Stewed Prunes...

ISA 2004 and Vonage....

cavis — Tue, 29 Aug 2006 17:16:36 GMT

I have received a few emails over the months regarding getting ISA 2004 to work with Vonage. I suppose it should really be getting Vonage to work with ISA 2004. So I decided to type up my resolution to this problem.

I have been running Vonage with my VoIP adapter behind the firewall since I started the service. I have to admit, I set it up pretty simply and with not near the level of security that I should have, so I decided to tighten things up for the purposes of this post.

My configuration – ISA 2004 Enterprise running on Windows 2003 R2 Enterprise and using the Motorola VT2442 VoIP router.

First, I use my ISA server as my DHCP server for my local LAN. I have seen other posting for assigning the WAN interface of the VoIP adapter a DHCP address and then creating rules in ISA to support that. However, I like simplicity. I also like the idea of my phone having as much uptime as possible so by eliminating DHCP issues, I don’t have to worry about losing phone service if there were ever a problem with DHCP. I decided to create a reservation in DHCP for the address I assigned the VoIP adapter, then I statically assigned that address to the WAN interface. I also provided the subnet and default gateway (pointing to the ISA server internal LAN interface). This is a one time config, I know what the IP will always be, and no worries about DHCP issues.

I also disabled the firewall on the VoIP adapter and allowed pings to the external interface. Now I can set up a connectivity verifier in ISA to alert me if the VoIP adapter is ever unreachable.

The next step is to find out what ports Vonage uses. I fired up the ISA monitor and filtered on Client IP of 10.0.0.222 as per my set up in the graphic. This allows me to see what kinds of communications requests are being sent from the VoIP adapter. On a whim, I decided to hit the Vonage site to see how helpful it would be. Lo and behold, I quickly found the ports Vonage uses — Outbound communications — UDP 53 (DNS), UDP 21,69,2400 (TFTP), UDP 80 (HTTP), UDP 123 (NTP). I did not have to use UDP 5061 (SIP) since my device is newer. There is also a huge range of UDP ports that need to be allowed for Inbound and Outbound — UDP 10000 to 20000. All of the other ports are predefined by service type within ISA.

For this latter range, I created a new protocol in the ISA toolbox called RTC and provided the range. Since Vonage VoIP adapters “call home” to establish their initial communications pathway, I set the direction to be Send Receive. This means the VoIP adapter can call home and keep the ports open for the inbound communications. It also means we don’t have to create and publishing rules since all of the communications are initiated by the VoIP adapter from behind the ISA firewall.

I flipped back to my monitoring and confirmed the ports provide by Vonage were all that were necessary and it all match up. Since I want to limit the ports the VoIP adapter is using, as well as limit what ports are accessible from the outside world, I decided to create a computer object to represent the VoIP adapter and to simplify creating the firewall policies.

This is also accomplished through the ISA 2004 toolbox.

Now it is time to create the firewall policies.

Again, since all communications are initiated by the VoIP adapter, there is only a single rule that is necessary. Since we defined the RTP (Vonage) rule as Send Receive, it too can be included with the policy. As you can see from the graphic above, we simply allow only the protocols needed by the Vonage “computer” object to the External network. Since no publishing is involved, we don’t need to worry about opening any additional inbound ports on the firewall. And since the RTC protocol definition is designated as Send Receive, those ports are only opened when a call is call is made or accepted and are only open for the duration of the call.

Simple, Secure, and it works.

I hope this helps for those of you that have had issues or wish to secure it a little more. You can accomplish the same thing with an “Allow All Protocols” rule, but I like having the comfort of know the adapter isn’t doing more than I want it to. This solution provides for easy monitoring and a minimum number of changes to your ISA config.

Cheers!

Windows Vista Session Resources....

cavis — Tue, 15 Aug 2006 06:43:57 GMT

Here are the resources for Vista that we are discussing this quarter…

Business Desktop Deployment Info

BitLocker Drive Encryption Overview

Vista Step-by-Step Guides for IT Pros

Anti-Phishing Technologies

User Account Control Overview

Windows Vista Hardware Guidance

SeeWindowsVista – If nothing else, check out this site because of how it looks. It is visually stunning! But it also have a tremendouns amount of valuable information on Windows Vista.

Windows Vista Team Blog – Excellent posts!

Vista Community Site — Access Newsgroups, Blogs, the latest product information and more…

Hive.net — Community site with discussion on Vista and more…

CPU / GPU Processor Capabilities — in regards to Vista

Vista Webcast Series

eLearning — Online training courses to prepare you for Vista

Cheers!

Exchange 2007 Event Resources....

cavis — Tue, 15 Aug 2006 06:23:47 GMT

Here are the Exchange 2007 resources mentioned in the live sessions we are covering this quarter….

You had me at EHLO – Exchange Team Blog

Exchange 2007 Beta 2 System Requirements

Exchange 2007 Beta 2 Download

Exchange TechCenter Home

Exchange 2007 Technical Documentation

Exchange 2007 Webcasts

Exchange 2007 Scripting Center

Cheers!

Exchange 2007 podcast...

cavis — Tue, 15 Aug 2006 03:53:23 GMT

Michael Murphy, a most awesome co-worker of mine, interviewed Terry Myerson – General Manager of our Exchange group. They discuss the 64–bit imperative for Exchange 2007. Check out Harold Wong’s blog while you are at it!

Cheers!

Exchange 2003 Event Resources...

cavis — Tue, 15 Aug 2006 03:44:15 GMT

I am a little late getting this posted! These are session resources for the Exchange 2003 events we are delivering this quarter. Some of these are links from the slide decks. Others are links that are just good to have for Exchange and Vista. Don’t forget to check out the awesome resources on the Technet Resource DVD!

Exchange 2003 Resources

Exchange 2003 MOM Management Pack

Exchange 2003 Deployment Guide

Suppress Out-of-Office Messages for BCC DL’s

Block Specific MAPI Clients from accessing Information Store

Create a catch-all mailbox & Blog Entry

Add a Custom Disclaimer to all Outgoing Messages & VB Script

MS04–035 & SMTP Tarpitting Blog Entry

Alias Matching for all users

Outlook 2003 Tips

Per User Alias Matching, RPC over HTTP Polling, MAPI Compression, performance Monitoring

OWA Customization Tips

Outlook Web Access Web Administration Tool

Customize OWA Logon Page and KB Article 830827

OWA Segmentation

Forms Based Authentication inactivity time-outs

View Spam Confidence (SCL) in OWA

Create and Deploy OWA Themes

Cheers!

Webcast: Securing Wireless using PEAP...

cavis — Wed, 09 Aug 2006 17:43:11 GMT

I am delivering a webcast next week on Securing Wireless Networks using PEAP. We will delivering this cast at 10am pacific on Wednesday the 16th. The actual title of the cast is “Secure Wireless LAN Solution: Microsoft’s Authentication Infrastructure with Aruba Networks’s Mobile Edge”

The primary goal of the webcats is to demonstrate that wireless networks can be very secure, maybe even more secure than wired networks when configured properly. We also don’t have to jump through a bunch of flaming hoops to make it happen. It truly is a simple process! We aren’t going to have to deploy a bunch of certificates or concern ourselves with tunneling. We are going to keep it simple and show it in action (as well as you can show wireless via a webcast!)

I will be co-presenting with Thenu Kattappa from Aruba Networks to show a full solution using Windows 2003 R2, Internet Authentication Services, Group Policy, and Aruba Network’s Model 800 Mobility NAS Controller and an Aruba AP70 Access Point.

Cheers!

Hacking Vista...

cavis — Sun, 06 Aug 2006 16:59:46 GMT

MSNBC has an article on how Microsoft has given Vista to a large number of security professionals to “hack”. The effort is designed to reveal security flaws before Vista is released as a production product.

My Opinion – I have to ride the fence on this.

The Good – It is great that we are enlisting the security community to help create a better product. Ultimately there should be fewer vulnerabilities discovered over the long term with this kind of testing. This is to the benefit of the entire computing world and really should apply to ALL products that will have the kind of dicstribution that Vista is expected to have.

The Bad – I simply don’t trust that all of the vulnerabilities will be revealed by the “hackers”. There is no doubt in my mind that there will be some unscrupulous few that will find a vulberability (or two…) and withhold that information. Why? for all of the same reasons the bad guys look for vulnerabilities in the first place – notoriety, financial gain, or just the knowledge of knowing something that someone else doesn’t.

I do believe it is the right thing to do though. I believe the good outweighs the bad. I do feel it is unfortunate that we have to resort to these kinds of tactics to secure our products, but it is a workable solution.

Time will tell….

Cheers!

The End of Customer Service....Part Two

cavis — Wed, 02 Aug 2006 22:31:00 GMT

ugh.

I wasn't going to write about this since it doesn’t actually change anything. But yesterday’s post was mildly therapeutic. Here we go……

Back in April, I booked a flight from SoCal to Seattle, through Orbitz. When booking the flight, the site hung and spun on the page confirming my credit card charge. Knowing how this stuff works, I let the page do it’s thing for at least 30 minutes before closing. I then went into my account on Orbitz just to see if it booked the flight anyway. It did not show up so I started up the process again. (What I should have done was call my credit card company to see if the charge came through. But, alas, I did not. Moving on…..). The second run through, of course, went without a hitch. Voila! Flight booked. House hunting trip set in motion.

I check my credit card statement online a few days later only to find two charges from Orbitz. Sigh. Call Orbitz, navigate the system (details fuzzy here….been a while), finally get to a human only to be told that they will not refund the airline ticket because they have already paid the airline. I will have to take it up with United.

Call United. (again…details fuzzy because it has been a while). Ultimately get informed that this was a non-refundable ticket, however, they will be happy to issue me a credit which I can use up to one year from the original purchase date.

Fast-forward to today. I call United to book a flight, using the credit, for my daughter to come up from Texas. Since I will be using a credit, I know there is no way that the automated system can handle this. So my goal is to get to a human as simply as possible.

Call #1 – Press #3 for travel within the 50 states. Get a busy signal.

Call #2 – Press #3 for travel….then I get one of the fancier systems that actually responds to voice commands. Problem is, the options it provides do not allow for you to get to a human. I get frustrated trying navigate to a human, and hang up.

Call #3 – Press #3. Don’t say anything at all in hopes that no response from me means they need to get a human involved. No Deal. System states, something to the effect of, “I did not understand, thank you for calling. Click.”

Now I am about to blow a gasket…..

Call #4 – Press #3. On a whim I say “Customer Service”. The system responds with, “Did you say ‘Agent?’. Well I didn’t, but at least it sounds promising so I lie and say yes.

Now I get…..a human…..but there is a slight language barrier. But to be honest, not enough to complain about. Just enough to note. I ask if they can locate my credit. They do. (that in itself is a miracle to me….I thought for sure I would have to fight that battle…). I am then told that because it is a non-refundable ticket, the actual credit is $100 less than what I paid originally. okay. I fly enough to realize that the airlines have to stick you somehow and have had that stick shoved in and broken off a few times. Not Happy, but so be it. Then I am told that since I am booking over the phone there is a $15 service few. I point out that on the United web site it clearly states that there is a $10 fee for making phone based reservations.

I even offer to provide the URL. I am told the information on the web is incorrect and that I will be charged $15. I begin pleading my case only to be cut off with, “Oh, but since this is a credit on an existing ticket, you are not subject to the fee”. Maybe there is hope yet….

I am then asked for the flight info. I have their site open and start providing the flight information. We get all that squared away only to hit the final roadblock…..the representative asks me who the passenger will be……this is key, because she asked me this question. I state the passenger name as my daughter’s name. Which she then asks me to spell for her. Which I hear her typing in. I am then, casually informed (after asking me the spelling and typing it in) that I can not use my credit for this traveler. Only I can use this credit. I can not apply it toward the purchase of a ticket for anyone else other than me. Please read this paragraph several times if you don’t see the absurdity of asking me for the passenger information, accepting it, verifying it, typing it in, only to disclose this amazing piece of critical information.

I ask for a supervisor. I get a supervisor. Language barrier a little higher, but still, nothing to complain about. Just something to note.

I plead my case only to get fed this line. “It is not an airline policy, it is an FAA Policy that tickets can not be transferred to another person”. In arguing with this person, it was also a “government policy” and then an “industry policy”. I pressed the issue and asked where I could find this policy, preferably now, through the web for reference, so I could educate myself for future reference. Of course it could not be provided, but if I called back to the EXACT SAME NUMBER I dialed for my reservations but selected a different option, that I could speak to someone about the policy. He could not transfer me.

That is when I lost it…

It was hardly a drunken Mel Gibson moment, no four-letter words. No accusing him of causing all the strife in the world. But I was very, very angry and he did not get a word in for a solid 2 minutes.

So hear I am, credit with an airline that I will never, under any circumstances fly again, and I still need to book a flight for my daughter.

The best part is……I have vented……and I truly feel just a tad bit better…..

Cheers!

The End of Customer Service....

cavis — Wed, 02 Aug 2006 00:17:15 GMT

I have decided customer service is dead. By dead, I mean it sucks.

A couple of months ago I moved from one state to another. On one level I was excited to travel across country, see some places I have never been, and re-establish myself in a new community. on another level I dreaded having to call the utility companies and other service providers to disconnect or establish service. What I found as the most satisfying experiences were the ones where I did not have to deal with any people at all. Not only did it satisfy my growing desire for instant gratification, I did not have to concern myself with a language barrier or with front line people who invariably don’t know the answers and certainly don’t know how to get you to the people that do. When machines are programmed properly, it is very efficient and very satisfying to get in, get out, and get it done. There are the occasional bright spots when an exceptionally helpful human who knows what I want and need goes the extra mile. But it has become such a rareity these days.

I was going to go on a lengthy tyrade about some of those experiences (I am still fighting with SDG&E to get a refund they incorrectly sent to the previous home owner of the home I owned in SoCal for almost 4 years. How does that happen !?!?!?!) but instead, I shall simply recount the experience I had today.

My wife and I have thought we smelled gas near the front door (outside) of our house now and then. We called the gas company this morning, they sent someone out, confirmed a leak, patched it, then told us we had two weeks to repair it or they have to cap the line. Smart, nothing out of the ordinary for a gas leak. THAT experience was actually pretty good. When we initially called them, we spoke to a person who promised a technician would arrive within two hours. He arrived in about 1 hour. He quickly identified the leak, explained the details and issues to me and answered all my questions. He even explained that it would not be too difficult of a DIY project and walked me through what I would have to do.

Tangent – Gas scares me. I will play with electricity. I can patch drywall. I like to paint and dabble a little in carpentry. But when it comes to gas, I try to take a hands off approach. I drop a circular saw, I may cut off my foot (which would suck) but hopefully it shuts down before going Maximum Overdrive and decapitating everyone within a city block. When gas goes off it tends to affect EVERYTHING in the immediate vicinity. People dissappear along with pets, cars, houses and wildlife.

So I decided to call a couple of places to get estimates. Please understand, I did not really think I would get anyone to tell me…..over the phone…..what it might cost to replace 10 feet of gas line. I fully expected to get the standard line of, “Well…..every situation is different. There are lots of variables……length of pipe (already established at 10 feet), diameter of pipe, (the one in question is a 3/4” line), whether I am in a good mood or not…..blah blah blah”.

But I thought I would try anyway.

First Call – Large, national, well known plumbing company. Apparently I called the national, automated routing center. I was informaed by the recorded voice that I was calling from a cell phone and that to “better serve me” I needed to provide a work or home number. My cell is my home number….. next company…..

Second Call — Another large, national, well known plumbing company. Again, a national call center only this one manned by a human. I was told flat out that until I provided my full name, home number, and address, they would not route me to a local center…… next company….

Third Call — Local company. They don’t do gas work. Fair enough. Points for being personable and being a human. I will call them back for water plumbing issues if the need be.

Fourth Call — Local Company with a big company phone routing system. After entering my zip code and getting looped through a second time, I decided to move on.

Fifth Call — Local Company. Spoke immediately to a human, transfered to owner of company, received voice mail.

Open BlogJet…..start venting.

Now I know I am not a very patient person. I know I could have probably stayed on the line in call four and maybe gotten a little further. But realizing I was probably not going to get someone to ballpark me on how much 10 foot of pipe, two elbow joints and a union joint would cost to install with labor, I decided to throw in the towel. At this point I am seriously considering it as a project for this weekend.

If you don’t see a post from me by late Sunday evening, send flowers and cards to my parents…

Cheers!

ps…..this will NOT be my only post on customer service (unless I don’t make it this weekend….) something needs to be done about it. Also, look for the new Rant & Rave category. —>

Badwater......don't drink it....

cavis — Wed, 26 Jul 2006 14:26:07 GMT

…but feel free to run it…

I was talking to some teammates about running and I mentioned a TV show I recorded about an endurance runner here in Seattle. He was showcased on a local program regarding his first attempt at running the Badwater Ultra-Marathon – 135 miles from the lowest point in Death Valley to the mid-point of Mt. Whitney, the tallest mountain in the lower 48.

I sent this info to a friend of mine who runs marathons and he forwarded a link to me this morning about the world’s longest race. Now in its 10^th year, the Self-Transcendence Race is a 3100 mile, 51 day race around a single city block in Jamaica, Queens. Not a typo – Three Thousand One Hundred Miles. More information on the sponsor of this and other ultra-races here.

For the record, *I* am not even considering anything more than a standard marathon……but some of you….. J

Cheers!

Looking for User Groups....

cavis — Mon, 24 Jul 2006 22:33:23 GMT

….because I want to hang out with other geeks!

Since I am new to the Redmond area, I would like to get involved in some local user groups. In the interest of transparency, I will state up front that working with user groups fulfills a work-related mission for me. I would be lax in my job if I didn’t spend some time speaking to user groups about MS products and technologies. But I also have a personal mission – I need some social outlets. Like anyone else, I like to hang out with people that have common interests. That is how user groups first started anyway; individuals coming together to help each other and share knowledge about their common interest in some product or technology. So why not hang out with some of these same, like-minded people, socialize, and share my own knowledge and experiences?

I am looking for some user groups near Redmond or even in the great er Seattle area that I can get involved with. I want to be a resource and conduit into Microsoft. I also want to meet people! Being new in town, I want to know where to go and what to do (and where NOT to go and what NOT to do!).

But, Chris…..I have a User Group in Portland, will you come speak to us? — Yes I will! Just email me or call me and we will work out the details. I can’t promise that I will be able to join and be an active, monthly attendee, but I will do what I can to get you the information you want.

Also, keep an eye on TechnetEvents.com. If you see a Technet event being delivered in a particular city AND you happen to be having a user group meeting that same week, let me know. I would love to attend!

Chris

Upcoming Technet Events...

cavis — Mon, 24 Jul 2006 22:11:54 GMT

There are several events coming up you should know about…

Windows Vista Technical Overview, Exchange 2003 Operations & Exchange 2007 Sneak Peak – I will be presenting this information on 8/15 in Portland, OR and 8/17 in Redmond, WA. The sessions are identical and will revolve around showing new features in Windows Vista (I am going to toss in some extra cool stuff!) and also some refresher information around Managing your Exchange 2003 environments. This will lead into a sneak peak at Exchange 2007.

Cheers!

Big Changes coming to Technet Subscriptions....

cavis — Sun, 23 Jul 2006 21:11:42 GMT

I am sitting in a Microsoft IT Pro Evangelist session listening to Scott Stout, Program Director of the Microsoft Technet Subscription program, tell us about some great new changes and offerings in the Technet Subscription program. Check this out…..

Technet Download Center — With Technet Plus, you currently have the benefit of current Beta software and non-timebombed versions of all of our server applications delivered to you. Very soon, you will be able to download all of this off the web. The site will also support “resume” functions if you happen to lose your connection during a large download. Sweet!

Technet Plus Direct — Don’t want all the CDs/DVDs being shipped to you every month? Prefer to download all of the Technet Content you normally have shipped to you? With Technet Plus Direct, you no longer receive monthly shipments of Technet content. Everything is available online. You also get a price break…$349. Super Sweet!

Managed Newsgroups — These are newsgroups that are only available to Technet Subscribers and are also managed and monitored by Microsoft support techs and personnel. We have committed to a 24 hour turn-around on answering posts. In addition, this is a great peer-to-peer support area to see how your fellow IT Pros are resoving real world problems. now I know this isn’t new, but i don’t think enough people take advantage of it.

These are just some of the changes coming to the Technet subscription program in the very near future! How near? Try August 1st! Where can you find out more information on this? — Watch the Technet Site for details on all fo these changes and more!

Cheers!

Rant and Rave #1....just the address please....

cavis — Fri, 21 Jul 2006 20:23:54 GMT

I have had an interesting time of late trying to identify a new ISP. Seems there is no single, unified place, anywhere in all of existence (that I can find) where I can provide only the service address and get a list of providers that service me. DSLReports and ShopForDSL are a step in the right direction, but both fall short. Both provide lists that include providers that are very distant and cannot provide service. Neither provides a comprehensive list, and both require a phone number for DSL qualification.

It would seem to me that in today’s day and age of technology and with our desire for instant gratification that someone, somewhere would have created a web site where an individual can provide only a service address and get a list of providers that service them.

Pretend Time….

You are new to the neighborhood. You have just purchased a new home or leased a new condo or apartment or whatever. In most cases, the basic utilities – gas, water, electric - are already on. It is just a matter of switching the billing to you. In some areas you may have more than one provider of these basic services to you and so everything below applies. But most of the time, those services are simply to setup.

Now all you have to do is accomplish the mind-numbingly simple task of establishing TV, phone and Internet service.

TV service usually comes to us through the air via antenna or satellite, or through a cable. There are two major satellite providers (DirecTV and Dish Network) so that is pretty simple if you choose that route. But you may not be able to receive a satellite signal due to a physical obstruction or some silly home-owners-association rule stating you can’t destroy the neighborhood and potentially spawn WW3 by placing an 20”, circular, disc anywhere on your OWN property (while I have never experienced this, I know others who have……it is profoundly silly…..so know your rights). Sometimes, due to (equally silly) local laws and restrictions, one or the other satellite provider will tell you they can’t provide service so you simply call the other one. Voila. Simple. Done. Now you can watch Survivorman.

But let’s say you either can’t get satellite, or, you simply don’t want to fight with the 300 pound, flowerdy moo-moo waring, HOA president who constantly has a cigarette dangling from her mouth and a perfectly worthless yap-yap miniature poodle in her arms. You want a cable based connection. Here is where it starts to get REALLY messy…..

If we search for “cable TV providers” online, we end up with a monstrous list. Of course that is a very wide open search which essentially does a query for ALL KNOWN cable TV providers that exist. You mighty think adding a zip code might narrow the list but, in fact, screws it all up and starts linking to HDTV discussion forums by zip and a myriad of other useless crap.

So how do I find local cable TV providers? Pick up the yellow pages (wow…..that is still being printed!?!?), flip to cable tv providers and start calling or hitting their websites)

On the surface, this seems like a simple enough resolution. But now we have to find a yellow pages. Probably simple enough….I don’t know…..I haven’t used a phone book in probably 10 years now. Then we have to call each and every cable provider. They will ask for a name in a feeble attempt to personalize the call but ultimately, the only piece of information they must have to determine availability is the service address. Yet we are forced spend time we don’t want to waste navigating through phone systems only to maybe get to a person who gives us a scripted, monotonous, lifeless sales pitch in an accent we can’t decipher.

Not so simple. And certainly not high on the customer satisfaction scale.

Phone Service — Not so many years ago, phone service was pretty simple to establish – only a single provider existed in any single area leaving the consumer little choice, but greatly simplifying the process of getting service. Phone service is in exactly the same boat as cable TV service. There is no single place you can go to find out who services your area. Searching online is pretty useless. Somehow you have to find a list of providers and then make calls to each one (with someone else’s phone) to verify before comparing service and purchasing. Amazing considering phones have been around for over 100 years now. Silly.

Internet Service – The huge thorn in my side right now. For the record, I do have an ISP. But I am going to briefly chronicle my desire to find an alternate ISP.

Internet Service has dependencies. You either have a phone line for dial-up or DSL, or a cable provider (usually the same one that provides TV services). There are the fringe users who use satellite or some other wireless broadband service, but dial-up, DSL, cable comprise the overwhelming majority of U.S. based Internet users. So establishing Internet Service depends on being able to easily and simply identify the above which we have already shown is neither easy or simple. In fact, it gets complicated even further with DSL because who you get DSL from is almost always tied to whom you get your phone service with and qualifying for DSL almost always relies on providing a phone number which you don’ have because you don’t want to switch phone providers just to get another ISP. Silly.

There are tricks to this – knock on your neighbors door and ask them for their phone number and provide that to a prospective DSL provider. Most likely you will be serviced by the same providers that can supply your neighbor. But the fact remains that there is no single location where I can provide that phone number and receive a comprehensive list of providers. You still have to call each and every provider and give them your neighbor’s phone number.

So….am I being unreasonable? Am I too far ahead of the curve? Is technology a limiting factor? Am I the only one who thinks this kind of site or service would benefit consumers? Am I the only one who thinks this could benefit the providers?

Let me know…..

Cheers!

Basic Group Policy Troubleshooting....

cavis — Thu, 20 Jul 2006 14:30:13 GMT

One of the most common troubleshooting question I receive is regarding Group Policy. Usually because a policy does not seem to be applying to the user or computer as configured on the DC.

So let’s look at the basic troubleshooting for 2000/2003/XP machines….

First, make sure the machines you wish the policy to apply to are running Windows 2000/2003 or XP (or Vista/Longhorn if you are beta testing). Most people know that Group Policy only applies to Windows 2000, Windows XP and Windows 2003 but occasionally I recieve an email about why a policy won’t apply to a Windows 9x machine. If you are experiencing problems with Windows 9x machines, that is because they do not understand Group Policy.

Next, verify the user/machine accounts are in the Organizational Unit(OU) where the policy is linked. It is very common for someone to think a policy should apply only to find out the User or Machine account is not in the correct OU.

On the machines where you believe the policy shold be applying, you can check to see if it is with these steps —

For Windows 2000 machines – Go to a command prompt and run

SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE

SECEDIT /REFRESHPOLICY MACHINE_POLICY /ENFORCE

These commands will refresh the policy on the client machine. You would then run the previous command to check to see if the policy has applied. If the policy is listed but is not applying, check out this article for Windows 2000 Clients –

http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q250842

For Windows XP/2003 machines – Go to a command prompt and run –

GPRESULT

If you do not see that your policy is applied, run the following at the command prompt –

GPUPDATE /FORCE

For XP, this will refresh the policy on the client machine. You would then run the previous command to check to see if the policy has applied. If the policy is listed but is not applying, check out this article for Windows XP/2003 machines –

Group Policy Troubleshooting on XP

I also recommend the following White papers —

Troubleshooting Group Policy on Windows 2000

Troubleshooting Group Policy Problems

Group Policy Management Console

Cheers!