2008
###=====================================
$Users = Get-User -ResultSize unlimited |
 where {
   ($_.RecipientTypeDetails -eq "MailUser")
   -or ($_.RecipientTypeDetails -eq "UserMailbox")
 }

ForEach ($Person in $Users) {
   $NewName = $User.LastName + ", "
   $NewName += $User.FirstName + " "
   $NewName += $user.Initials
  
   # get rid of trailing spaces caused by blank initials
   $NewName = $NewName.Trim()
   Set-User $User -Name $NewName -DisplayName $NewName
   $NewName = $Null
}

Don't forget to update the OAB after this is done so your outlook clients will update.

Active Directory - Removing SID History

I use a couple of great tools from joeware.net to remove a SID from a users SID History. I had a problem where the wrong user was mapped over during a migration when we were colasping multiple domains into one.

The 2 tools I used from joeware were adfind and admod, both free.

adfind -h IT-DC01 -default -f sAMAccountName=jackuser sidhistory

dn:CN=Jack User,OU=Employees,OU=People,DC=mydomain,DC=edu
>sIDHistory: S-1-5-23-4189335451-1674751469-1023141700-3124
>sIDHistory: S-1-5-23-4217985222-169311000002009-1212232504-146495

This listed the current SID's in the history of the users account. After deciding which one I wanted to removie I used admod to remove it.

admod -b "CN=Jack User,OU=Employees,OU=People,DC=mydomain,DC=edu"
sidhistory:-:S-1-5-23-4217985222-1000002009-1212232504-146495

Sid Removed and now where ready to take that SID and add it to the correct user account.

admod -b "CN=Jackie User,OU=Employees,OU=People,DC=mydomain,DC=edu"
sidhistory:+:S-1-5-23-4217985222-1000002009-1212232504-146495

Note: I found out after this post that this option does not work with SIDHistory. You will need to use the VB Script or ADMT to migrate the sid from the source domain.

ADMT Migrating Computers from 2003 to 2008

In order to migrate computers from a 2000 or 2003 Active Directory Domain to a 2008 Active Directory Domain you need to set a group policy in your 2008 domain that allows cryptography algorithms compatible with Windows NT 4.0. Otherwise, the migration will bring the computer account over but will not change the domain the computer is in.

You can find this Group Policy setting here:
In the Group Policy Management Editor console, expand Computer Configuration, expand Policies, expand Administrative Templates, expand System, click Net Logon, and then double-click Allow cryptography algorithms compatible with Windows NT 4.0. Based on (http://support.microsoft.com/kb/942564)

Another thing I found was that that Target Domain Account you are using to transfer the computers over need to have local admin privileges on the systems you are migrating from the source domain and the ADMT System needs to have access to the computer. (IE: Firewall opened for at least that machine).

Active Directory Install - Server 2008

Here are my basic steps for an Active Directory Installation using Server 2008. This is of course after a clean install of Windows 2008 Server and running Windows updates. I also like to turn off IPv6 in the networking and create a changelog.txt file in the all users -> startup folder.

Step 1. Configure Network
--- Start configureNics.bat ---
REM *** Configure IP Address
netsh interface ip set address name="Local Area Connection" static 10.0.0.10 255.255.255.0 10.0.0.1 1

REM *** Configure DNS Server (Point to Domain Controller)
netsh interface ip set dns "Local Area Connection" static 10.0.0.10

REM *** Configure WINS Server
netsh interface ip set wins "Local Area Connection" static 10.0.0.9
--- end configureNics.bat ---


Step 2. Rename Server
I then rename the Server to the name of my DC, usually somthing like DC01 or IT-DC01 as I don't like to rename domain controllers after the domain has been created.
--- Start renamecomputer.bat ---
@ECHO OFF
REM - Matt Brown 2008
REM ---------------------------------------------------
REM Rename Domain Controller
REM ---------------------------------------------------
ECHO

ECHO Please set your new computer name:
SET /P newpcname=[New Computer Name]
ECHO Renaming computer from %computername% to %newpcname%
netdom.exe renamecomputer %computername% /newname:%newpcname% /FORCE /VERBOSE
--- END renamecomputer.bat ---

Step 3. Prep Domain Controller
--- START prepdc.bat ---
ECHO *** Install .NET Framework
ServerManagerCmd -i NET-Framework-Core

ECHO *** Install Local and Remote Administration Tools
ServerManagerCmd -i RSAT-ADDS
--- END prepdc.bat ---

Reboot Server

Step 4. Prep Domain Controller Part 2
--- START prepdc-part2.bat ---
ECHO *** Install Local and Remote Administration Tools
ServerManagerCmd -i RSAT-ADDC
ServerManagerCmd -i RSAT-ADLDS
ServerManagerCmd -i RSAT-DNS-Server
ServerManagerCmd -i RSAT-WINS
ServerManagerCmd -i GPMC
ServerManagerCmd -i PowerShell

ECHO *** Install DNS Role
ServerManagerCmd -i DNS
--- END prepdc-part2.bat ---

Step 5. Install DC
--- START InstallDC.bat (run from c:\)---
ECHO *** Install Active Directory Domain Services Role
ServerManagerCmd -i ADDS-Domain-Controller
DCPromo /Answer:"C:\ad_setup.txt"
--- END InstallDC.bat ---

--- START ad_setup.txt ---
[DCInstall]
; New forest promotion
ReplicaOrNewDomain=Domain
NewDomain=Forest
NewDomainDNSName=corp.com
ForestLevel=2
DomainNetbiosName=CORP
DomainLevel=2
InstallDNS=Yes
ConfirmGc=Yes
Sitename=MainSite-001
CreateDNSDelegation=No
DatabasePath="C:\Windows\NTDS"
LogPath="C:\Windows\NTDS"
SYSVOLPath="C:\Windows\SYSVOL"
; Set SafeModeAdminPassword to the correct value prior to using the unattend file
SafeModeAdminPassword=
; Run-time flags (optional)
; RebootOnCompletion=Yes
--- END ad_setup.txt ---

Reboot Server, you now have a functioning Domain Controller.

Create Active Directory Users with Powershell

Here's a quick little script I wrote to create users in Active Directory using Powershell and the Quest extensions for AD.

---- Start Script CreateUsers.ps1 ----
### -----------------------------------------------------------------
### Written by Matt Brown - 12:13 PM 9/17/2008
###
### Powershell script requires a text file with the following fields
### Name,sAMAccountName,First,Last
### Brad,Bradley.J.Pitt,Brad,Pitt
###
### Requires Quest Powershell extenstions for AD
### -----------------------------------------------------------------

# Open the File of User Names and Put it in the Pipeline
Import-Csv "NewAccounts.txt" |

# Loop Through the CSV File, creating accounts
Foreach {
# Set Vars
$StrName = $_.Name
$StrSAMAccountName = $_.sAMAccountName
$StrFirst = $_.First
$StrLast = $_.Last

# Send vars to screen (1 line below)
write-Host "Creating User Account: $StrSAMAccountName - $StrName - $StrFirst - $StrLast"

# Create Account (1 line below)
New-QADUser -ParentContainer "OU=NewAccounts,dc=mydomain,dc=com" -Name $StrName -FirstName $StrFirst -LastName $StrLast -SamAccountName $StrSAMAccountName -DisplayName $StrName -Description "Training Account." -UserPassword 'P@ssword' -UserPrincipalName "$StrSAMAccountName@domain.edu" | Enable-QADUser
}
---- End Script CreateUsers.ps1 ----

And below is the text file used to create the accounts. Run this using the Quest Powershell extensions for AD and you'll be good to go.

---- Start NewAccounts.txt ----

Name,sAMAccountName,First,Last
Brad,BradleyJamesPitt,Brad,Pitt

---- End NewAccounts.txt ----

Active Directory - Restore Deleted Item (AD)

I recently had to restore an object (user account) in Active Directory that was accidentally deleted. The AdRestore Tool makes this very easy and painless.

Download it here AdRestore:
http://technet.microsoft.com/en-us/sysinternals/bb963906.aspx

Once you download and install it... open up the cmd prompt and type in:
c:\> adrestore -r username
or
c:\> adrestore -r objectname

In my case I needed to restore a useraccount called mbrown. So I ran c:\adrestore -r mbrown the search returned 5 accounts that started with mbrown, I choose no to all but the one I wanted to restore, choose yes to the correct mbrown account and presto... the account was back in the original OU.

Afterwards, I did have to go in and refresh the OU and enable the account... but at least the SID was correct.

Roaming Profiles... just not in the computer labs - part 2

I just figured out a way to have dynamic roaming profiles. Works perfect with both Active Directory on Windows Server 2003 and AD on Windows Server 2008.

Say we have a user bob. Here are three senarios for bob:

• Senario #1: When bob logs into a computer in his office computer we want him to get his roaming profile that has to do with his job.
• Senario #2: When bob logs into a computer in the Computer Sciense department we want him to get his roaming profile that has specific user settings for programming and coding softare.
• Senario #3: When bob logs into a computer in the General Access Computer Labs we want him to get a generic profile optimized for the lab system.

Here's our solution:
AD Setting: Bob's user account in Active Directory has a the profile path box set to %profilepath%.

1. In Senario #1 above, all the computers in bobs department have a System Enviorment variable set of profilepath=\\servershare\profiles\%username%
   
   
2. In Senario #2 above, all the computers in the Computer Science department have a System Enviorment variable set of profilepath=\\computerscience\profiles\%username%
   
   
3. In Senario #3 above, all the computers in the General Access Computer Lab are in an OU in Active Directory that have the following Group Policy applied to them: Computer Configuration \ Policies \ Administrative Templates \ System \ User Profiles \ Only allow local user profiles = enabled ). What this does is forces the system to use the default profile on the Lab machine. When we build the image for our lab machines we setup the profile exactly like we want it and then log in with an admin account and using the profile tool under Computer Properties we copy the model profile over the top of the default User folder (hidden folder in documents and settings). Now every user that logs into the lab gets the same experiance. We also use a product called DeepFreeze, that sets the system back to original image state after every reboot.
   

Roaming Profiles... just not in the computer labs.

We recently needed to find a way to allow for roaming profiles with our Active Directory Domain for a certain group of users. This caused a problem for our Computer labs because we didn't want the profiles to roam in the labs as we were wanting every user to get the same experience in the labs and be given the pre-configured profile.

There are 2 options depending on the type of computers you have on your domain in the lab enviorment. Put all the computers in an OU and add a group policy to them. Is under this tree:
(Computer Configuration \ Policies \ Administrative Templates \ System \ User Profiles)

For Windows XP enable the following:
- Only allow local user profiles

For Windows Vista you can change the profile value:
- Set roaming profile path for all users ( you could carfully set it to a local folder)


This works great and allows both the use of roaming profiles in the office environment while still letting the Lab machines be configured for maximum performance. Also, if you use DeepFreeze or a similar product I'd recommend disabling machine password changes through Group Policy so your systems don't suddenly drop off the Domain.

The session setup from the computer %computername% failed to authenticate.

I've been seeing this error come through on my Domain Controller System Event logs for some time now and finally figured out what the cause is. The Error is System Even ID: 5805

Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5805
Date: 3/30/2008
Time: 10:16:24 PM
User: N/A
Computer: DC1
Description:
The session setup from the computer %computername% failed to authenticate.
The following error occurred:
Access is denied.

My Computers that are connecting to the Domain are Lab Computers for Student Computer Labs. We use a product called Deepfreeze with restores the computers to the last frozen state on every reboot. The one problem with using DeepFreeze and having the computers on the domain is that when the computers try to to a domain machine account password change they will forget the new password after a reboot. Now the computer won't login to the domain or setup a session. I fixed this by adding a group policy to all the Frozen Lab Computers that disables machine account password changes:

It's under Computer Configuration -> Windows Settings -> Security Settings -> Local Policies/Security Options -> Domain Member: Domain Member: Disableachine account password changes

There are multiple accounts with name cifs/102-PC12.domain.edu of type DS_SERVICE_PRINCIPAL_NAME

I've been having the following error logging on my domain controllers about every hour for quite some time now and finally got around to drilling down to figure it out.

Type: Error
Event: 11
Date Time: 8/29/2007 7:46:33 AM
Source: KDC
ComputerName: DC2
Category: None
User: N/A
Description: There are multiple accounts with name cifs/102-PC12.domain.edu of type DS_SERVICE_PRINCIPAL_NAME.

After a little research and lots of luck... I decided to use ldp.exe to do a quick search of the (serivceprincipal=*.102-PC12.domain.edu). What do you know... it came up with 2 accounts sharing that name. I quickly found the one that was a problem and deleted it. It turns out somebody put an image on a few machines without first pulling the source from the domain... not a good idea.