Tech Blog

File Server Audit Logging via Group Policy

Recently going through the HIPAA compliance standards and dealing with “accidentally” deleted items on a file share has lead to a need for a standard file server audit logging policy that can be deployed to all servers via Group Policy Object (GPO). Here is the summation of my research:

File Server Audit Logging Policy GPO

1. Create a GPO and name it File Server Audit Policy
2. Set the following settings to enable advanced features and disable shutdown:

[Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\]
Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings – Enabled
Audit: Shut down system immediately if unable to log security audits – Disabled

3. Move down the tree structure to the following and edit these various auditing settings:

[Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\]
Account Logon: Credential Validation – Success and Failure
Account Management: Computer Account Management – Success
Account Management: Other Account Management Events – Success and Failure
Account Management: Security Group Management – Success and Failure
Account Management: User Account Management – Success and Failure
Detailed Tracking: Process Creation – Success
Logon-Logoff: Logoff – Success
Logon-Logoff: Logon – Success and Failure
Logon-Logoff: Special Logon – Success
Object Access: File System – Success
Policy Change: Audit Policy Change – Success and Failure
Policy Change: Authentication Policy Change – Success
Privilege Use: Sensitive Privilege Use – Success and Failure
System: IPsec Driver – Success and Failure
System: Security State Change – Success and Failure
System: Security System Extension – Success and Failure
System: System Integrity – Success and Failure

4. Change the following Maximum Log Size (KB) settings according to http://support.microsoft.com/kb/957662:

[Computer Configuration\Administrative Templates\Windows Components\Event Log Service\Security\]

5. Open the Properties of the shared folder needing Auditing, click on Security tab and then on the Advanced button
Folder Security Properties Page
6. Click on the Auditing tab, if there is UAC prompt then click Continue and then click on the Add button

Folder Advanced Security Settings
7. Click on Select Principal, search for the Everyone security group and then click on the OK button
8. Change the Type to All, click on Show advanced permissions, check the boxes next to “Delete subfolders and files” and “Delete” and then click on the OK button
File Server Audit Logging Entry
9. Put a check next to “Replace all child object auditing with inheritable auditing from this object then click on the OK button
If your company is using a Windows Server for network file access and need help getting the File Server Audit Logging setup property for HIPAA compliance, then contact us for assistance.

Terminal Server Lockdown Group Policy

Recently have had to setup a couple terminal servers and wanted to create a list of standard lock downs that can be added via a Terminal Server lockdown Group Policy Object (GPO).

Terminal Server Lockdown Preparation

1. Open Active Directory Users & Computers
2. Create Organizational Unit (OU) for Terminal Server.
3. Move all terminal servers to this OU.
4. Create Security Group in this OU for users who will use Remote Desktop Host (i.e. Terminal Server Users).
5. Add all users who will use the terminal server as members of this security group. 6. Open Group Policy Management, right click the new Terminal Server OU and “Create a GPO in this domain, and Link it here” (i.e. Terminal Server Lock Down).
7. In Security Filtering delete Authenticated Users, add Terminal Server Users security group created in previous step.

Configure users who can connect to the server remotely:

1. Log into the terminal Server
2. Open Control Panel, open System, click on Remote Settings then click on the Remote tab.
3. Click on Select Users, Remove any groups/users and then Add the Terminal Server Users security group.

Disable Server Manager Pop Up at user log on:

1. On Terminal Server open Task Scheduler.
2. Navigate to Task Scheduler Library\Microsoft\Windows\Server Manager.
3. Disable task “ServerManager” which triggers at log on of any user.

Configure Group Policy for Terminal Server Lock Down:

Loopback Processing:

[Computer Configuration\Policies\Administrative Templates\System\Group Policy]

Configure user Group Policy loopback processing mode: Enable – Merge

Disable Control Panel Items:

[User Configuration\Policies\Administrative Templates\Control Panel]

Hide specified Control Panel items: Enable

Add following items to the disallowed Control Panel items:
Microsoft.AdministrativeTools
Microsoft.AutoPlay
Microsoft.ActionCenter
Microsoft.ColorManagement
Microsoft.DefaultPrograms
Microsoft.DeviceManager
Microsoft.EaseOfAccessCenter
Microsoft.FolderOptions
Microsoft.iSCSIInitiator
Microsoft.NetworkAndSharingCenter
Microsoft.NotificationAreaIcons
Microsoft.PhoneAndModem
Microsoft.PowerOptions
Microsoft.ProgramsAndFeatures
Microsoft.System
Microsoft.TextToSpeech
Microsoft.UserAccounts
Microsoft.WindowsFirewall
Microsoft.WindowsUpdate
Microsoft.DateAndTime
Microsoft.RegionAndLanguage
Microsoft.RemoteAppAndDesktopConnections
Install Application On Remote Desktop Server
Java
Flash Player

Remove Administrative Tools and Powershell:

Restrict access to Administrative tools:

1. Navigate to:

[Computer Configuration\Policies\Windows Settings\Security Settings]

2. Right click on File System, choose Add File… .
3. In the Add a file or folder window, type the following in the Folder field and click OK:

%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Administrative Tools

Terminal Server Lockdown - Folder Security Settings
4. On the next window, Database Security, remove Users and check that Administrators have Full Access.
Database Security for Server Manager.lnk
5. On the Add Object window choose Configure this file or folder then Propagate inheritable permissions to all subfolders and files then click OK.
Terminal Server Lockdown - Add Object
6. Repeat the above steps for the PowerShell shortcut (in addition delete Creator Owner in database security):

%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\System Tools\Windows PowerShell.lnk

7. Repeat the above steps for the Server Manager shortcut:

%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnk

File Explorer Configuration:

[User Configuration\Policies\Administrative Templates\Windows Components\File Explorer]

Enable – Restrict A, B, C and D drives only: Hide these specified drives in My Computer

Enable – Remove Hardware tab

Enable – Hides the Manage item on the File Explorer context menu

Enable – Remove Security tab

Disable Registry Modification:

[User Configuration\Policies\Administrative Templates\System]

Enable – Prevent access to registry editing tools

Configure Windows Installer and Windows Updates:

[Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Installer]

Enable: Prevent users from using Windows Installer to install updates and upgrades

Enable Always: Turn off Windows Installer

[Computer Configuration\Administrative Templates\Windows Components\Windows Update]

Enable: Do not display ‘Install Updates and Shut Down’ option

[Computer Configuration\Administrative Templates\Windows Components\Windows Update]

Enable: Do not display ‘Install Updates and Shut Down’ option

Disable: Allow non-administrators to receive update notifications

Additional Policies:

[Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits]

Enable (i.e. 30 minutes): Set time limit for disconnected sessions

[Computer Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection/Remote Desktop Session Host/Session Time Limits]

Set time limit for logoff of RemoteApp sessions: Enable (i.e. logoff delay 1 hour)

[Computer Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection/Remote Desktop Session Host/Session Time Limits]

Set time limit for active but idle Remote Desktop Services sessions: Enable ( i.e. 1 hour)

[User Configuration/Policies/Administrative Templates/Start Menu and Taskbar]

Go to the desktop instead of Start when signing in or when all the apps on a screen are closed: Enable

[User Configuration/Policies/Administrative Templates/Start Menu and Taskbar]

Remove the Action Center icon: Enable

[User Configuration/Policies/Administrative Templates/Windows Components/Windows Update]

Remove access to use all Windows Update features: Enable (0 = Do not show any notifications)

[User Configuration/Policies/Administrative Templates/Windows Components/File Explorer]

Remove CD Burning features: Enable

[User Configuration/Policies/Administrative Templates/Windows Components/File Explorer]

Prevent access to drives from My Computer: Enable (choose the drives)

[User Configuration/Policies/Administrative Templates/Windows Components/Credentials User Interface]

Do not display the password reveal button: Enable

[User Configuration/Policies/Administrative Templates/Windows Components/AutoPlay Policies]

Turn off Autoplay: Enable (CD-ROM and removable media drives)

[User Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection]

Do not allow passwords to be saved: Enable

For detailed explanations of what each of these items does please see the notes in each individual Group Policy setting.

ScreenConnect Remote Access Tool

I have had the privilege of using a new remote support tool called ScreenConnect which was recently acquired. This tool has all the major features of other remote support tools including a built in screen annotation feature and OCR capability that feeds into the built in research tool. Looking forward to training and trying all the features of this wonderful new software.

Easily Transfer FSMO Roles Between DCs

To understand the need to transfer FSMO roles it is necessary to understand FSMO. As per Wikipedia – “Flexible Single Master Operations (FSMO) is a specialized domain controller (DC) set of tasks, used where standard data transfer and update methods are inadequate. Active Directory (AD) normally relies on multiple peer Domain Controllers, each with a copy of the AD database, being synchronized by multi-master replication. The tasks which are not suited to multi-master replication, and are viable only with a single-master database, are the FSMOs.”

When adding a new DC to a domain it often becomes the primary DC which means that a transfer FSMO roles will need to migrate. There are several ways to get this done, but this is by far the easiest I have found. Run the following PowerShell script from the new DC:

Move-ADDirectoryServerOperationMasterRole -Identity “[New DC Computer Name]” –OperationMasterRole PDCEmulator,RIDMaster,InfrastructureMaster,SchemaMaster,DomainNamingMaster

That command came from and special thanks go out to The Lazy Admin Blog.

Fab-ulous New Software Experience

Big thanks go out to the fellows at the PodNutz Podcast for the recommendation of Fab’s AutoBackup Pro as this has been one of the best investments I have made in automating my business in recent years. I was hesistant at its expansive claims to basically grab everything from every profile on an old computer or even removed hard drive and automatically put it into the associated new profiles on a target computer. The claims are all true and really have to be experienced to be believed, so don’t do this kind of thing manually anymore as Fab’s will take care of all the heavy lifting. It will move the following:

Fab moves Personal folders:

Windows desktop’s content
Windows desktop’s wallpaper
Quick Launch toolbar’s shortcuts (for Windows XP and Vista : this tool bar has been removed from Windows since Windows 7)
Windows Start screen/menu Modern UI layout (only shortcuts, not applications)
My Documents
My Pictures
My Music
My Videos
Downloads folder (Windows Vista/7/8/8.1/10)

Fab moves Web browsers:

Windows Internet Explorer favorites
Windows Internet Explorer main start page
Windows Internet Explorer settings (proxy, security zones…)
Microsoft Edge favorites
Google Chrome profile
Chromium browser profile
Apple Safari profile
Opera profile
Firefox settings : bookmarks, extensions…

Fab moves Mail:

Outlook Express messages and settings (mail accounts, rules…)
Microsoft Office Outlook PST/OST files and email accounts (messages, address book and calendar are stored in)
Outlook signatures files
Microsoft Office Outlook typed email addresses history
Windows Mail messages and settings
Windows Live Mail messages and settings
Windows Address book, used by outlook Express or Windows Mail
Mozilla Thunderbird messages and settings
PostBox messages and settings
IncrediMail messages and settings
Opera Mail

Fab moves Misc :

Windows Vista’s calendar
Sticky Notes
Screen saver settings (enabled or not, password protected or not, delay before activation)
Documents templates
Skype data and settings
Trillian data ad settings
ICQ data and settings
Windows Gadgets (installed by user)
Network drives connections
Network places
Picasa (albums and database)
BlackBerry Desktop settings
BlackBerry devices backups
Logitech SetPoint settings
Microsoft IntelliType Pro settings
Microsoft IntelliPoint settings
Apple IOS devices iTunes backups (iPhone, iPod, iPad)

Fab moves Common items:

Common documents
Common desktop
Common pictures
Common music
Common videos
Public Downloads folder (Windows Vista/7/8/8.1/10)
Fonts (useful if you have installed some by yourself or bundled with software)
Microsoft Office XP, 2003, 2007 and 2010 activation files (Microsoft Office 2013 is not handled)
Modem settings file (fichier rasphone.pbk), except credentials
Intuit QuickBooks data (experimental)
NCH ExpressInvoice data
Steam (downloads)
Installed printers list

Fab moves User defined:

Additional files (manual selection or using wildcards search on selected operating system partition)
Additional folders

I cannot say enough good things about this software. Buy it and tell everyone you know about it too.

Missing Active Directory Attribute Editor Tab

Ran into this issue a couple times now while migrating Small Business Server (SBS) clients from on-premis Exchange to Office365. After setting up the DirSync tool on the server, to add an email alias to a user’s Office 365 account it needs to be setup in the Active Directory Attribute Editor tab under the proxyAddresses attribute. The easiest way to do this is add a record as follows:

Add the Active Directory Attribute Editor Tab in Small Business Server

smtp:[useralias@yourcompany.com]

into the proxyAddresses section of the Attributes tab:

Active Directory Attribute Tab

This is normally easy to do and then run a manual DirSync to add the alias to the user’s Office 365 account, but what if the Attributes tab is missing? It is time to break out the ADSIedit tool again to make the needed changes to the way these pages are displayed. Here are the steps to get it done:

open ADSIedit.msc
Right click on ADSIedit and choose “connect to”
Under connection point select “select a well known Naming context” and in that window choose “Configuration”
Under computer leave as “Default (Domain or server that you logged into)” then click OK
Expand CN=configuration, DC=[your domain], DC=local
Expand CD=DisplaySpecifiers
Click on CN=your language. (The language # can be found on http://support.microsoft.com/kb/324097 for example US English is 409, so CN=409)
In the right hand window locate CN=User-Display right click and choose properties
Locate AdminPropertyPages, highlight it and click “edit” and add the line

11,{c7436f12-a27f-4cab-aaca-2bd27ed1b773}

In the right hand window locate CN=Computer-Display right click and choose properties
ocate AdminPropertyPages, highlight it and click “edit” and add the line

12,{c7436f12-a27f-4cab-aaca-2bd27ed1b773}

In the right hand window locate CN= Default-Display right click and choose properties
Locate AdminPropertyPages, highlight it and click “edit” and add the line

4,{c7436f12-a27f-4cab-aaca-2bd27ed1b773}

Make sure to click on the View menu in Active Directory Users and Computers to choose the Advanced Features option if not already selected to see these newly added Active Director Attribute Editor Tab in the display.

Change Office 365 Distribution Group Restriction

If an Office 365 Distribution Group is being synced from on-premise Active Directory environment then you cannot receive emails to that group from an external source by default. If you try to change the setting in Office 365 the following error appears:

The action ‘Set-DistributionGroup’, ‘RequireSenderAuthenticationEnabled’, can’t be performed on the object ‘[Your Distribution Group]’ because the object is being synchronized from your on-premises organization. This action should be performed on the object in your on-premises organization.

Office 365 Distribution Group Error

This can be changed using the ADSIEdit tool. Navigate through the Active Directory hierarchy and find the Distribution Group then right click and choose Properties. Scroll down to “msExchRequireAuthToSendTo” and change the setting to FALSE. Run a manual DirSync to effect the changes in Office 365.

Office 365 Distribution Group - ADSI Edit

Google Apps SPF / DKIM setup

A Sender Policy Framework (SPF) record indicates mail servers that are authorized to send mail for a domain. Email recipient servers perform a check with DNS to see if the mail came from an authorized server. If not, then the email is most likely SPAM. SPF DNS records lets the recipient server perform this verification.

A DomainKeys Identified Mail (DKIM) record adds a digital signature to emails your organization sends. Email recipient servers perform a check with DNS for the to see if the DomainKey matches the sender. If so, then the email is considered unmodified and from a legitimate sender. DKIM DNS record lets the recipient server perform this verification.

Configure Google Apps SPF

If you use Google Apps for email, you’ll need access to your DNS provider to add an SPF record. In most cases, you simply login and create a new TXT record with the value of:

v=spf1 include:_spf.google.com ~all

Google provides detailed instructions on how this is done. Be sure to save your changes.

Configure DKIM for Google Apps

You’ll need access to your Google Apps control panel and your DNS records to set DKIM. This is a three step process:

1. Create the DKIM key

a. Login to your Google Apps Control Panel (e.g., http://www.google.com/a/cpanel/yourdomain.com)

b. Navigate to the Gmail App Control Panel

c. Scroll down to “Authenticate email” and click on “Set up email authentication (DKIM)”.

d. Your domain name should be displayed. Click on “Generate new record”. Leave the default selector prefix as “google”. Click “Generate”.

e. Leave this browser window open, and then create a new tab or browser window.

2. Create the DKIM DNS record

a. Login to your DNS provider.

b. Create a new TXT record. The name of the TXT record should be:

google._domainkey

This creates a domain that, fully resolved, looks like: google._domainkey.yourdomain.com.

c. The value for the DNS record will be a very long string of characters, something like:

v=DKIM1; k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCG5in7gQIDAQAB

The actual length of the string will be much longer than that above. I find it simplest to copy-and-paste the information from the Control Panel page displaying the information. Save the DNS record.

3. Start Authenticating

a. Wait 24-hours for your changes to propagate, and for Google’s servers to detect the changes.

b. Login to your Google Apps Control Panel (e.g., http ://www .google .com /a /cpanel /yourdomain .com)

c. Go to the “Advanced tools” tab, then scroll down to “Authenticate email” and click on “Set up email authentication (DKIM)”.

d. Click “Start authentication”.

As always, check Google’s detailed instructions if your setup is more complex.

Verify that SPF & DKIM are configured

Send an email from your Gmail account to check –auth @verifier .port 25.com after you’ve completed the Google Apps SPF and DKIM setup. You’ll receive an email response in a few minutes. If everything is properly configured, you’ll receive a “PASS” for both the Google Apps SPF and DKIM settings. This means your email is now securely being delivered and can be verified as such.

Deploy Office 365 Desktop Apps

Recently had to deploy Office 365 Desktop Apps on a terminal server which did not work with the standard download from the web portal due to licensing issues. Only customers with Office 365 E3 licenses or greater are able to use the deployable version of the Office 365 Desktop Apps in a terminal server environment. Here are the steps needed to deploy the apps:

Deploy Office 365 Desktop Apps on Terminal Server

Download the Office Deployment Tool for Click-to-Run here.
Run and extract the tool to a folder on your Terminal Server.

Edit and configure the configuration XML file as follows including the \\[SERVER]\[SHARE]\ path:

<Configuration>
<Add SourcePath=”\\[SERVER]\[SHARE]\” OfficeClientEdition=”32″>
<Product ID=”O365ProPlusRetail”>
<Language ID=”en-us” />
</Product>
</Add>
<Display Level=”None” AcceptEULA=”True” />
<Property Name=”SharedComputerLicensing” Value=”1″ />
</Configuration>
Please visit this TechNet article for more details on the configuration file settings, like excluding apps from deployment.
From an elevated Command Prompt, navigate to the folder extracted files are located in, and run the following to download the installation files:

Setup.exe /download configuration.xml

The Office365 ProPlus installation files will be downloaded to the specified share with the following structure.
From an elevated Command Prompt, run following to install Office Click-to-Run:

Setup.exe /configure configuration.xml

When the installation is complete, the Office 2016 suite will be available for use.
On starting the application, you will be prompted to Activate Office. Click Next and Sign in.
Once signed in, you are ready to go. Office will automatically activate and configure the applications. This is supposed to work similarly with deployment via Group Policy. If your company is using a terminal server for your remote access and need help to deploy Office 365 Desktop Apps, then contact us for assistance.

My Computer Shows Network Drive Red Xs

Kept getting calls from clients about their network drives “disappearing” or disconnecting throughout the day at “random” intervals, so after much troubleshooting found these steps to take on the workstations and file server to help alleviate the issue:

Network Drive Red Xs On the Workstation:

1. Click on Start button then choose Control Panel
2. In Control Panel open the Device Manager
3. Expand the Network Adapters and open each one used on that workstation
4. Look in the Power Management tab and Advanced tabs to look for any power settings that would disable the device then uncheck them. Click OK button and close all other windows.
5. Open the Registry Editor.
6. Expand the tree to the following key:

HKLM\SYSTEM\CurrentControlSet\Service\lanmanworkstation\parameters

7. If it doesn’t exist then create a REG_DWORD named KeepConn with the Decimal value of 86400 (aka 24 hours)
8. Reboot the workstation for changes to take effect.

Network Drive Red Xs On the Server:

1. Login as administrator
2. Open Command Prompt as administrator
3. Type in the following to disable Auto Disconnect of network drives:

net config server /autodisconnect:-1

4. Reboot the server for changes to take effect.

File Server Audit Logging via Group Policy

File Server Audit Logging Policy GPO

Terminal Server Lockdown Group Policy

Terminal Server Lockdown Preparation

Configure users who can connect to the server remotely:

Disable Server Manager Pop Up at user log on:

Configure Group Policy for Terminal Server Lock Down:

Disable Control Panel Items:

Remove Administrative Tools and Powershell:

File Explorer Configuration:

Disable Registry Modification:

Configure Windows Installer and Windows Updates:

Additional Policies:

ScreenConnect Remote Access Tool

Easily Transfer FSMO Roles Between DCs

Fab-ulous New Software Experience

Fab moves Personal folders:

Fab moves Web browsers:

Fab moves Mail:

Fab moves Misc :

Fab moves Common items:

Fab moves User defined:

Missing Active Directory Attribute Editor Tab

Add the Active Directory Attribute Editor Tab in Small Business Server

Change Office 365 Distribution Group Restriction

Google Apps SPF / DKIM setup

Configure Google Apps SPF

Configure DKIM for Google Apps

Verify that SPF & DKIM are configured

Deploy Office 365 Desktop Apps

Deploy Office 365 Desktop Apps on Terminal Server

My Computer Shows Network Drive Red Xs

Network Drive Red Xs On the Workstation:

Network Drive Red Xs On the Server:

Recent Posts

Archives

Categories

Tech Blog

File Server Audit Logging Policy GPO

Terminal Server Lockdown Preparation

Configure users who can connect to the server remotely:

Disable Server Manager Pop Up at user log on:

Configure Group Policy for Terminal Server Lock Down:

Disable Control Panel Items:

Remove Administrative Tools and Powershell:

File Explorer Configuration:

Disable Registry Modification:

Configure Windows Installer and Windows Updates:

Additional Policies:

Fab moves Personal folders:

Fab moves Web browsers:

Fab moves Mail:

Fab moves Misc :

Fab moves Common items:

Fab moves User defined:

Add the Active Directory Attribute Editor Tab in Small Business Server

Configure Google Apps SPF

Configure DKIM for Google Apps

Verify that SPF &amp; DKIM are configured

Deploy Office 365 Desktop Apps on Terminal Server

Network Drive Red Xs On the Workstation:

Network Drive Red Xs On the Server:

Recent Posts

Archives

Categories

Evaluation Signup

Verify that SPF & DKIM are configured