Group policy changes to enable ping response and remote desktop (and remote desktop firewall exception)

I recommend these changes on Windows domains to enable ping/ICMP responses from domain connected computers and remote desktop enabling (with network level authentication) and a remote desktop exception on the firewall.  Not all of these items are default on Windows 10 and/or Group Policy.  I think these are best practices so here is how you can add them to Group Policy.

Open Group Policy Management on a domain controller.  Right click on default domain policy and choose edit.

Enable ping responses via Computer Configuration -> Policies -> Administrative Templates Policy -> Network -> Network Connections -> Windows Firewall -> Domain Profile and enable Windows Firewall: Allow ICMP exceptions

Choose the option for "allow inbound echo request."

To enable a remote desktop firewall exception, in the same location, change "Windows Firewall: Allow inbound Remote Desktop exceptions"

To enable network level authentication, go to:
Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections

Enable "Allow users to connect remotely by using Remote Desktop Services"

To make all remote desktop connections use network level authentication, go to:
Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security

Enable "Require user authentication for remote connections by using network level authentication"

Upgrading to Windows 10 after 7/29/16

There is a workaround to get the Windows 10 upgrade on PCs after Microsoft's 7/29/16 deadline.  Per this article from Howtogeek.com - the upgrade is still available for users who use "assistive technologies."  There is no validation on whether or not the computer uses assistive technologies, so in effect, the upgrade is available to everyone.

For reference, the link to the Windows 10 upgrade is here:

https://www.microsoft.com/en-us/accessibility/windows10upgrade

Best practices for safe user behavior to keep your account/computer from being compromised

I wish the internet was a safe place, but it's not.  There are people who want to compromise your accounts, computers, bank accounts, and credit cards.  In this post, I'll talk about ways to help keep you and your computer safe.

I separate risks into two categories:
1) User risks - these are things that you do over the course of regular use of your computer
2) Server side risks - these are parts of the your IT system that you have no control over

This blog will focus on user risks, the things you can control and should be conscious of when using your computer.  While TV and movies often focus on hackers compromising your company's server, the vast majority of IT security compromises come from everyday internet and email use.

I will list the items that you should think about in order of importance.  All items are important, but the items listed first will be more important.

1. Backup - every computer should have a backup system and preferably one that includes off-site storage.  This protects you from A) hardware and software failure and B) bad actors who would destroy your data or hold your data for ransom (this happens).  My strong preference is a cloud based backup system like Backblaze or Carbonite.  Of the two, my preference is Backblaze at $5 per computer per month.
2. Antivirus - all computers should have an up to date modern antivirus program (Macs included).  Windows 8 and Windows 10 come with antivirus built-in.
3. Malware protection - I believe best practice is to have a separate program for malware detection.  Antivirus, while good, does not protect against several types of Malware.  My favorite malware program is MalwareBytes at www.malwarebytes.org at a cost of $25 per year for residential users and $50 per computer per year for business users.
4. Complex passwords - all passwords should be at least eight characters with at least one letter, one number, and one special character.
5. Turn on multi factor authentication - As of 2016, many email providers offer a two factor or multi-factor authentication.  To minimize the chance of your email being compromised, you can turn on two factor or multi-factor authentication.  When turned on, your email system will send you a text message to your cell phone to verify you any time you access your email from a new computer.  Some people find this annoying, but it is a secure way to make sure your account does not get compromised.
6. Safe email behavior - Users should never open an attachment or link in an email unless they are 100% sure they are confident that the attachment or link is safe.  Your IT person can often help you figure out if a link or attachment is safe if you are not sure.
7. Avoid sending private information over standard email - Standard email traffic is not encrypted, and it is safe to assume that all the emails you send and receive can be viewed by other parties.  There are ways to send encrypted email, but encrypted email is not standard and needs to be set up by your email administrators.
8. Safe web behavior - Even innocuous Google searches can return virus laden links.  Before clicking on any link in a web browser, be sure to verify that you are visiting the site you intend.  You might think you're going to a restaurant of movie review, but you might end up in another location.  Make sure when you look at search results that the address of the page you're visiting matches the name of what you are looking for.
9. Avoid illegal software - Downloading software from questionable sites can create trouble.  Often this software is loaded with what we call "bloatware."
10. Ignore virus warnings from web browsers - For many years, unethical people have created "fake alert viruses."  In your web browser (Firefox, Chrome, Internet Explorer, Edge, Safari, etc), a window opens up telling you that you have a virus and to click on the page to remove the virus or to call a phone number.  If the warning comes a page web page, this is a false message trying to get you to take action that will infect you.
11. Ignore unsolicited phone calls - As of 2016, users sometimes get unsolicited phone calls from "Microsoft" or "Comcast" saying that your computer is infected and they want to help you.  This is a scam.  There is no such concept as a central authority somewhere keeping track of your phone number and computer status.  

If you have any questions, please contact your IT people.  They are the best resource for help staying safe.

Moving autocomplete files between profiles on Outlook 2010/2013/2016

This is the process I use for moving autocomplete data from one profile to another profile when you don't have an Exchange server.  This is applicable for Outlook 2010/2013/2016.

First, send an email from the new mail profile and note the time/date when you sent the email.  This time/date will be important shortly.

Now, go to:
c:\users\%username%\appdata\local\microsoft\outlook\roamcache

You're looking for two autocomplete files.  Both files start with stream_autocomplete . . .

You're looking for one stream_autocomplete file with the time/date when you sent the email just now.
You're also looking for the stream_autocomplete that is much larger and represents the autocomplete for the old profile (this will be a file between 10 KB and 5000 KB) with a time/date that corresponds to the last time you sent an email from the old profile.

We'll call the new file "new_autocomplete" and the old file "old_autocomplete" going forward.

Open Outlook.  Put Outlook offline.

in c:\users\%username%\appdata\local\microsoft\outlook\roamcache . . .

Copy and paste old_autocomplete so you have old_autocomplete and old_autocomplete_copy.

Highlight new_autocomplete and choose rename.  Hit control C so you have the name of new_autocomplete in your clipboard.  Add a single letter to the end of new_autocomplete so new_autocomplete now has a new name.

Highlight old_autocomplete_copy and choose rename.  Paste the name you have on your clipboard.  Now, your copy of old_autocomplete will have new_autocomplete's name.

Close Outlook.
Wait 30 seconds
Reopen Outlook.
Put Outlook onlne.

Test autocomplete.

That's it.

Creating an anti-spoofing rule in Office365

Here's how to create a mail flow rule in Office365 to send spammers who spoof your domain to the online quarantine.  These instructions are applicable ass of 8/9/16.  Typically, these spoofed messages will go to your users' junk e-mail boxes, but this can still lead to confusion, so we don't want these messages to go to junk e-mail at all.

In the Exchange Admin Center, go to Mail Flow:

Add a new mail flow rule:

Hit More Options near the bottom of the page:

Give the rule a name of "Spoof Check."  Tell the rule to apply this rule if sender is outside of the organization and the sender's domain is [your public domain] and do the following: deliver the message to the hosted quarantine.

log on as a service is greyed out on domain connected computers

I found Log on as a Service to be greyed out in local security policy for my domain member server (running Win 2008 R2).  It looked like this:

It is greyed out because the setting is defined in group policy management by a domain controller and not in local security policy.  I was able to edit the setting here on a domain controller here:

In my case, I had to log on to one of my Windows 2008 R2 domain controllers and open Group Policy Management and go to Default Domain Policy where I could go to edit the log on as a service for the entire domain.

The setting is located here:

And editing the value looks like this (right click on default domain policy and choose edit):

 

Downloading Acrobat 9 updates now that Acrobat is no longer actively supported

Acrobat 9 (Standard or Pro) will no longer download updates automatically from version 9.0.0 at least that was my experience on 6/30/16.  Acrobat 9 is no longer supported by Adobe.  Luckily, I found this page:
http://khkonsulting.com/2014/08/where-are-my-adobe-acrobat-9-updates%E2%80%BD%E2%80%BD%E2%80%BD/#comment-306225

The page explains that while the autodownload function no longer works, you can manually download the updates from here:
PC - ftp://ftp.adobe.com/pub/adobe/acrobat/win
Mac - ftp://ftp.adobe.com/pub/adobe/acrobat/mac

I found that when I got to about version 9.3.5, the autoupdate feature *did* work, but the autoupdate feature definitely did not work on version 9.0.0.