Category: Servers

My Computer Shows Network Drive Red Xs

Kept getting calls from clients about their network drives “disappearing” or disconnecting throughout the day at “random” intervals, so after much troubleshooting found these steps to take on the workstations and file server to help alleviate the issue:

Network Drive Red Xs On the Workstation:

1. Click on Start button then choose Control Panel
2. In Control Panel open the Device Manager
3. Expand the Network Adapters and open each one used on that workstation
4. Look in the Power Management tab and Advanced tabs to look for any power settings that would disable the device then uncheck them. Click OK button and close all other windows.
5. Open the Registry Editor.
6. Expand the tree to the following key:

HKLM\SYSTEM\CurrentControlSet\Service\lanmanworkstation\parameters

7. If it doesn’t exist then create a REG_DWORD named KeepConn with the Decimal value of 86400 (aka 24 hours)
8. Reboot the workstation for changes to take effect.

Network Drive Red Xs On the Server:

1. Login as administrator
2. Open Command Prompt as administrator
3. Type in the following to disable Auto Disconnect of network drives:

net config server /autodisconnect:-1

4. Reboot the server for changes to take effect.

Configure Server 2012 VPN Connections

Here are the basics to configure Server 2012 VPN connections to the local network. This is preferred by Farmhouse Networking over a third party vendor software or router based solution because of its native functionality and integration with domain credentials – think Single Sign On (SSO) or one password to access it all.

Install the Routing & Remote Access Service (RRAS) Role

1. Start the Server Manager
2. Click Add Roles and Features from the Manage Menu
3. On Add Roles and Features wizard begins and click Next
4. Select the Role-based or feature-based installation option and click Next
5. If you have more than one server managed via the server manager console, then select the desired server you’d like to install Routing and Remote Access on
6. From the Roles lists select Remote Access, click Add Features on the popup window
7. Click Next
8. Click Next as no additional features are needed
9. Select DirectAccess and VPN (RAS), click Next
10. Click Next
11. Accept default selections and click Next
12. Click Install
13. When installation is completed, click Close

Initial Server 2012 VPN Configuration

1. From the Server Manager screen, click on the warning sign and click ‘Open the Getting Started Wizard’
2. On Configure Remote Access, click Deploy VPN Only.
3. From the Routing and Remote Access MMC, right-click on the server and click ‘Configure and Enable Routing and Remote Access’
4. Click Next on the wizard
5. Select Custom Configuration
6. Select VPN access
7. On completion, click Finish
8. Click Start service to start the RRAS, then wait for the service to startup.

Add IPv4 IP Address Range

1. From the Routing and Remote Access MMC, right-click on the server and click ‘Properties’
2. Under properties screen click IPv4 tab, select Static address pool, click Add and enter the desired IP address range on the windows popup
3. Click OK to close

Open Ports on Network Firewall

For compatibility, here are the ports to open for both Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Tunneling Protocol (L2TP) on the network firewall:

500, 1701, 1723 & 4500

Need to open IP Protocol 47 also on the router to allow PPTP Passthrough.

(Note: On SonicWall routers, you will need to create address objects for internal / external IP addresses, service group containing all the above ports, NAT rule for PPTP traffic and firewall rule allowing the service group from the external to the internal IP address.)

Enable Remote Access for users

Open the properties of a domain user account via Active Directory Users and Computer MMC. Click on Dail-in, under Network Access Permission click Allow access

If your company is in need of a robust and simple to use Windows Server 2012 VPN connection to your LAN resources, then contact us for assistance.

Command Line Configuring TCP/IP Addressing

Recently had an issue where a client needed to have their IP address statically assigned and the thought came to mind that my Remote Monitoring software was able to give me command line access, so I thought I would try configuring TCP/IP addressing via the command line interface and not have to interrupt the end users work. Here is how to get it done:

netsh interface ip set address name="Local Area Connection" static [static IP] [subnet mask] [default gateway] 1

That gets the IP address, subnet mask and default gateway – so what about static DNS? Here is the next step:

netsh interface ip add dns name="Local Area Connection" addr=[DNS address #1]

netsh interface ip add dns name="Local Area Connection" addr=[DNS address #2] index=2

If your company need remote assistance or help planning / maintaining / configuring TCP/IP addressing in your network infrastructure, then contact us for assistance.

Scheduled Windows Server Restart

There have been innumerable times that I have had to schedule a Windows Server restart for after hours so that I don’t have to log back in after hours to do this manually. So here is a quick command to schedule a reboot at 11:59 PM (copy & paste for greater degree of simplicity):

schtasks /CREATE /SC once /TN “Windows Server Restart” /TR “shutdown /r /t 0 /f” /ST 23:59 /RL highest

This should be done within an administrative command prompt. Leave the server logged in for it to complete successfully (this is highly recommended not to do) or change the one setting in the Task Scheduler to run the Windows Server Restart task as a particular user.

Setup Microsoft Mobile Device Management (MDM)

Recently had some issues where another tech company was unable to properly setup MDM for their clients, so reviewed the documentation and their current efforts then came to the conclusion that they had skipped a couple steps in the initial setup that were causing the issue. Here is the proper initial setup steps:

Activate Mobile Device Management in Office 365

1. Sign in to Office 365 as an administrative user
2. Click on the Admin pane
3. Click on Mobile Management on the list to the left hand side
4. Click on the “Get Started” button
5. Wait awhile (5 minutes to 2 hours) for the setup to complete

Configure Initial Domain DNS Settings

1. Back in the Mobile Management section, look for the red x circle and click on “Manage settings”
2. First to configure custom DNS needed for automatic configuration, click on the “Set up” next to “Configure domains for MDM”
3. Click on the primary domain used for Autodiscover, etc. then click on “Domain settings”
4. Under “Domain purpose” click on “Change domain purpose”
5. Put a check next to “Mobile Device Management for Office 365” then click on “Next”
6. Take note of the following cname records:

enterpriseregistration enterpriseregistration.windows.net 3600
enterpriseenrollment enterpriseenrollment.manage.microsoft.com 3600

7. Enter these into the customers custom DNS records along with any others that are listed on that page which weren't entered previously.
8. Return to this page to confirm that the DNS settings have changed properly.

Configure Apple Push Notification (APN) Certificate

1. Back in the Mobile Management section, look for the red x circle and click on “Manage settings”
2. Click on “Set up” next to “Configure an APNs Certificate for iOS devices” to request the needed certificate to manage Apple devices.
3. Click on “Download your CSR file” to save the file locally then click “Next”
4. Click on “Apple APNS Portal” to open the Apple Push Certificates Portal
5. Sign in with a valid (hopefully domain associated) Apple ID
6. Click on the “Create a Certificate” button
7. Agree to the Terms of Use
8. Upload the Certificate Signing Request (CSR) that was save locally earlier
9. Download the new Mobile Device Management certifcate and save it locally
10. Go back to the “Install Apple Push Notification Certificate” page and click “Next”
11. Upload the new Mobile Device Management certifcate tjat was saved locally from Apple

Configure Basic Mobile Device Management Policy

1. Create a Security Group in Active directory that will be used to apply the MDM policy and run DirSync manually.
2. Back in the Mobile Management section, click on “Manage device security policies and access rules”
3. Click on the + to add a new policy
4. Give the policy a name and click “Next”
5. On the pop-up page leave the defaults and check next to “Require managing email profile (required for selective wipe on iOS)”
6. Also select “Block access and report violation” to keep users off the network until they comply with the new policy then click “Next”
7. On the following page there are additional option that give additional security but are not required, when done click “Next”
8. Change selection to “Yes” and chose the Security Group in Active Directory that will be used for MDM enforcement then click “Next”
9. Click on “Finish” to begin enforcing this new policy

The next time any user opens an associated Office App on their supported devices it will ask them to start the enrollment process which goes through a compliance check which usually requires them to delete their current Exchange Active Sync profile to continue.

Special thanks to the guys at ExchangeServerPro.com for their blog entry with the basics. Also a thanks to the Microsoft Office Blog Team for their detailed look at MDM policy setup.
If your company is using Office 365 or has a Bring Your Own Device (BYOD) policy which need mobile device management, then contact us for assistance.

Create Office 365 Shared Calendars

Often when migrating a client from on-premise Exchange server to the Office 365 platform, the company will have an Exchange pubic folder shared calendar or two that are used for various reasons. Here is the steps for creating the new kind of Office 365 shared calendars:

Creating a Public Folder Mailbox

1. Open the Office 365 portal with an administrative user
2. Open the Admin panel
3. Open the Exchange Admin panel
4. Click on Public Folders, then on the Public Folder Mailboxes
5. Click on the + symbol then give the new Public Folder Mailbox a name and click Save

Creating the Root Public Folder

1. Still in the Public Folders section click on Public Folders at the top
2. Click on the + symbol then give the new Public Folder Mailbox a name and click Save
3. Click on the new Public Folder then on the right hand side click on Manage under Folder permissions
4. Add all administrator users to the Folder Permissions

Creating the Shared Calendar Public Folder

1. Open Outlook on administrative users workstation who will be the "Owner" of the folder
2. Click on Folders at the bottom and expand into the new root Public Folder
3. Right click on the root and choose Add New Folder
4. Give it a name and choose Calendar Items under folder contains then click OK
5. Right click on the new Public Calendar click on Properties then on Permissions tab
6. Add all users who will be accessing the calendar and appropriate permissions for them

Adding the Calendar folder to Outlook

1. Open Outlook on each users workstation
2. Click on Folders at the bottom and expand into the new Public Calendar
3. Right click on the Public Calendar and choose Add to Favorites which then makes it listed under their calendar tab.

If your company is migrating from on-premise Exchange to Office 365 or are in need of an Office 365 Shared Calendars setup, then contact us for assistance.

Network Ransomware Infection Best Practices

After several clients have faced this issue, it time to write out some best practices for how to immediately deal with an infection from one of the Cryptolocker / Cryptowall network ransomware infection variants. These usually infect a single workstation on the network, encrypt all local files, encrypt all network file shares and leave an instruction file on how to pay for the decrypt key in every folder. A good backup of the network file servers is key for this network ransomware infection not to do devastating damage to a company.

Steps for cleaning up after the network ransomware infection:

1. Login to file server and find one of the instruction files (usually HELP_DECRYPT.txt or decrypt_instruction.html) on the affected network share.
2. Right click on the file, chose Properties and click on the Details tab. The Owner listed is most likely the username for the person using the only infected computer on the network.
3. Isolate this machine from the network, deep virus clean or wipe / reload the operating system to get rid of the infection.
4. It is also good to run basic virus scanning on all workstation and servers on the network to determine if further infection has happened. Clean as needed.
5. It is good to know all the infected files on the file server, so here is a Powershell script to do so (change the instruction file as needed):

get-childitem [local path of file share] -include HELP_DECRYPT.* -recurse | select fullname >> C:\TEMP\InfectedFiles.txt

6. Send a copy of an encrypted file and of one of the instruction files to your Antivirus vendor because obviously they missed something.
7. Next comes the cleaning of the instruction files, so more Powershell to automate this (change the instruction file as needed):

get-childitem [local path of file share] -include HELP_DECRYPT.* -recurse | foreach ($) {remove-item $.fullname}

8. Use backup software to restore affected file shares to an alternate location.
9. Copy / replace files into their original location from the alternate location.
10. Test to make sure that users are able to get back into their files.

If your company has been infected with a network ransomware infection or would like to be proactive about protecting your important company files from disaster, then contact us for assistance.

Office 365 Email Distribution Group

Had a client that was using Office 365 Directory Synchronization (DirSync) to manage their users / groups in Office 365 via the local Active Directory which meant that there was not end-user manageability of those groups. A user asked to have a new email distribution list created that they could manage, so performed the following to make that happen:

Create an Office 365 Email Distribution Group

1. Open Active Directory Users and Computers.
2. Navigate to where in the hierarchy that the Distribution Group will be created.
3. Right click on the Organizational Unit where it is to be created and choose New then Group.
4. Give the Group a name and leave the default Group scope of Global and change Group type to Distribution then click OK button.
5. Double click on the new group to open it. Type in the email address to use then click on the Attribute Editor tab.
6. Scroll down and double click on the proxyAddresses item. Add the email in the format SMTP:[username@domain.com] then click on the Add button and OK button.
7. Click on the Managed By tab and click on the Change button to search for the user who will be the group administrator.
8. Click OK button then run a manual DirSync to send the changes to the cloud.
9. Open the group administrators Outlook.
10. Click on the Address Book button.
11. In the Address Book drop down list choose the Global Address Book (this may take some time to download the update).
12. Find the newly created Distribution Group and double click to open then click on the Modify Members button to add users.
If your company is using Office 365 and needs end users to manage their Office 365 Email Distribution Group, then contact us for assistance.

Exchange User Calendar Adding Permissions

Had a request to allow all users access to the new hires Exchange user calendar and some researched determined that this was not a job for the Exchange Managememt Console GUI. Instead it required a bit of PowerShell scripting to get the job done. It is best to run Get-MailboxDatabase before editing the script to retrieve the [Database Name] and [Username]. Here is the final product for accomplishing this task:

Add Exchange User Calendar Permissions via Powershell

$mailboxes = Get-Mailbox -Database “[Database Name]”
$AccessRights = “Reviewer”
$newusername = “[Username]”

foreach ($mailbox in $mailboxes) {

$calendar = (($mailbox.SamAccountName)+ “:\” + (Get-MailboxFolderStatistics -Identity $mailbox.SamAccountName -FolderScope Calendar | Select-Object -First 1).Name)

Write-Host “Updating calendar permission for $mailbox…” -ForegroundColor Yellow

add-MailboxFolderPermission -User $newusername -AccessRights $AccessRights -Identity $calendar

}

If your company is using on-premise Microsoft Exchange User Calendar or needs any help migrating to Office 365, then contact us for assistance.

ShadowCopy Quickly Saves Your Bacon

In my opinion this feature is simply a must for all servers and stand alone workstations – ShadowCopy otherwise known as previous versions. As per Microsoft:

Previous versions are automatically saved as part of a restore point. If system protection is turned on, Windows automatically creates previous versions of files and folders that have been modified since the last restore point was made. Typically, restore points are made once a day. If your disk is partitioned or if you have more than one hard disk on your computer, you need to turn on system protection for the other partitions or disks.

To enable and configure ShadowCopy of Shared Folders:

1. Go to Administrative Tools and then click Computer Management .
2. In the console tree, right-click Shared Folders, click All Tasks, and then click Configure Shadow Copies.
3. In Select a volume, click the volume that you want to enable Shadow Copies of Shared Folders for, and then click Enable.
4. You will see an alert that Windows will create a shadow copy now with the current settings and that the settings might not be appropriate for servers with high I/O loads. Click Yes if you want to continue or No if you want to select a different volume or settings.
5. To make changes to the default schedule and storage area, click Settings.
If your company has important files shared on a network and would like to prepare in advance of a disaster to protect them, then contact us for assistance.

Archives

Categories

Plant a Seed @ 541-761-9549
233 Rogue River Hwy #873 Grants Pass, OR 97527
Mon-Fri: 9:00am-5:00pm
support@farmhousenetworking.com
© 2016-2025 - Farmhouse Networking. All rights reserved
Terms and Conditions Privacy Policy

Evaluation Signup

Error: Contact form not found.

And God will generously provide all you need. Then you will always have everything you need and plenty left over to share with others. As the Scriptures say,
“They share freely and give generously to the poor. Their good deeds will be remembered forever.”
For God is the one who provides seed for the farmer and then bread to eat. In the same way, he will provide and increase your resources and then produce a great harvest of generosity in you. - 2 Corinthians 9:8-10