Start menu organization in Windows 10

I used to leave the Windows 10 menu alone with all the default bloatware garbage on it, but I've started arranging the menu and putting the critical programs, weather, and news (changed from small to large window size) on the start menu,  I prefer a nicely organizard tile section in my start menu, so why not make it that way for the users?  This is what my typical start menu looks like:

Computer swap process - revised 2-24-17

This post will go over all the items we look at when putting in a new computer for an existing user (for example - an employee is getting a new laptop and needs his/her data transferred).  This process doesn't cover installation of programs (assumes this has already been done), but it will ask you to check on important installations.

1. Change the name of the computer as required (putting initials for the user in the computer name)
2. Install all applicable updates (for Windows and Office)
3. Copy data from old computer to new computer using robocopy script
4. Move data to appropriate locations (desktop data to desktop, music to music folder, etc)
5. Ensure all applicable programs are installed/configured including (but not limited to):
   a. AP StyleGuard
   b. Adobe Acrobat Standard/Reader
   c. NitroPDF
   d. MS Project
   e. MS Visio
   f. TightVNC
   g. Skype
   h. Google Talk
   i. QuickBooks
   j. Malwarebytes
   k. Java
   l. FileMaker
   m. Backblaze (or other backup program)
   n. Great Plains and/or Management Reporter
6. Make sure Outlook is configured as appropriate
7. Confirm antivirus is installed and up to date
8. Confirm shared calendars are in place
9. Confirm printers are installed with appropriate printer set as default
10. Confirm VPN is in place with saved credentials
11. Confirm new user has appropriate permissions on computer (local admin or standard user)
12. Put appropriate icons for frequently accessed programs on desktop (Computer, Word, Excel, Outlook, terminal server icon, VPN icon, accounting software if applicable)
13. Confirm backup is working properly for the new user.
14. Add drivers for mobile broadband card if needed
15. Encrypt the laptop using bitlocker if required on that network
16. Arrange the start menu per best practices (link to visual of best practices)
17. Track computer's serial number in inventory spreadsheet and make sure user's name is noted as current user for computer

Setting Up Two Factor Authentication in Office365

This post will go over the steps a person will need to take in setting up two factor authentication for Office365.  As of 2016, two factor authentication is the the most common option for secure access to cloud based systems.

Step 1: Ask your administrator to enable two factor authentication (can only be enabled by an administrator)

Step 2: Go to https://account.activedirectory.windowsazure.com/profile/

Step 3: Log in with your email address

Step 4: Click Set up now

Step 5: Set up the second authentication method.  For 99% of people, this will be a text message to your cell phone

Step 6: Click Contact me.  You'll a code sent to your cell phone.  Enter that code on the next page to verify successful receipt of the code.  Click Verify after entering the code.

Step 7: Click Done (you can ignore the other text in the window)

Step 8: Click Additional Security Verification

Step 9: Confirm that the settings look right (they should look right if you've gotten this far)

Step 10: Click on "app passwords"

Step 11: Click Create

Click 12: Give the name to the app password you're creating.  With near certainty, the first one you'll want to create will be for Outlook.  You'll be creating an app password for *each* non-web based program/device you use.  You cannot reuse app passwords.  Let's say you've got a tablet, a phone, two different Outlook installations (on two different computers), and a Skype for Business installation.  That's five different programs and you'll need five separate app passwords.  I recommend naming each app password for the program you'll be using.  For example, you might call them Outlook laptop, Outlook desktop, iphone 7, Galaxy S7, iPad, Skype for Business, or something similar.

Step 13: Use the app password the system gives you and track it.  Within the next two hours, your devices (Outlook or phone or tablet etc) will prompt you for a password for your email account.  Instead of using your regular password, you'll use the app password.  You *cannot* reuse app passwords, so you should be sure to 1) make as many passwords as you need and 2) track them until you first use them (the app passwords are useless after you first use them).

Windows 10 Upgrade tips when the upgrade process fails

My last two Windows 7 to Windows 10 upgrades have not gone smoothly.  In each case, I was running the Windows 10 upgrade for users who use the accessibility features of Windows located here:
https://www.microsoft.com/en-us/accessibility/windows10upgrade

Here are the steps I take if the computer is stuck at 0% installing Windows 10 or stops anywhere before finishing.

1. Create a batch file with the content below and run the file as administrator
2. Update all drivers on the machine - particularly the video card driver
3. Make sure the C drive has at least 40 GB free
4. run "sfc /scannow" from an elevated DOS prompt
5. Remove any third party antivirus
6. Log in as a user with a minimal profile
7. Go to msconfig and under services, hide all Microsoft services and then disable all services (which will leave all MS servers enabled)
8. Remove the computer from the domain and log in with a brand new profile with admin privileges,  

Batch file contents:


net stop wuauserv
net stop bits
net stop cryptsvc
net stop trustedinstaller
sc config cryptsvc start= auto obj= "NT Authority\NetworkService" password= a
sc config wuauserv start= auto obj= LocalSystem
sc config bits start= delayed-auto obj= LocalSystem
Sc config trustedinstaller start= demand obj= LocalSystem
Sc config eventlog start= auto
reg add HKLM\SYSTEM\CurrentControlSet\Services\wuauserv\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "%systemroot%\system32\wuaueng.dll" /f
reg add HKLM\SYSTEM\CurrentControlSet\Services\bits\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "%systemroot%\system32\qmgr.dll" /f
reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /f
reg delete HKLM\COMPONENTS\PendingXmlIdentifier /f
reg delete HKLM\COMPONENTS\NextQueueEntryIndex /f
reg delete HKLM\COMPONENTS\AdvancedInstallersNeedResolving /f
sc sdset wuauserv D:(A;;CCLCSWRPLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOSDRCWDWO;;;WD)
sc sdset bits D:(A;CI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;SAFA;WDWO;;;BA)
sc sdset cryptsvc D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
sc sdset trustedinstaller D:(A;CI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRRC;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;SAFA;WDWO;;;BA)
sc sdset eventlog D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;SA;DCRPWPDTCRSDWDWO;;;WD)(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
takeown /f %systemroot%\winsxs\pending.xml
icacls %systemroot%\winsxs\pending.xml /grant Administrators:(F)
icacls %systemroot%\winsxs\pending.xml /grant Administratörer:(F)
del /q %systemroot%\winsxs\pending.xml
ren %systemroot%\System32\Catroot2 oldcatroot2
ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
rename \ProgramData\Microsoft\Network\Downloader Downloader.old
cd /d %windir%\system32
regsvr32.exe atl.dll /s
regsvr32.exe urlmon.dll /s
regsvr32.exe jscript.dll /s
regsvr32.exe vbscript.dll /s
regsvr32.exe scrrun.dll /s
regsvr32.exe msxml3.dll /s
regsvr32.exe msxml6.dll /s
regsvr32.exe actxprxy.dll /s
regsvr32.exe softpub.dll /s
regsvr32.exe wintrust.dll /s
regsvr32.exe dssenh.dll /s
regsvr32.exe rsaenh.dll /s
regsvr32.exe cryptdlg.dll /s
regsvr32.exe oleaut32.dll /s
regsvr32.exe ole32.dll /s
regsvr32.exe shell32.dll /s
regsvr32.exe wuapi.dll /s
regsvr32.exe wuaueng.dll /s
regsvr32.exe wups.dll /s
regsvr32.exe wups2.dll /s
regsvr32.exe qmgrprxy.dll /s
regsvr32.exe wucltux.dll /s
regsvr32.exe wuwebv.dll /s
net start eventlog
net start cryptsvc
net start bits
net start wuauserv
fsutil resource setautoreset true c:\
netsh winhttp reset proxy
bitsadmin /reset /allusers
wuauclt.exe /resetauthorization /detectnow
:MESSAGE
echo+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
echo===========================================================
echo     The commands has been succesfully executed. Hit enter to continue
echo===========================================================
echo+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Pause > Null
:end

How to completely uninstall Google Apps Sync for Microsoft Outlook (GASMO)

This post will talk about how to completely uninstall Google Apps Sync for Microsoft Outlook (hereafter referred to as GASMO).

You might want completely uninstall GASMO for several reasons.  If you're experiencing instability in Outlook, creating a new GASMO profile is typically the first step by re-running "Set up a Google Apps Sync user" and then setting the new profile as the default.  Should the new profile prove to be unstable, sometimes you need to completely remove GASMO.

Here is how I do remove GASMO completely.

Close Outlook
Uninstall GASMO via add/remove programs.
Delete the folder C:\Program Files (x86)\Google\Google Apps Sync
Delete the folder C:\Users\%username%\AppData\Local\Google\Google Apps Sync

Step by step - restore active directory objects from Windows backup

I accidentally deleted some active directory objects when I was deleting some Exchange mailboxes.  Chaos ensued, but I had to restore the active directory users.

Here's what Microsoft helped me do (step by step).

Boot into Directory services restore mode.  (see here for how: https://blogs.technet.microsoft.com/activedirectoryua/2008/11/20/how-to-start-in-directory-service-restore-mode-dsrm-in-windows-server-2008-and-windows-server-2008-r2/)

Log in

Open an elevated command prompt

type "wbadmin get versions"
This will give you all the backups that you can restore from.
Pay attention to the version identifier as this will define what backup you're working with.

type "wbadmin start systemstaterecovery -version:10/01/2016-04:30" where 10/01/2016-04:30 will vary based on the actual version that you are restoring from that you found when you ran "wbadmin get versions"

Choose yes twice.

Now, you'll need to wait 45 to 90 minutes while the system preps itself.  Ugh.

Next, you'll restore organization units (OUs) as a whole to the version the the OUs were at the time of the backup.  So for example, if I have an OU named accounting and I'm doing a restore on October 3, 2016 where the backup I'm restoring from is October 1, 2016 - all changes from 10/1/16 to 10/3/16 will be lost.

This gets less intuitive here.  After the system has loaded the backup, the system will ask you to reboot the server.  Don't do it.

Instead, launch a command prompt, type ntdsutil, and then press Enter.

1 .           Type activate instance ntds and press Enter.

2.            Type authoritative restore and press Enter.

3.            At this point, determine whether you're restoring an OU or an object. The previous table showed the syntax to restore either an OU or an object. Type the restore command and press Enter.

For example, to restore a user object, use the following format:

•             restore object dn

•             restore object "cn=Sally,ou=sales,dc=pearson,dc=pub"

Or, to restore an OU, use the following format:

•             restore subtree dn

•             restore subtree "ou=sales,dc=pearson,dc=pub"

NOTE

This increments the update sequence number (USN) so that all other DCs consider it the most recent change.

4.            Type quit and press Enter twice to exit ntdsutil.

5.            Restart the DC normally.

As an example. if you were restoring an OU called distribution groups which sits under an OU called MyBusiness, you'd type:

restore subtree "OU=distribution groups,OU=MyBusiness,DC=contoso,DC=local"
if you're not familiar with LDAP syntax (which I'm not), some googling and trial and error will help you find what you need.  If you type in the wrong values, the process willl just fail.

This is what a successful restore looks like.  Look at "successfully updated records"

What's weird for me in the two times I've tried this is that I rebooted once, and my 2008 R2 server had no internet connectivity and no restored AD items on first reboot.  I had reboot again to get my items and to get internet connectivity.  So weird.

Configuring VPN to work without regard to dial in policy

Per this page:

https://technet.microsoft.com/en-us/library/cc732252%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396

1. Click Start, click Administrative Tools, and then click Network Policy Server. The NPS console opens.
2. Double-click Policies, click Network Policies, and then in the details pane double-click the policy that you want to configure.
3. In the policy Properties dialog box, on the Overview tab, in Access Permission, select the Ignore user account dial-in properties check box, and then click OK.

You can enable NPS (Network Policy Server) to work without regard to the user's dial-in setting.  For years, I've been manually marking people with Allow for Dial-in as in below.