October 1st is a very nerve racking day. Just under 1000 Microsoft MVPs wait anxiously to find out if they have been awarded for another year. Earlier today, I received my email for an MVP award for 2015 in the expertise of Cloud & Server Installation and Servicing.
Suffice to say, I am extremely grateful to Microsoft for this award and to all of you for reading this blog, keeping me on my toes and always asking questions. Now, I’m off to enjoy a very special rum and coke with my wife!
File Screens, a feature of the File Server Resource Manager tool, allows administrators to restrict the type of files that can be stored on a share. It is both useful and infuriating. Useful to me as I can enable it on our student’s redirected folder location. Infuriating for students because they can’t save any EXEs in this location.*
File Screens has a downside though. It is an all or nothing approach to file type filtering. In the example above, users are either allowed or blocked from saving executable files on the HomeFolders location. The result is dependent on if the rule is active or not.
Let’s say that you don’t really mind that a user saves an executable to their redirected downloads folder. You might have asked a user to download an application so you can deploy it. Or a user might need to run a small application once (such as a online meeting plugin). When file screens are enabled, your users get a nasty accessed denied error. What is needed is something a bit more flexible – say, a PowerShell script (or two).
Our first script allows a trial run on your share or DFS Namespace. You will need to modify the Get-ChildItem path in the first line to match your environment. The script will search for any file in that location that has an .EXE extension and has a Last Write Time older than 7 days ago. Each file is then marked as hidden. This allows us to simulate a -whatif scenario.** If you want to see what files will be marked as hidden, run just the $Files line and see what is contained in that variable.
$Files = Get-ChildItem "\\Test.local\data\Staff\" -Recurse | Where-Object {$_.Extension -eq ".EXE" -and $_.Lastwritetime -lt ((Get-Date).AddDays(-7))} | sort Lastwritetime
foreach ($File in $Files){
$(Get-Item $File.FullName).Attributes = 'Hidden'
}
If your environment is like mine, no one will notice that their EXEs are missing. When you feel confident to actually remove the files (and have a valid backup), run the second script. It has a slightly modified foreach loop that calls the Remove-Item Cmdlet. If the $File item is successfully removed, the file details are written to .\DeletedFiles.csv. The Get-ChildItem and Remove-Item Cmdlets use the additional -force parameter in this script. This parameter allows both Cmdlets to interact with hidden and read-only files. This is needed if you marked all of your EXEs as hidden with the first script.
$Files = Get-ChildItem "\\Test.local\data\staff" -Recurse -Force | Where-Object {$_.Extension -eq ".EXE" -and $_.Lastwritetime -lt ((Get-Date).AddDays(-7))} | sort Lastwritetime
foreach ($File in $Files){
Remove-Item -Path $File.FullName -Recurse -Force
if ($? -eq $True){
$File | export-csv .\DeletedFiles.csv -NoTypeInformation -Append
}
}
These two scripts saved almost 60GB of storage in my environment and I hope they help your servers out as well! I now use file screens on certain shares and this script on other shares. And if you are getting tired of folder redirection, don’t despair – you only have two more articles in this series to read. 🙂
*AppLocker would prevent an EXE from running in this location.
**Though now that I think of it, modifying the ACLs on the EXE to add an deny would have been a better way of simulating the actual delete.
Pictures and videos consume the most space in the redirected folders of my users. While I don’t have a great solution for videos yet, I cobbled together a few PowerShell scripts into a single solution. The script below will search a root folder (\\Test\FR\Staff\) and work through each user’s subfolder (\\Test\FR\Staff\jmoody\). It will find any picture greater than your specified resolution and reduce it to a more appropriate size. Even small environments could save several 100 GBs!
I wanted to see how big of a difference this re-sizing could make. I modified the script output to keep the old photo for comparison. To show you the size difference, look at the screenshot below. The new photo is almost 30x smaller than the original photo! On my 1920×1080 monitor – I can see zero difference in quality.
In the very first line of the PowerShell script, you will need to set your domain name. The next three $UserFolders lines are examples searches. The first will convert pictures only in the Jmoody subfolder. The second will convert the first 10 folders in the root folder. The final example will convert all folders. As you implement this script in your environment, I recommend a roll-out using those three examples. For safety, keep extending the select -first example until you are comfortable converting every picture that is in your folder redirection share.
Here is the script – I’ll meet you with some more information below it. If your mouse wheel breaks while scrolling down, remember that you can still use the Page Down button on your keyboard. 🙂
I thought I knew a lot about Network Policy Server (NPS). The last few months have taught me differently. It started with my mad grab to enable AD authentication on any network device that supports it. Next, I got the joyful job of wading into the world of wireless. Alliteration aside, this led to a complete overhaul of our wireless infrastructure. By using NPS, our environment now uses a single SSID that dynamically VLANs objects based on how they authenticate.*
Both of these projects had their fair share of problems to overcome. Let’s talk about two tricks today; one learned from each project. The first makes NPS easier to manage by simplifying clients. The second makes NPS easier to manage by increasing redundancy.
Many network administrators group devices by their type and IP. For example, all network switches in at a site might be in a dedicated range or a specific portion of a subnet. When creating RADIUS clients, think about how the clients can be grouped. In the screenshot below, you can see two clients. The first IP address is actually a range. My 10.94 IP range actually a /20 at that site. All of my switches though are located in the first 254 addresses. The second IP address show how clients used to be managed – one IP at a time.
I now use the single RADIUS client IP of 10.94.0.0/24 to allow authentication to all of my switches at that site. If I add a new switch at that location, I don’t have to remember to also create a RADIUS client for it because it is automatically included.
If another type of device happens to be in that range, no big deal. For any kind of a security risk, that device would have to be:
Using IP ranges instead of single IP addresses makes RADIUS client management so much easier!
Having all of this fancy authentication is of little good if your Network Policy Server is offline. To be redundant, you need a second server running NPS with your RADIUS clients configured to contact it as a backup service. For switches, this is as simple as adding a separate radius-server host command in your configuration. HP Switches, at least, contact RADIUS servers in a top – bottom order in their configuration. Other devices typically allow you to specify multiple RADIUS entries in their web interface.
The next step is to keep your servers in sync with each other.** PowerShell makes this incredibly easy. Copy the below script, written by JGrote, and save it on your secondary Network Policy Server. Be sure to configure the two variables under the ###Variables section.
###Network Policy Server Synchronization Script
#This script copies the configuration from the NPS Master Server and imports it on this server.
#The Account that this script runs under must have Local Administrator rights to the NPS Master.
#This was designed to be run as a scheduled task on the NPS Secondary Servers on an hourly,daily, or as-needed basis.
#Last Modified 01 Dec 2009 by JGrote <jgrote AT enpointe NOSPAM-DOTCOM>
###Variables
#NPSMaster - Your Primary Network Policy Server you want to copy the config from.
$NPSMaster = "NPS1.Test.local"
#NPSConfigTempFile - A temporary location to store the XML config. Use a UNC path so that the primary can save the XML file across the network. Be sure to set secure permissions on this folder, as the configuration including pre-shared keys is temporarily stored here during the import process.
$NPSConfigTempFile = "\\NPS1.Test.local\C$\NPSConfig-$NPSMaster.xml"
#Create an NPS Sync Event Source if it doesn't already exist
if (!(get-eventlog -logname "System" -source "NPS-Sync")) {new-eventlog -logname "System" -source "NPS-Sync"}
#Write an error and exit the script if an exception is ever thrown
trap {write-eventlog -logname "System" -eventID 1 -source "NPS-Sync" -EntryType "Error" -Message "An Error occured during NPS Sync: $_. Script run from $($MyInvocation.MyCommand.Definition)"; exit}
#Connect to NPS Master and export configuration
$configExportResult = invoke-command -ComputerName $NPSMaster -ArgumentList $NPSConfigTempFile -scriptBlock {param ($NPSConfigTempFile) netsh nps export filename = $NPSConfigTempFile exportPSK = yes}
#Verify that the import XML file was created. If it is not there, it will throw an exception caught by the trap above that will exit the script.
$NPSConfigTest = Get-Item $NPSConfigTempFile
#Clear existing configuration and import new NPS config
$configClearResult = netsh nps reset config
$configImportResult = netsh nps import filename = $NPSConfigTempFile
#Delete Temporary File
remove-item -path $NPSConfigTempFile
#Compose and Write Success Event
$successText = "Network Policy Server Configuration successfully synchronized from $NPSMaster.
Export Results: $configExportResult
Import Results: $configImportResult
Script was run from $($MyInvocation.MyCommand.Definition)"
write-eventlog -logname "System" -eventID 1 -source "NPS-Sync" -EntryType "Information" -Message $successText
Create a scheduled task on your secondary server that calls powershell.exe with this script as a parameter. The screenshot below shows the syntax for this action. Set the task to run on a regular schedule. Our environment syncs once per day.
The account running this task needs Modify/Read permissions to the NPSConfigTempFile variable location as well as the ability to read the primary Network Policy Server configuration. Once setup, run the task and ensure that your primary configuration syncs to your secondary server.
Your environment now has a secondary server running NPS that will authenticate any client created on your primary server! Do you have any other tips for managing NPS?
*My goal with any article is to help the most amount of people possible. This means I don’t often write about specific technologies or products. If anyone would like more information about this, just leave a comment or shoot me an email.
**I wanted to make a boy band joke here so bad. Any suggestions?
There are few things I love more than hearing, “This software requires Administrator rights.” Statements like this make me irritable and elated at the same time. An odd combination. On the one hand, I am irritable at that developer who can’t be bothered to follow best practices. On the other hand, I can’t wait to prove them wrong.
Though this guide won’t fix every single application that requires admin rights, it will solve the vast majority of these issues. We can break down administrative requirements into some pretty broad categories such as: file permissions, registry permissions, and User Account Control issues. Let’s talk about solutions for these three big problems.
Standard users can write to just a few locations on a local machine by default. The primary location they control is their own user profile. Applications that write outside of these locations need additional permissions delegated to work properly with a standard user account. We have to overcome two problems to solve this issue:
If the application is nice enough to say, “Hey – I can’t write to C:\StupidApplication\”, proceed to problem 2. If the developer doesn’t follow best practices with permissions, they probably don’t write helpful error messages either. Microsoft’s Process Monitor will show us what permissions are needed and it can be downloaded from here.
Ideally, install and run Process Monitor on a dedicated VM that has little else running on it (no AntiVirus, no indexing, etc). Process Monitor can be a little overwhelming at first. Like that annoying friend with no filter, it will literally tell you everything. Start your application as a standard user and reproduce any errors that you’ve received. Stop the capture in Process Monitor. Find your application in the capture, right click and filter only to it. You should now see exactly what your application is doing and the permissions needed to do it. Looking through the logs, you can further filtered to DENIED actions and see the exact permission that are needed.
Launch the Group Policy Management Console and create a new GPO named APP_Your Application Name (ex: APP_Adobe Reader). I prefer keeping all related settings, such as security settings or preferences, in a single GPO. Navigate to Computer Configuration/Policies/Windows Settings/Security Settings.
Right click on File System and Select Add File. From here, you can browse to the exact file or folder that needs additional permissions assigned. In the screenshot below, I’ve already added C:\Program Files\Meals Plus. Group Policy will automatically change any hard coded paths (like C:\Windows or C:\Program Files) to their correct variables. If a program can be installed in multiple locations (Program Files (X86) or Program Files), create a separate File permission setting for each.
The File System security settings in Group Policy allow you to easily deploy file and folder permissions to your clients. Though rarer, some applications might also need additional permissions to the registry. For example, an application may right a license key or registration information to HKEY Local Machine. Process Monitor is still used to find the requirements and Group Policy is still used to deploy the required settings.
Registry permissions are configured at Computer Configuration/Policies/Windows Settings/Security Settings/Registry. Right click on Registry – select Add Key. Navigate to the key that needs the extra permissions assigned. If the key does not exist on your computer, you can paste a key path directly into Selected Key location. As a note, you can also paste file and folder paths directly into the This Folder box under File System.
Occasionally, you will have an application that triggers a User Account Control (UAC) prompt when the application doesn’t require elevated rights. Don’t get mad at Microsoft for this one – the unnecessary UAC prompt is a result of shoddy coding. Preventing the UAC prompt can be accomplished in two ways:
Because readers of this blog are never stupid, let’s take the easy way and create an application shim. Start by downloading and installing the Microsoft Application Compatibility Toolkit. Currently, it is part of ADK. Launch the Compatibility Administrator tool. Under Custom Databases, select New Database and press the Fix button in the toolbar. Name your application fix and browse to the executable that needs a bit more persuasion to work right.
Under Additional compatibility modes, scroll down and select RunasInvoker. You can press Test Run now to see if the application starts correctly. If it does, continue through the rest of the wizard. This tool can also be used to set other compatibility settings such as setting an application to run in particular mode for an older OS.
Save your database and it will generate an shim with the file format .sdb. You can deploy this fix by using a startup script (in Group Policy) or an application dependency(in SCCM). The script should simply run: sdbinst.exe .\applicationfix.sdb
We covered file/folder and registry permission changes with Group Policy and creating a shim for UAC. What other tricks do you use to fix applications that require administrator right