www.kreslavsky.com » Active Directory

Show only specified Control Panel items GPO doesn’t apply on Windows 2008R2 Terminal Servers

Gil Kreslavsky — Tue, 24 Aug 2010 10:23:11 +0000

In Previous version we used to work with CPL File Names to define which one of control panel applets will be displayed.

In order to make it work Use Canonical names instead.
It should Look like that

You can get the full list from here

Block Access to My Computer Properties Menu in Windows 7 and Vista

Gil Kreslavsky — Fri, 30 Oct 2009 10:05:00 +0000

In System properties window you can various information about Windows system .
You may wish to block it to prevent users from accessing it and do changes.

You can easily disable access to My Computer context menu through AD Group Policy.
This solution doesn’t block access to menus, only hides it from right click. Menu can still be accessed Windows key + Pause/Break key.

To disable it Open Group Policy Manager
Navigate to User Configuration > Policies > Administrative Templates > Desktop
Double Click on “Remove Properties from the Computer icon context menu” and change it to “Enabled”

Windows 7 Trial Download

Prevent users from disjoining from domain using GPO

Gil Kreslavsky — Thu, 29 Oct 2009 09:54:00 +0000

There is no 100% foolproof solution that blocks local admin users access the option of disjoining their computer from domain , but you can make it harder to get to system menu.

I remove the "properties" from when you right click on my computer.
Then i also remove system applet from control panel menu ,and disable registry editing.

To disable right click on my computer go to Group Policy.
Navigate to User Configuration>Administrative templates>Desktop
Locate “Remove Properties from the My Computer context menu” and set it to “Enable”

You should check also How disable Right Click Properties on my computer on windows 7/Vista

Than navigate to User Configuration>Administrative templates>Control PanelLocate “Hide specified Control Panel applets”Set it to “Enabled” and add Sysdm.cpl to the list of disallowed Control Panel applets.

To block Sysdm.cpl from executing

Navigate to User Configuration>Administrative Templates>System

Navigate to “Don’t run specified Windows application” set it to “Enabled” and add Sysdm.cpl to the list of disallowed applications

c1038a21 PR_PF_PROXY exchange 2003 public folders error

Gil Kreslavsky — Wed, 22 Jul 2009 11:01:16 +0000

Error c1038a21 appears when you try to view properties of public folder system folder – Schedule + free busy or offline address book folder

Microsoft have a article on how to fix it , but in there guide they recommend usage of Information Store Viewer (MDBVu32).

I prefer to use PFDAVAdmin that can be downloaded from here it is much easier .

Run PFDAVAdmin
Press on file>connect
Fill your DC settings like on screenshot bellow (don’t forget to select public folders)
Navigate to problematic folder – schedule free busy for example
Right click on it and chose “property editor”
Select PRF_PF_PROXY from property dropdown
mark clear and press execute.

That’s it, that should fix the problem.

New User Mailbox is Created in Wrong Mailbox Store or Storage Group

Gil Kreslavsky — Tue, 28 Apr 2009 07:31:11 +0000

The issue occurs when you are trying to create mailbox for new user using ADUC in Exchange 2003
By Microsoft the reason for the issue is : After upgrade of the forest to a 2003 native mode functional level, the Recipient Update Service may overwrite the value of the homeMDB attribute for new Microsoft Exchange Server 2003 users.

To fix the issue:

Open ADSI Edit.
Double-click the Configuration container
Expand CN=Services
Expand CN=Microsoft Exchange,
Expand CN=.
Click CN=System Policies.
In the right pane, right-click CN=Mailbox Enable User, and then click Properties.
Scroll down to select the purportedSearch attribute, and then click Edit.
Clear the attribute, and then use the following filter to configure the attribute:
(&(objectCategory=person)(objectClass=user)(mailnickname=*)(homeMdb=*))
Click OK .

Solution was been created with the help of the following article:http://technet.microsoft.com/en-us/library/aa998426.aspx

note:You must enter the attribute without any spaces, exactly as it is.

Useful AD PowerShell Commands

Gil Kreslavsky — Wed, 08 Apr 2009 09:48:00 +0000

Finding Disabled Users:

get-qaduser –disabled

Create a new Active Directory user:

new-QADUser -name '<User CN>' -parentContainer '<Parent DN>' -UserPassword
'<Password>' -FirstName '<User First Name>' -LastName '<User Last Name>'
-UserPrincipalName '<User UPN>'

Create multiple users in Active Directory:

$parentDN = “" $strPass = “userPaswd” For ($i = 1; $i -le 1000; $i++) { $strUserName = “User” + $i New-QADUser -name $strUserName -parentContainer $parentDN -UserPassword $strPass }

Modify Attributes for several users:

$strfileServer = "\\Servername\"
$objOU = [ADSI] "LDAP://"
$objOU.psbase.Children |% {
    $uac = [int](($_.userAccountControl).ToString())
    if (($_.objectClass -eq "user") -and (($uac -band 2) -eq 0))
    {
        $_.put("homeDirectory", $strFileServer + $_.sAMAccountName)
        $_.SetInfo()
    }
}

Delete user in Active Directory

remove-QADObject -identity

Set user profile in Active Directory

get-QADUser -identity "" |
set-QADUser -HomeDirectory '\\Servername\Katrin' -HomeDrive
'H:' -ProfilePath '\\server1\profiles\jsmith'
-scriptpath '\\dcname\netlogon\logonscript.vbs'

Move User to other OU

move-QADObject -Identity  -NewParentContainerName <New OU DN>

Find Locked User Accounts

Get-QADuser -locked

Unlock User Account

Unlock-QADUser -Identity <UserDN>

Retrieve Password lockout policy

Get-QADObject domainname.com | format-list Name, *password*, *lockout*

Move Domain Controller to other site – PowerShell

Gil Kreslavsky — Mon, 06 Apr 2009 09:24:00 +0000

$dcname = $newSite = "NewSite Name"
$context = New-Object
System.DirectoryServices.ActiveDirectory.DirectoryContext(‘DirectoryServer’, $dcname)
$dc =
[System.DirectoryServices.ActiveDirectory.DomainController]::getDomainController ($context)
$dc.MoveToAnotherSite($newSite)

Where DomainDNSName – Enter your DNS domain name

Moving a Group to Another Domain – Using ADMT

Gil Kreslavsky — Wed, 01 Apr 2009 17:33:13 +0000

To move windows group to other domain download ADMT Tool

Install Active Directory Migration Tool
Open the ADMT MMC snap-in it is located in Administrative Tools.
Chose source and destination domains and click Next.
On the Group Selection screen, chose the group that you want to migrate and click Next.
On the next screen, select Browse and locate the desired OU.
On the Group Options screen, select one or more of the following and click Next:

Update user rights: Copies any user rights that are assigned in the source domain to the target domain.

Copy group members:Specifies whether the user objects that belong to the group should be migrated along with the group.

Adds the security identifiers (SIDs) of the migrated group accounts in the source domain to the SID history of the new group in the target domain.

On the Naming Conflicts screen, select whether you want to migrate group objects that conflict with objects in the target domain and click Next.
Follow the remainder of the wizard to complete the migration.

Folder Redirection to NTFS share Permissions

Gil Kreslavsky — Mon, 30 Mar 2009 09:42:39 +0000

If you want to redirect domain user folders to NTFS or Storage share, you need to set the permissions like in the list bellow:

Creator Owner => Full Control on “Subfolders and Files Only”

Security group of users needing to put data on share => List Folder/Read Data, Create Folders/Append Data on “This Folder Only”

System => Full Control, on “This Folder, Subfolders and Files”

In addition you can add Domain Admins security group to have permissions on user folders:

Open Group Policy Management
Navigate to Computer Configuration>Administrative Templates>System>User Profiles
Set “Add the Administrator security group to the roaming user profile share” to enabled

Prevent users from deleting start menu items via GPO

Gil Kreslavsky — Sun, 29 Mar 2009 21:51:00 +0000

Open Group Policy Editor:
Link Policy to relevant OU
Navigate to User Configuration>Administrative Templates>Start menu and taskbar.
Edit “Prevent Changes to Taskbar and Start Menu Settings”
Set it to enable
Pres OK

Note: To enforce group policy: Navigate to Start>Run type gpupdate /force and hit Enter

www.kreslavsky.com » Active Directory

Show only specified Control Panel items GPO doesn’t apply on Windows 2008R2 Terminal Servers

Related Articles

Block Access to My Computer Properties Menu in Windows 7 and Vista

Read more

Prevent users from disjoining from domain using GPO

Related Articles

c1038a21 PR_PF_PROXY exchange 2003 public folders error

Related Articles

New User Mailbox is Created in Wrong Mailbox Store or Storage Group

Related Articles

Useful AD PowerShell Commands

Finding Disabled Users:

Create a new Active Directory user:

Create multiple users in Active Directory:

Modify Attributes for several users:

Delete user in Active Directory

Set user profile in Active Directory

Move User to other OU

Find Locked User Accounts

Unlock User Account

Retrieve Password lockout policy

Related Articles

Move Domain Controller to other site – PowerShell

Related Articles

Moving a Group to Another Domain – Using ADMT

Related Articles

Folder Redirection to NTFS share Permissions

If you want to redirect domain user folders to NTFS or Storage share, you need to set the permissions like in the list bellow:

In addition you can add Domain Admins security group to have permissions on user folders:

Related Articles

Prevent users from deleting start menu items via GPO

Related Articles