How to Configure Security Sites in Internet Explorer 10 & 11

In Internet Explorer 10 & 11 you can no longer use the Internet Explorer Maintenance setting in Group Policy to make changes to the Browser Security Sites. This has changed in IE 10 to use Group Policy Preferences and ADM Policy Settings.

Use a Windows 2012 Server

To access the new features of Group Policy you will need to connect to the Domain from a Windows 8.x or Windows 2012 Server. Enable the Group Policy Management features and then open Group Policy Management.

Edit a Policy

Create or Edit an existing Group Policy and then drill down to UserPolicy\AdministrativeTemplates\WindowsComponents\InternetExplorer\InternetControlPanel\SecurityPage

Locate the Setting Site to Zone Assignment List

Edit Setting

Check to Enable the Setting. Click the Show button to add the sites required.

Add Sites

Sites that are entered here will be shown in the users browser under the Security Tab and Sites

1. Intranet Sites
2. Trusted Zone
3. Internet
4. Restricted Sites

To add a site enter the site URL on the left value and the Site Number value to the right.

Update User Browser

On the Users Computer run the command

gpudate /force

This will update the Group Policy. Then you can check the Browser Internet Options, Security Tab, Local Intranet Sites and then in the list will be the site you added.

How to Export a Distribution Group to a CSV File in Exchange 2013

I wanted to export all the Distribution Groups in Exchange 2013 that were set to allow external users to send email to them.  The cmdlet below will do this and export to a CSV file.

get-distributiongroup | Sort -Property RequireSenderAuthenticatioNEnabled | Select Name, Requir
eSenderAuthenticationEnabled, PrimarySMTPAddress | Export-CSV "C:\IT Support\Dist.csv"

Exchange 2013 Server emails not being delivered - 451. 5.7.3

I had a problem today with two Exchange 2013 Servers, one at a UK site and the other at our Data Centre connected by a IPSEC VPN.

We suddenly saw no email being delivered from the UK site to the Data Centre Mailbox Server, the emails were being queued with a 451 5.7.3 error in the Queue viewer.

The message describes that Exchange Authentication has failed.

I first checked my Receive Connectors thinking that they did not have Exchange Authentication enabled but they did, this was not the issue.  Never the less emails were building at my CAS Server and not delivering to my Mailbox Server.  This is on a system that had been working for weeks.

What was different I thought.  Well the Exchange Servers in the data centre were behind a Cisco ASA 5510 with a CSC module for scanning traffic for malware.  This was different, before this the Exchange Mailbox Servers were behind a Watch Guard Firewall.

So what had happened?  Well the CSC unit had failed and went this happens there is a default policy for what the traffic should do and in this case the traffic from my Exchange Server in the UK site to the Data Centre was not excluded and was dropped.

What I needed was to bypass the CSC Access Control List for this traffic so it was not dropped.  To do this I found the CSC Class map and then the Global Policy, this references an Access Control List.

In the ACL I then added a line to deny traffic from my Exchange Server and stop it being dropped by the CSC policy.   In this case the lines I added were

access-list global_mpc line 1 extended deny ip host 10.0.0.200 any

As soon as this was added the mail started to flow.  This was a case to always check your Firewalls even when passing all IP traffic across a VPN.

Group Policy - How to Add Internet Favorites via Group Policy with Internet Explorer 10

This is a guide on how to add Internet Explorer Favorites via Group Policy when you have clients with Internet Explorer 10.

Open Group Policy Management MMC

From a Windows 2008 and above server open the Group Policy Management MMC.

Create a Group Policy

From the left hand pane, right click on Group Policy Objects and choose New

Name the Policy

In this instance we will name the Policy Internet Favorites

Edit the Policy

The Policy will now appear in the left pane and we can right click on this and choose Edit.

Create a Folder for the Favorites

Expand the User Configuration, Preferences, Windows Settings down to Folders. On the Folders option right click and choose New, Folder.

Folder Configuration

In the Path field we can enter the location for the folder, this should be the variable %FavoritesDir%\OurFolderName. Click OK to create.

Create a Shortcut for a URL

Expand the User Configuration, Preferences, Windows Settings, Shortcuts and right click to choose New Shortcut. Next set the Action to Create, the Name of the Shortcut in the format of our Favorites folder name from the above step and the name of the Favorite, so OurFolderName\OurFavorite

In the Target Type choose URL and in the Location choose Explorer Favorites.

In the Target URL enter the URL for the Web Site you wish to publish.

How to set a Favorite to a specfic Organisation Unit in Active Directory

Often we will want to show one Favorite to one person in a OU and another to someone else in a different OU, this can be done in Group Policy with Item Level Targeting. To set these options choose the Common Tab in the object and then seletc Item-level targeting and choose the Targeting button.

Create a Targeting Rule

This Window allows you to create targeting rules based on multiple criteria, in this case we want to make a decision based on the users OU. Choose New Item, Organizational Unit.

Editing Target Rule

The rule now shows that if a user belongs to a OU then they will have this shortcut apply, to select the OU choose the button marked ...

Find OU

From the Active Directory lookup choose the OU for the users.

Updated Target Rule

The OU is now selected and the target rule is updated.

Shortcut

You can now see the Shortcut is created for the Google Home Page.

Assign Group Policy to Active Directory

In the Group Policy Tree we want this Group Policy to apply to the entire Domain so right click on the top of the tree and choose Link and Existing GPO

Choose the GPO

From the list choose your GPO

Policy is Assigned

You can now see the GPO is assigned to the Domain and will now take affect.

2X Thin Client - PXE boot NBP is too big to fit into free base memory

Having problems with a PXE Boot image that caused this error.

PXE Error

When you start the PXE Boot you are shown this error message

NBP is too big to fit in free base memory

DHCP Setting

The issue is found in the DHCP Settings, you cannot load an IMG file straight into a PXE boot. The above image shows that the IMG file is being attempted to be loaded by the PXE boot. This will fail as it is too large to load at PXE boot.

PXE Boot File

The file you need to load is the PXE Boot file that then calls the IMG file you want to boot from. In this case I was using the 2X Thin Client and this has a PXELINUX.0 file in the TFTP root.

Update DHCP Option 67

In your DHCP config, update Option 67 to read the PXELINUX.0 file instead of the IMG file location.

Restart PXE Boot

Now when you start the PXE boot you will see that the PXELINUX.0 boots and then loads the IMG file correctly.

2X Thin Client

Now the 2X Thin Client boots as expected.

Outlook 2013 List Pane is Blank

After a Windows Update you notice your List Pane in Outlook 2013 is blank.

Blank Pane Problem

When you try to use the List Pane you can see it is blank and it is covering the lower pane list for Mail, Calendar and People.

Which Update caused this?

The Update that causes the problem is found here.

How to move a user from a Parent Domain to a Child Domain with PowerShell

If you have a situation where you need to move a Active Directory object from a Parent Domain to a Child Domain you will find you cannot do this with the Active Dirrectory MMC.  You need Power Shell.

Here is the Power Shell for the task

move-AdObject -Identity"CN=HotChilli,OU=Overseas,OU=Staff,OU=Users,OU=daveshotsauce,DC=daveshotsauce,DC=Local" -TargetPath "OU=US,DC=us,DC=daveshotsauce,DC=local" -TargetServer "habenero.us.daveshotsauce.local"