OS X Active Directory Users losing admin privileges when offline

For anyone using Directory Services in OS X to bind the Mac to a Windows domain, you've likely seen the option to allow administration by..., where you can define groups to administer the machine. I have a security group setup in Active Directory specifically for this, and whenever I bind the Mac to the domain I add that group and turn that option on. However, once in a while, when a machine is not able to directly authenticate with an Active Directory server, domain users do not have local admin rights. Typically admin rights come back the next time the machine is able to communicate with Active Directory, but in the meantime it is an annoyance while offline. Fortunately, it appears that I'm not the only one who has been dealing with this. I only wish I had spent some time researching it sooner.

Previously, my workaround to this problem has been to remove the Mac from the Active Directory domain, and then rejoin. While this has worked, it is just a workaround rather than a solution. It appears that someone with the same issue has found the actual problem, and also posted the solution. What is apparently happening is that even though those groups are supposed to be allowed to administer the computer according to the setting in Directory Services, the accounts are not added to the local admin group on the Mac. You can fix this by opening a Terminal session, and running the following command:

dseditgroup -n /Local/Default -o edit -u localUsername -p password -a accountToAdd -t user admin

*UPDATE*

Rather than use the above command, I found simply using sudo removes the need for the -u and -p switches so you can use the following.

sudo dseditgroup -n /Local/Default -o edit -a accountToAdd -t user admin

-n = node
-u = local username used to authenticate to make the change
-p = password for user defined with -u
-a = name of account to add to the admin group
-t = type of account you're adding
admin = group name

You'll want to use your own information for -u, -p, and -a. -t can take group as an option (instead of user). I haven't tried that yet, but it should allow you to add an entire security group to the local admin group in case you have multiple users for that one machine

Now, I believe this may do the same thing as well if you're not comfortable using Terminal to issue that command. You'll need to have login info for an actual local admin account, and the domain account you want to grant admin rights to must have logged in to the machine at least once already. Simulate being offline by turning off the wifi connection and disconnecting any LAN cable(s). Once you're offline, go into System Preferences->Accounts, click the user that should have local admin rights and check the box that says "Allow user to administer this computer". Then reconnect your network connection and reboot.

The two articles I found related to this that I used are:

https://discussions.apple.com/message/16026679#16026679

https://discussions.apple.com/message/22540531#22540531

ProcessExplorer "Unable to extract 64-bit image" error

The ProcessExplorer program is a very useful utility. I needed it today to track down a file lock, but upon trying to run it on my Windows 7 64-bit machine, I kept getting an error telling me "Unable to extract 64-bit image...". A few Google searches mentioned this being caused by a permissions error, but this didn't make sense since I'm an admin on the machine. After I ran across this on the SysInternals forum, then I realized that those saying that permissions were the problem weren't wrong, but that their answer wasn't specific enough.

Upon running the ProcessExplorer executable, it will extract the 64-bit version of the program to the AppData/Local/Temp folder and attempt to run from there. However, if you're like me and have restrictions on applications running from the Temp folder, this will cause the error. To get around it I simply navigated to my temp directory and move the procexp64.exe file to my Desktop and executed it from there. It opened right up and I was able to get back to what I needed ProcessExplorer for.

By default the AppData directory is hidden. The quickest way to get there is by clicking Start, then type %tmp% into the Search box and press Enter. Or type the path directly into the navigation bar, or choose to show hidden files.

Full path to the temp folder is C:\Users\"your username"\AppData\Local\Temp

Toshiba Mobile LCD and IE 10 or 11 crash

I have one user with a Toshiba Portege ultrabook, and it's been fine. He also wanted a Toshiba mobile LCD screen to bring along for more screen real estate. Eventually his machine started having issues with Internet Explorer, where IE would crash immediately upon opening. I assumed it was a corrupt IE install since IE 10 had just came out, but uninstalling/reinstalling IE 10 didn't help. IE 9 worked fine though. After going through plenty of additional troubleshooting I finally found the cause of the issue. It was the DisplayLink driver that was installed with the mobile LCD screen. When that driver was installed IE would stop working, and as soon as it was uninstalled IE would go back to normal. Luckily DisplayLink had newer drivers available to download, and the driver worked fine with both IE 10 and IE 11.

For anyone scratching your head trying to find a solution to IE 10 or 11 crashing, if you have a portable LCD screen in use that uses DisplayLink drivers, try updating those first. It'll save you plenty of head scratching and unnecessary malware scans.

Configure VLAN(s) and enable routing on an HP Procurve switch

If you're running a managed HP Procurve switch and want to take advantage of VLANs to subnet your network, it's pretty easy. Here's a diagram of my example

In this example we have two VLANs (VLAN 1 and VLAN 2). VLAN 2 is setup just for workstations and must connect to VLAN 1 for DHCP, DNS, and Internet access.

In case the image is too small, on the switch, ports 1-24 are being designated as part of VLAN 1, and 25-48 are part of VLAN 2. VLAN 1 is the 192.168.10.0/24 subnet, and VLAN 2 is the 192.168.20.0/24 subnet.

On my primary and secondary DNS/DHCP servers, I have a DHCP scope setup for the primary network (VLAN 1), and another scope setup for VLAN 2. In my DHCP options for both, I set the primary DNS server to 192.168.10.10, and the secondary to 192.168.10.11. For VLAN 1, I set the router to 192.168.10.1, but on VLAN 2 I set the router to 192.168.20.254 since the default gateway needs to be found within the same subnet.

To actually set this up, first, you would telnet into your Procurve switch, which I'm hoping you know how to do if you're going to attempt setting up a VLAN. You'll need enable access on the switch as well. Once you've logged into the switch and are at the terminal, here is what I would enter to set up the above example. I've added comments/explanations on all lines, so be aware that you do not want to enter the - (.....) from the lines into the terminal window

enable - (enables admin access)

conf t - (enters configuration mode using the terminal)

ip routing - (enabled IP-based routing, which is required to allow the two VLANs to communicate)

vlan 1 - (will enter the configuration mode for vlan 1, which should exist by default on the switch)

untag 1-24 - (untags ports 1-24 on the switch to indicate they're going to be restricted to vlan 1)

ip address 192.168.10.254/24 - (assigns the IP address of 192.168.10.254 to the VLAN 1 interface)

vlan 2 - (will create vlan 2 if it doesn't already exist, then enters configuration mode for it)

untag 25-48 - (untags ports 25-48 on the switch to indicate they're going to be restricted to vlan 2)

ip address 192.168.20.254/24 - (assigns the IP address of 192.168.20.254 to the VLAN 1 interface)

ip helper-address 192.168.10.10 - (sets VLAN 2 to send DHCP packets to the primary DHCP server)

ip helper-address 192.168.10.11 - (sets VLAN 2 to send DHCP packets to the secondary DHCP server)

ip route 0.0.0.0 0.0.0.0 192.168.10.1 - (sets the default route to the default gateway in VLAN 1)

write mem - (commits the changes you made to the configuration stored in memory on the switch)

end - (exits configuration mode)

exit - (exits enable mode)

exit - (logs you off from your telnet session)

The one issue I ran into when I first did it is I had "ip default-gateway 192.168.10.1" set on my switch and thought that was good enough for my VLAN 2 to get to the Internet. However, that is only effective when ip routing is disabled, and for the VLANs to communicate ip routing needs to be turned on. That requires you to add an actual static route, or use ip default-network if it's an available option. For more information on that see this link. It's from Cisco, but the same applies to the Procurve devices. That link explains the differences between the default gateway options, and what routing protocols are affected by each.

The one thing I didn't touch on here is setting your actual routing to be able to reach VLAN 2. For that you'll have to decide what is best because it depends on your network and routing devices and protocols in use. In my example, I need to setup a route in VLAN 1 that would send traffic for 192.168.20.0/24 to 192.168.10.254 (the switch's IP on VLAN 1). If you have OSPF configured on your network and your switch participates, then you likely have nothing to do here. For my network, the switch doesn't support OSPF and the router is managed by my ISP and I have no access. In order to get traffic to VLAN 2, I added a static route to my firewall for it. That way it still gets advertised over OSPF and VLAN 2 can be reached.

When I initially decided to do this, I used a few articles to come up with the final configuration. In case they may be helpful to you:

IP Routing Between VLANs

Relaying DHCP packets to a remote server

Configuring a gateway of last resort using ip commands

Happy VLANing!

Convert user mailbox to resource when using Exchange Online

I am in the middle of a cutover migration from an Exchange 2003 environment to Exchange Online. One issue with the cutover is that all our resource mailboxes were imported as user mailboxes, rather than resources. Luckily, using PowerShell, it is easy to convert these and I only had ~10 so it was easy enough to do. If you have a lot of resource mailboxes to convert you may want to script it instead. Anyway, here are the instructions which I originally found from here:

1. Connect Windows PowerShell to the Service. Refer to the article below.
http://help.outlook.com/en-us/140/cc546278.aspx

2. Run set-mailbox mailboxName -type room, substituting your specific mailbox name in for mailboxName, and also specifying either room OR equipment. The example is to convert to a room resource

Cannot get mail connection to server is unavailable error on iOS device

The typical answers to this would be verify your username/password/server address, and make sure you have an active data connection and can access the server. However, I'm posting this because I ran across a very odd solution to this error message when those first two failed.

I had a user who could not receive any new emails on her iPhone 5 through an Exchange ActiveSync connection, yet she could send and also had the contacts and calendar working fine. It happened out of nowhere and I was able to replicate the issue on a 2nd iPhone. No other users were reporting issues, and the user's email was working fine in Outlook and OWA. It was very odd.

After doing some extensive troubleshooting I finally tracked down the issue and decided to post it in case anyone else runs across the same problem and is scratching their head. The user had used an emoticon when sending an email, and had two replies to that message in her Inbox. However, that emoticon had gotten corrupted on the receiving end, so when sent back to her in the reply it actually made the messages unreadable on the iPhone and prevented any newer emails from being downloaded as well. As soon as I removed those 2 emails from the Inbox, the iPhone began working correctly again.

Error while trying to export to PST using Export-Mailbox on Exchange 2007

This is probably valid for more than just Exchange 2007, but that's the version I was working on where I ran into the problem. After finally getting myself setup with a machine running a 32-bit Windows OS, and with both Exchange Management Tools and Outlook 2007 installed, I tried running my Export-Mailbox command. No go, and in checking the migration log file the error looked something like:

Error was found for user1 (user1@email.com) because: Error occurred in the step: Moving messages. Failed to copy messages to the destination mailbox store with error: 
MAPI or an unspecified service provider.
ID no: 00000000-0000-00000000, error code: -1056749164

I scratched my head on this one for a while after the Google results for the error code didn't show any results. Luckily my brain still works without Google (kind of...) and I had to smack myself a little for how simple the fix was. I didn't have full access to the mailboxes I was trying to export with the account I was logged in with! Once I realized that I simply ran

Add-MailboxPermission -Identity user1 -User myaccount -AccessRights FullAccess

Once that was done I tried my Export-Mailbox command again and viola! Exporting to PST files from the Exchange 2007 information store worked as expected.

Windows Search Companion pane is blank

If you run into this, the likely cause is that the jscript.dll file is not registered correctly. To fix, simply go to Start->Run, then use the command "regsvr32.exe %windir%\system32\jscript.dll" and click OK. You should get a pop-up saying that the DLL was successfully registered, then try using search again.

Outlook Web Access (OWA) shows requested resource is in use page

I don't like admitting this, but I'm still stuck supporting an Exchange 2003 environment. Yes, it's over 10 year old software, but it is what it is. With that out there, I had a problem today with my Exchange 2003 box after a power outage. Outlook Web Access, aka OWA, was showing a page that said "Requested resource is in use" if anyone tried to use it. I didn't see anything obviously wrong, and other Exchange functionality was working fine, so I turned to the web.

The fix was very simple. A dll file that OWA depends on was not registered properly. To fix the problem all I had to do was go to Start->Run, then use the command "regsvr32 %windir%\system32\vbscript.dll". You should get a pop-up alert that the DLL was registered succesfully after you run that command, and OWA will come back to life.

Deploying Windows 8 using the Windows ADK and WinPE

After spending a chunk of today trying to get imaging and deployment of Windows 8 figured out I decided it was worth a post since the scripts Microsoft provides are either slightly incorrect or missing information. I started out with this TechNet article and this other, then built the final solution from there.

First, use the article to get the Windows ADK, which will allow you to create bootable WinPE media. You can either create a bootable USB device like the article states, or create an iso image file that can be burned to a CD. Personally I prefer CD because it seems to be the most compatible since everything can boot from CD, but not everything likes booting from USB. To create the iso file instead of the USB in their step 1.3, use the command MakeWinPEMedia /ISO /C:\winpe_amd64 C:\winpe.iso. That will create the ISO file named winpe.iso in the root of the C drive using the directory located at C:\winpe_amd64. If you want to change those paths, feel free, especially for the location of the iso file.

From this point on I was able to capture the system image using the directions outlined in the TechNet article, so refer to that for image capture.

Deployment is where I started running into problems. I have a pile of cheap Dell Inspirons, and they were using UEFI booting. I'm not going to get into MBR/BIOS since I didn't deal with that and don't know if the article is correct, but the scripts provided for the UEFI option need some tweaking.

For the create partition script, use the script below instead of what Microsoft provided. I have bolded the changes I made. For the line with shrink minimum, adjust this so it's big enough to hold your system image. 14GB is what they have it set to, and my image came out to just over 7 so if I didn't adjust it I would've wasted 7GB of hard drive space.

rem These commands are used with DiskPart to
rem erase the drive and create five partitions
rem for a UEFI/GPT-based computer.
rem Adjust the partition sizes to fill the drive as necessary.
select disk 0
clean
convert gpt
rem === 1. Windows RE tools partition ===========
create partition primary size=300
format quick fs=ntfs label="Windows RE tools"
assign letter="T"
set id="de94bba4-06d1-4d40-a16a-bfd50179d6ac"
gpt attributes=0x8000000000000001
rem === 2. System partition =====================
create partition efi size=100
format quick fs=fat32 label="System"
assign letter="S"
rem === 3. Microsoft Reserved (MSR) partition ===
create partition msr size=128
rem === 4. Windows partition ====================
rem ==    a. Create Windows partition =========== 
create partition primary 
rem ==    b. Create space for recovery image ====  
shrink minimum=10000
rem ==    c. Prepare the Windows partition ====== 
format quick fs=ntfs label="Windows"
assign letter="W"
rem === 5. Recovery image partition =============
create partition primary
format quick fs=ntfs label="Recovery image"
assign letter="R"
set id="de94bba4-06d1-4d40-a16a-bfd50179d6ac"
gpt attributes=0x8000000000000001

You can name that CreatePartitions.txt as suggested, or use your own file name. Make sure you copy it onto a USB drive or something that is accessible to the machine you will be deploying the image to. You can use the instructions in the TechNet article to run this script (e.g. diskpart /s E:\CreatePartitions.txt if the script file is saved on something mapped to the letter E).

Now, for the batch file that actually deploys the image you need to make a few tweaks to this as well to get it to work. Use the below

rem These commands use the specified Windows image file 
rem to deploy Windows, system, and recovery tools 
rem to a UEFI-based computer.

rem Usage:   ApplyImage WimFileName 
rem Example: ApplyImage E:\Images\ThinImage.wim

rem === Apply the image to the Windows partition ========
dism /Apply-Image /ImageFile:%1 /Index:1 /ApplyDir:W:\

rem === Copy tools to the Windows RE Tools partition ====
md T:\Recovery\WindowsRE
copy W:\windows\system32\recovery\winre.wim T:\Recovery\WindowsRE\winre.wim

rem === Copy boot files to the System partition =========
W:\Windows\System32\bcdboot W:\Windows /s S: /f ALL


rem === Set the location of the WinRE tools =============
W:\Windows\System32\reagentc /setreimage /path T:\Recovery\WindowsRE /target W:\Windows

rem === Create the recovery image =======================
Mkdir R:\RecoveryImage
Copy %1 R:\RecoveryImage
W:\Windows\System32\reagentc /setosimage /path R:\RecoveryImage /target W:\Windows /index 1

To actually have the system partition recognizable as UEFI you need to add the /f ALL to the bcdboot command. Also, they made a bad typo in the very last line by getting the drive letters mixed up. They have it as T in their script, but it needs to be R.

With those few changes I was able to successfully deploy Windows 8 just like I had been doing for Windows 7 machines using WinPE and imagex.exe. Hopefully this will save you from trying to figure out what is wrong with the scripts Microsoft provides. I did send them feedback outlining the mistakes, but whether or not they'll actually update it is yet to be seen. Good luck with your deployment!