DeployHappiness | Monthly Archives: May 2015

Finding Printer IPs Easier in Print Management

Posted on May 26, 2015 by Joseph Moody

I have always been annoyed by the seven steps it takes to find a printer’s IP in the Printer Management MMC. I even reached out on TechNet about this and was told that it was a limitation of the MMC. For a long time, I would look at the extended view window to get the IP. Some printers show their IP when you use Extended View but many don’t.

With a bit of PowerShell, you can populate the Comment attribute with the IP address of the Printer. This script uses the Print Management module which was introduced on Windows 2012 servers. If you want to run it on Windows 8+, you just need to install the RSAT tools.

$PrintServer = "YOUR-PRINT-SERVER.DOMAIN.Local"
$Printers = get-printer -ComputerName $PrintServer

foreach ($Printer in $Printers){ 

Set-Printer -Name $Printer.name -ComputerName $PrintServer -Comment $Printer.PortName
}

The only thing you will need to specify in this script is your print server name in line 1. Set this script to run on a regular basis so that your data is current. Finally, select the View button – Add/Remote Columns and add the Comment attribute to the Displayed columns row.

You can now see the printer’s IP in Print Management without any additional steps. If you are curious, you can read other printer management tips (including why you should set a location) here. If you have any other tips for printer management, let me know in the comments below.

Business Rules, Security Roles, and Logging – A Deeper Look at Adaxes for Active Directory

Posted on May 22, 2015 by Joseph Moody

This post is sponsored by Softerra, Ltd. What’s this?

A couple of weeks ago, we explored Adaxes as a replacement for the Active Directory management tools. We covered some really cool topics like the web console and streamlined wizards. That was just the tip of the iceberg in terms of features. In the second part of our review, we will cover a few of the advanced features found in Adaxes.

Business Rules for Active Directory

Delegation in Active Directory is strictly a black and white kind of world. You are either allowed to do something or you get to see a nice Access Denied error. While other Microsoft products, such as Advance Group Policy Management, support change control – Active Directory does not. Let’s look into change control when Adaxes is brought into the picture.

Business Rules, found under the Configuration Node, are the triggers that monitor Active Directory. They can be enforced before or after an action occurs. For example, the builtin rule After User Creation creates a home directory, exchange mailbox, and activates an Office 365 account.

We can create a new business rule and target it to Organizational Units that are deleted. By setting the Apply Before option and adding the action Send this operation for approval, we can create a completely customized change control environment. Each rule that you create can have conditions applied to narrow the application scope. In the screenshot below, my rule applies to all OUs but is scoped to members of the Helpdesk security group.

Approvers can be specified by security groups or automated through the use of the Owner setting on the OU. These pending changes are sent to the Approval Requests node until action is taken on them. Adaxes will notify administrators by email any pending request. The Approval Requests node is used by administrators to access all of the requests that the Adaxes Service produces.

Security Roles – Preconfigured Delegation

In many organizations, every employee of the Tech Department is a member of the domain administrators group (or another super group). There is a saying that many cooks spoil the broth. With Domain Admin permissions, they also burn your house down…

Granular Security Roles make delegation incredibly simple by preconfiguring permissions. As you can see in the screenshot above, I’ve selected the Computer Manager role. This role has the ability to Create/Delete computer objects which provides the ability to join new machines to the domain. They can also set properties on the computer accounts.

Thinking about the permissions needed in your environment will allow you to map jobs to roles. For example, a computer technician might need to manage Computers and Users in AD. This means he will need permissions from the Computer manager role and the Help Desk role. The builtin Help Desk role allow administrators to reset passwords and change account/password options.

These role permissions can be merged through assignments. As you can see in the screenshot below, the Helpdesk group has been assigned the Computer Manager permissions to the Domain Sites OU. This gives you granular control without additional complexity.

In Depth Logging – Who did what in Active Directory

The Adaxes administrative console does two really cool subtle things:

allows editing to occur before it is pushed a live environment
logs this editing (and any other AD change) to a central location

When we configured change control and tested a security role above, those changes did not become live until we selected the save button. If we navigated away from the active window, we are prompted to save our changes. I think this small change is very cool as most items in Active Directory are immediately live after being edited.

Once a change has been saved in an Adaxes node (or an object has been edited in Active Directory), that information is recorded in the Logging node. This applies across the entire object life cycle: creation, modification, and deletion. Errors, such as the access denied (red exclamation point) are even recorded for review.

Wrapping it all up

In this review, we covered business rules, security roles, and logging. Each of these advanced features integrate together to extend your ability to manage Active Directory. Business Rules function much like rules in Outlook – they allow you to automate tasks based off of a trigger. These can proactively protect resources or complete a process. Security Roles make delegation simpler by allowing you to drop users into granular permission sets. Finally, logging gives you insight into Active Directory activity without combing through cumbersome logs.

Using Adaxes as your Active Directory management console can provide some huge benefits. If your environment needs a more robust tool for managing AD objects, download the free Adaxes trial at this link.

Reset User Passwords with AD Self Service Portal – Updated!

Posted on May 18, 2015 by Gerald Moody

Being able to reset user passwords with an Active Directory self service portal can save you a ton of time! I have seen many options for handling this problem – most are not free and many can be a difficult to setup. By using Exchange and PowerShell, we are going to setup a free self service password reset tool for our Active Directory users.

We are going to start off with the password reset script, then configure it for your environment, and finally cover ways to get your users to use it. Give me 30 minutes and I’ll get you out of the “I forgot my password” business.

Self Service Password Reset PowerShell Script

Copy the script and paste it into a PowerShell ISE prompt. I’ll meet you at the bottom.

#Configuration Block
$SmtpServer = "MAIL.DOMAIN.COM"
$ResetEmail = "reset@DOMAIN.com"
$Username = "DOMAIN\reset"
$Password = "P@ssw0rd"
$MailServer = "https://MAIL.DOMAIN.COM/ews/exchange.asmx"
$ExchangeVersion = "Exchange2010_SP1"

#User who shold recieve email notifications that a password was reset or an invalid request was sent.
$LoggingUser = "YOUREMAIL@DOMAIN.com"

#Download for file is here: http://www.microsoft.com/en-us/download/details.aspx?id=35371 
[Reflection.Assembly]::LoadFile("C:\Program Files\Microsoft\Exchange\Web Services\2.0\Microsoft.Exchange.WebServices.dll")

function Create-RandomString()
{
  $aChars = @()
  $aChars = "a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z", "A", "C", "b", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z", "2", "3", "4", "5", "6", "7", "8", "9", "_", ";"
  $intUpperLimit = Get-Random -minimum 8 -maximum 10

  $x = 0
  $strString = ""
  while ($x -lt $intUpperLimit)
  {
     $a = Get-Random -minimum 0 -maximum $aChars.getupperbound(0)
     $strString += $aChars[$a]
     $x += 1
  }

  return $strString
}

$email = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService([Microsoft.Exchange.WebServices.Data.ExchangeVersion]::$ExchangeVersion)
$email.Credentials = New-Object Net.NetworkCredential($Username, $Password)
$uri=[system.URI] $MailServer
$email.Url = $uri
$inbox = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($email,[Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Inbox)

if ($inbox.UnreadCount -gt 0)
{
 $PropertySet = new-object Microsoft.Exchange.WebServices.Data.PropertySet([Microsoft.Exchange.WebServices.Data.BasePropertySet]::FirstClassProperties)
 $PropertySet.RequestedBodyType = [Microsoft.Exchange.WebServices.Data.BodyType]::Text;
  # Set search criteria - unread only
 $SearchForUnRead = New-object Microsoft.Exchange.WebServices.Data.SearchFilter+IsEqualTo([Microsoft.Exchange.WebServices.Data.EmailMessageSchema]::IsRead, $false) 
 $items = $inbox.FindItems($SearchForUnRead,10)  #return only 10 unread mail items
 
 Import-Module -Name ActiveDirectory

 foreach ($item in $items.Items)
 {
   # load the property set to allow us to view the body
  $item.load($PropertySet)
  
  if($item.Body.text -Like "*")
  {
   $Phone = $item.From.address
   $Phone = $item.From.address.substring(0, $Phone.IndexOf("@"))
   $user = Get-ADUser -Filter {MobilePhone -eq $phone} -Properties MobilePhone 
   
   If ($user -ne $null)
   {
    $PW = Create-RandomString
    if ($PW.length -gt 1)
    {
     Set-ADAccountPassword -identity $user.samaccountname -Reset -NewPassword (ConvertTo-SecureString -AsPlainText $PW -Force)
     Unlock-ADAccount -identity $user.samaccountname
     
     $PasswordAge = (Get-ADUser $user -Properties PasswordLastSet | Select PasswordLastSet)
     if ($PasswordAge.PasswordLastSet -ge (Get-Date).AddMinutes(-1)){
     $Body = "Password reset for " + $user.SamAccountName + "-" + $user.DistinguishedName
     send-mailmessage -to $LoggingUser -from $ResetEmail -subject "Password Reset - $PW" -body $Body  -SmtpServer $SmtpServer
     send-mailmessage -to $item.From.address -from $ResetEmail -subject " " -body "Your password is now $PW" -SmtpServer $SmtpServer
     }
    }
   }
   else
   {
    send-mailmessage -to $LoggingUser -from $ResetEmail -subject "Invalid Phone number" -body "Phone number $Phone not found" -SmtpServer $SmtpServer
    send-mailmessage -to $item.From.address -from $ResetEmail -subject " " -body "Your phone number was not found." -SmtpServer $SmtpServer
   }
  }
  $item.Isread = $true
  $item.Update([Microsoft.Exchange.WebServices.Data.ConflictResolutionMode]::AlwaysOverwrite) 
 }
}

This awesome script comes from Gerald Moody. If you use Office 365, see the script at the end of this post.

Configuring Password Reset Self Service with PowerShell

At the top of the script, you’ll find the Configuration Block. You will need to set each of those variables for your environment. You will also need a dedicated AD account to use with this script. The account should have just the reset password permission delegated to it in Active Directory. It should also have a simple email (ex: reset@yourdomain.com).

Next, you will need to download the Microsoft Exchange Web Services Managed API 2.0 installer from here. Install this on the machine that will be hosting the script above. It does not have to be installed on your mail server. The machine’s IP will need to be able to send emails externally. A relay connector should be configured on your Exchange server. The machine that will run the script also needs the Active Directory PowerShell module installed. On Server 2012 R2, this is found in Add Roles and Features under the Remote Server Administration Tools location.

The function Create-RandomString controls what the password will be reset to. In the version above, a user will receive a password between 8 and 10 characters. Each character is randomly chosen from the $aChars array. Here is an example password: KbSDTxNeX . The random passwords will never contain confusing characters. You will notice that o,O,(zero),(one),l, and L are not in $aChars. You can remove/add any character to that line to change the way a random password is generated. For fun, remove every character but “a” and “b”. Then it will be like a cheat code to log back in. Moving on now…

Completely random passwords might not be your cup of tea. Reader Mike Liebstein replace the Create-RandomString function with the version below. It relies on a dictionary file (.\dict.csv) that is located in the same directory as the script. If you do not want to create a wordlist yourself, you can download this one.

function Create-RandomString()
{
$rand = new-object System.Random
$conjunction = "or", "after", "as", "if", "than", "since", "the","my","we","our","and","but"
$words = get-content .\dict.csv 
$word1 = ($words[$rand.Next(0,$words.Count)])
$con = ($conjunction[$rand.Next(0,$conjunction.Count)])
$word2 = ($words[$rand.Next(0,$words.Count)])
$strString = $word1 + "-"+ $con + "-" + $word2
Return $strString
}

Finally, two points on security. First, at no point is a user’s name delivered to the end user. For a user to reset their password, their phone number has to be pre-entered into their AD account. A malicious user would have to have the username and a way to intercept the password. If your management is skittish about this method, you can add a security question to the process. Simply modify the search body portion of this script to match another user attribute to AD. Then inform your users to text your reset email with that attribute (like a birthday). If the cell number exists and the birthday matches, it resets the password.

Testing Your Self Service Password Reset Script

Now that your script is configured, create a scheduled task. The scheduled task needs to run as a user that can reset AD passwords. Set the scheduled task execute once a minute. Don’t worry about AD performance, AD is only queried if the $ResetEmail user has an unread message in its inbox.

Let’s test this out now. Open up Active Directory Users and Computers. Find a test user and enter your cell phone number under that user’s mobile phone attribute.

From your mobile phone, text your $ResetEmail. Put something in the body of the text (ex: Reset). Wait a minute (or manually execute the script or scheduled task). You should get a text back that looks like:

To verify that the password was changed, just open CMD and type: net user /domain USERNAME . Scroll down to the password last set line and you should see that the password was changed! When the $LoggingEmail variable is set, you will also receive an email confirming that the password has been set. In testing mode, the subject includes the password. This can be removed on line 71.

If the password hasn’t changed, check these common issues:

Is the exchange version right in the Configuration Block?
If you didn’t receive a text back, make sure the reset text message reached the inbox of the reset user. Make sure it was marked a read (processed).
If you received a text back but the password didn’t change – check user permissions? Can your $ResetUser manually reset the user’s password?
Some readers reported issues with the (ConvertTo-SecureString -AsPlainText $PW -Force) line – if needed, you can remove this from the Set-ADUser line.

Convincing Users to Stop Bothering You

To distribute this to your users, you can configure a custom logon message showing the email address that automates the password reset. No need for a separate web page, no need for dedicated machines pointing to a self service portal! To do this, set the Group Policy settings Interactive Logon: Message text and Interactive Logon: Message title. Both of these settings are found under: Computer Configuration/Policies/Windows Settings/ Security Settings/Security Options.

You can take a few routes to populate Active Directory with mobile numbers. If you would like a user driven (as in you don’t do the work) approach read this How To Guide and automate that process! If you can’t trust your users to do this (or have security policies against this), you can use this PowerShell approach by reader Michael Zinn.

$ImportCSV = import-csv "\\server\share\importfile.csv"
foreach ($line in $ImportCSV) {
$Mobile = $line.Mobile
$Mobile = "$Mobile" -Replace "[^\d]"
Set-QADUser -Identity $line.Username -MobilePhone $Mobile
$Date= Get-Date
Get-QADUser -Identity $line.Username | Select-Object Name,UserPrincipalName,MobilePhone,@{N="Date";e={$Date}}
$User= Get-QADUser -Identity $line.Username

To get users accustomed to self service, you have to have buy-in from your whole IT department. Encourage helpdesk staff to direct users to reset their own passwords. It might be a bit more difficult at first but the benefits are huge in the long run. One college IT administrator told me that 26,000 passwords have been reset with this method over two years! Talk about awesome!

Have you implemented a self service password reset tool? Tell me about your experiences in the comments below.

Office 365 Self Service Password Reset Script

[Reflection.Assembly]::LoadFile("C:\Program Files\Microsoft\Exchange\Web Services\1.2\Microsoft.Exchange.WebServices.dll")

function Create-RandomString()
{
  $aChars = @()
  $aChars = "a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z", "A", "C", "b", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z", "2", "3", "4", "5", "6", "7", "8", "9", "_", ";"
  $intUpperLimit = Get-Random -minimum 8 -maximum 10

  $x = 0
  $strString = ""
  while ($x -lt $intUpperLimit)
  {
     $a = Get-Random -minimum 0 -maximum $aChars.getupperbound(0)
     $strString += $aChars[$a]
     $x += 1
  }

  return $strString
}

$email = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService([Microsoft.Exchange.WebServices.Data.ExchangeVersion]::Exchange2010)
$email.Credentials = New-Object Net.NetworkCredential('reset@YOURDOMAIN.com', 'someOldPassword')
$uri=[system.URI] "https://bl2prd0711.outlook.com/ews/exchange.asmx"
$email.Url = $uri
$inbox = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($email,[Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Inbox)
if ($inbox.UnreadCount -gt 0)
{
 $sendMailCredentials = New-Object System.Management.Automation.PsCredential 'reset@YOURDOMAIN.com',(ConvertTo-SecureString -String 'YOURPASSWORDFORRESET' -AsPlainText -Force)
 $PropertySet = new-object Microsoft.Exchange.WebServices.Data.PropertySet([Microsoft.Exchange.WebServices.Data.BasePropertySet]::FirstClassProperties)
 $PropertySet.RequestedBodyType = [Microsoft.Exchange.WebServices.Data.BodyType]::Text;
  # Set search criteria - unread only
 $SearchForUnRead = New-object Microsoft.Exchange.WebServices.Data.SearchFilter+IsEqualTo([Microsoft.Exchange.WebServices.Data.EmailMessageSchema]::IsRead, $false) 
 $items = $inbox.FindItems($SearchForUnRead,20)  #return only 20 unread mail items
 foreach ($item in $items.Items)
 {
   # load the property set to allow us to view the body
  $item.load($PropertySet)
  if($item.Body.text -Like "*Reset my password*")
  {
   $Phone = $item.From.address.substring(0, $item.From.address.IndexOf("@"))
   if ($Phone.substring(0, 1) -eq "1")
   {
    $Phone = $Phone.substring(1)
   }
   $user = get-aduser -filter "mobilePhone -eq $Phone"
   If ($user -ne $null)
   {
    $PW = Create-RandomString
    if ($PW.length -gt 6)
    {
     Set-ADAccountPassword -identity $user.samaccountname -NewPassword (ConvertTo-SecureString -AsPlainText $PW -Force)
     Unlock-ADAccount -identity $user.samaccountname
     send-mailmessage -to "reset@YOURDOMAIN.com" -from "reset@YOURDOMAIN.com" -subject "Password Reset" -body "Password reset for $($user.SamAccountName) - $($user.DistinguishedName)" -SmtpServer pod51018.outlook.com -UseSsl -Port 587 -Credential $sendMailCredentials
     send-mailmessage -to $item.From.address -from "reset@YOURDOMAIN.com" -subject " " -body "Your password is now $PW" -SmtpServer pod51018.outlook.com -UseSsl -Port 587 -Credential $sendMailCredentials
    }
   }
   else
   {
    send-mailmessage -to "reset@YOURDOMAIN.com" -from "reset@YOURDOMAIN.com" -subject "Invalid Phone number" -body "Phone number $Phone not found" -SmtpServer pod51018.outlook.com -UseSsl -Port 587 -Credential $sendMailCredentials
    send-mailmessage -to $item.From.address -from "reset@YOURDOMAIN.com" -subject " " -body "Your phone number was not found." -SmtpServer pod51018.outlook.com -UseSsl -Port 587 -Credential $sendMailCredentials
   }
  }
  $item.Isread = $true
  $item.Update([Microsoft.Exchange.WebServices.Data.ConflictResolutionMode]::AlwaysOverwrite) 
 }
}

Active Directory Users and Computers vs Adaxes

Posted on May 7, 2015 by Joseph Moody

This post is sponsored by Softerra, Ltd. What’s this?

For most IT administrators, the Active Directory Users and Computers (ADUC) tool is their primary gateway for AD object management. This tool is showing some age. Little annoyances include never remembering any setting that you check to the lack of real customization. Bigger issues include no granular builtin roles (which most other Microsoft products include) and a need to use multiple solutions for simple automation.

Why won’t computers stay checked? 🙁

Adaxes completely refreshes Active Directory object management by providing a complete picture GUI that can control workflow, handle customization, and integrate with multiple tools. Knowing the limitations of the native tools, let’s explore how Adaxes can help you.

New Administrative Tools: Traditional and Web Access

Adaxes comes in two flavors: a traditional administrative console and a modern web interface. Both have their individual strengths and are very useful in that context. The administration console, at first glance, is a blend of ADAC with more advance tools that you would use in programming or database management. You will find all of the familiar ADAC icons along with a huge amount of extra functionality (baskets, roles, scheduled tasks, virtual OUs, etc).

The Adaxes Administration Console

Do you ever wish there was a lite version of Active Directory? You know, some type of tool that made resetting passwords/creating users/etc straight forward for tier 1 helpdesk or HR staff. The web version of Adaxes is built for that very purpose! Below, you can see a screenshot of the helpdesk version of the web console that highlights the user management section:

The helpdesk version of the Adaxes web console

There is also a more complex administrator version of the web console for robust mobile work. The final part of the web console setup is the self-service portal. This page provides a simple way for standard users to edit their AD attributes. From here, they can upload thumbnail photos, rename themselves, change passwords, etc. There is even a tie in for self-service password resets that is driven from the Windows logon interface. Imagine all of the helpdesk calls a self-service portal can prevent. These three default configurations are not fixed. Each can be completely customized. You can even add additional Web Interfaces with own configurations.

The self service portal in Adaxes

AD Object Management – Streamlined

I never saw anything wrong with creating a user in ADAC until I created one in Adaxes. This is even with PowerShell creating many of my users beforehand. Adaxes simplifies the entire process. What exactly is wrong with creating users in ADAC:

No standardization. Names can be omitted, rearranged, etc. This can lead to an assortment of naming conventions on display names and logon names
Temptation to enter standard/poor passwords and issues with password complexity
Having to finish setting up the user after creation (ex: create a mailbox or add in attribute data through account properties).

When an account is created with Adaxes, these problems do not exist. Take the screenshot below as an example. After typing the first and last name of a user, the user logon name is automatically generated based on your configured value. The display of the full name is configured by a custom value that you can configure as well. This generation is carried over into the Web UI. Regardless of the interface, that practically any AD attribute can be automatically generated or restricted to certain values. This provides a great deal of flexibility while ensuring standardization.

Logon Name generation in Adaxes

Passwords for users can be generated and in the same window, you can view the password policy. The next screens allow you to generate a mailbox and email for the user as well as configure user attributes.

A lot of thought went into improving the AD management experience. This same attention to detail is in each process that Adaxes controls. The crazy thing is, I now see other ways to take this even further (for example – adding a copy groups feature so that a new user’s group membership is copied from an existing user).

If I had to bet, the developers of Adaxes were Active Directory administrators that got tired of being inefficient. By using Adaxes, you can provide a custom AD management experience to different personnel. You can delegate account maintenance to trusted individuals or even enable a self service infrastructure. Finally, any work that you do is made quicker and easier with the streamlined wizards. You can live demo Adaxes or setup a free trial here.

Extending Folder Redirection: Data Deduplication, Volume Shadow Services, and Offline Files

Posted on May 4, 2015 by Joseph Moody

So you enabled Folder Redirection and got pulled off to another 100 projects. Believe me, I completely understand. Though Folder Redirection is working for you, you can take it so much further! Welcome to part three of our Folder Redirection series. To get the most out of Folder Redirection, we will configure three technologies to save you space, time, and a few headaches – in order: Data Deduplication, Volume Shadow Services, and Offline Files.

Using Data Deduplication with Folder Redirection

We previously covered data deduplication and used an SCCM primary site server in our example. You can read that guide here. When data deduplication is used with Folder Redirection, you have to make a few extra changes. Go ahead and enable the data deduplication role; then select the data deduplication properties for your volume.

Ensure the data deduplication type is set to General purpose file server. In our environment, we found that the default file age was a bit too aggressive because files changed so often. For our configuration, files won’t be deduplicated until they are 10 days old. We also exclude three file types: pst, xls, and db. When deduplication scrubbing would occur, file corruption errors were being logged in Event Viewer. Oddly, they only involved these three file types.

As a side note, this corruption issue made me explore a way to automatically convert older Office files (.doc, .xls, .ppt) to the Office 2007 format. This prevents the file corruption issue that I saw and saves a ton of storage space (as the new file format is 1/10 the size of the older file format). Expect a write up on that process soon. Data deduplication with folder redirection is simple to setup and very useful with folder redirection. Knowing these caveats will ensure a successful roll out.

Using Volume Shadow Services with Folder Redirection

Volume Shadow Services, also known as Shadow Copies, allow users to restore their own files from a previous point in time. The next time a user overwrites a critical document, he can right click on the file – choose Restore Previous Versions – and restore the file without calling the helpdesk. I love saving future me time!

To enable Shadow Copies, launch Explorer and open the properties of your data volume. Select the shadow copies tab and press enable. Select Settings and set a Use limit.

If you prefer more than two snapshots a day, adjust the schedule now. More snapshots allow you a greater amount of flexibility in backups but reduce how far back you can restore. Your staff can now restore their own files and folders – you just have to train them now. 🙂

Using Offline Files with Folder Redirection

Offline Files received a bad reputation with XP (and for good measure). It was constantly visible by slowing down logouts, presenting sync errors. Offline Files in Windows 7 and above is nearly maintenance free.

Why would you want to enable Offline Files though? Three reasons: roaming users, insurance, and speed. Users with laptops/tablets are able to work offline and have their changes sync with they are connected to your network. Offline Files also gives you some flexibility when a user’s machine becomes disconnected due to network/power issues or if your file servers are offline. Users are still able to access documents and work. Finally, Offline Files improves folder redirection speed.

When a user first logs in with Offline Files enabled, local files that will be redirected are moved to the Offline File cache (C:\Windows\CSC\) and are then synced up to your file server. This allows the user to log on faster as the Folder Redirection CSE is able to finish sooner. When Offline Files are not enabled, users have to wait for these files to copy to your server. Copying within disk is always faster than over the network.

The Group Policy settings for Offline Files can be found at: Computer Configuration\Policies\Administrative Templates\Network\Offline Files. Depending on your OS, Offline Files is enabled or disabled by default. To ensure that Offline Files is enabled no matter the OS, find the Allow or Disallow use of the Offline Files feature and set it to enable. In our environment, this setting is applied to primary machines only – labs and common use areas do not get Offline Files.

Redirected folders are automatically cached for Offline Files. You can assign other folders to cache by enabling the Specify Administratively Assigned Offline Files setting. Good candidates for this setting might be folders where software retrieves network data. Setting these folders to cache would allow a user to access this information offline. Locations where many users will write to simultaneously should not be specified here.

And that wraps up post three of our Folder Redirection series. In the next part, we will tackle remote file access for folder redirection.

Monthly Archives: May 2015