Tro inte på allt du tror!
Stop JAVA Update from displaying ….
Ett registry hack behövs på x64 servern…
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Update\Policy\
The official fix, create a new DWORD value called EnableAutoUpdateCheck , and set it to 0.
Tydligen strular detta för vissa och de har fått sätta följande nyckel till 0 också EnableJavaUpdate= 0 worked
På en klient kör följande
runas /noprofile /domain\administrator password cmd
Detta startar en lokal cmd process som domänadmin på klienten
Ta nu ner Psexec från denna site https://download.sysinternals.com/Files/PsTools.zip
Packa upp.
I ”Admin” cmd fönstret starta följande kommando
c:\pstools\psexec.exe \\server c:\windows\system32\cmd.exe
Nu tar detta en liten stund och en ny cmd prompt uppstår.
skriv whoami för att kolla så du verkligen vart rätt (admin)
Nu är du PÅ servern lokalt och jobbar…
Farliga delen! (Sabbar windows aktiveringen nämligen……..)
Kör följande
cd c:\windows\winsxs
takeown /F pending.xml
rename pending.xml pending.old
Vänta…
Kolla på servern så den ändrar status från 3 of 3 65% till applying settings.
I Detta läga resettade jag servern.
Vid omstart kom jag in direkt.
DOCK vart nu servern INTE aktiverad och krävde att få ominstalleras. HUA….
”Windows must be reinstalled to activate. Please insert the Windows CD or DVD to begin reinstallation”
Fix:
Högerclicka på CMD.exe ock välj ÔÇÿRun as AdministratorÔÇÿ
net stop slsvc (Stoppa tjänsterna …)
cd %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareLicensing
rename tokens.dat tokens.bak
cd %windir%\system32
net start slsvc
cscript slmgr.vbs -rilc (Tar en stund…)
Omstart ! (enligt info tydligen 2 ggr …)
I mitt fall gick detta inte …
Beslöt då att försöka återställa pending.xml igen, så gjorde samma sak en gång till, dock fanns då en ny pending.xml.7126127612 fil..
Döpte om även denna ,,, omstart…
Samma fel.
Logga in lokalt igen en gång..
Via remote som ovan återställde den utsprungliga pending.xml filen och startade om..
NU kom ”3 of 3 65%” tillbaka men gick igenom…
Jag kunde efter en minut eller så loggain i windows och fick då igen aktivera windows (vilket nu gick).
Frid & fröjd… so far….
Länkar:
https://msmvps.com/blogs/bradley/archive/2010/03/25/fixing-a-bit-of-pending-xml.aspx
https://thedailyreviewer.com/server/view/sbs-2008-updates—configuring-updates-stage-1-of-3—0-complet-104443286
I Windows Server 2008 R2 är det ca 50,000 system state filer, ca size 4-6GB…
Snabbaste sättet att göra backup där är att köra med Wbadmin som är ett console program.
Med Wbadmin kan du använda följande syntaxför att starta en SYSTEMSTATE backup alt. återställa…
wbadmin start systemstatebackup -backupTarget:VolumeName
VolumeName är platsen/volumen där du vill lagra backuppen ex. F:
För att återställa kör följande kommando från en Eleverad kommando prompt:
wbadmin start systemstaterecovery -backupTarget:VolumeName
VolumeName här är platsen som inehåller backuppen du vill återställa ifrån.
Samlingspost för batch syntaxer… (glömmer dem ju hela tiden)
% Parametrar…
”%0” är parameter noll i en batch, dvs namnet på batch filen själv.
Man kan filtrera den info med följande
d=drive
p=path
n=name
x=extension
Ex.´┐¢
%~dpnx0 = Namnet på batchfilen med extention
%~dp0 = Namnet på sökvägen där batchfilen finns
Exempel på nyttjande: Kopierar in filerna från det share man stog i eller katalog till c:\install och startar setupfilen.
Set dest=c:\install
md %dest%
md %dest%\office
xcopy %~dp0*.* %dest%\office /e /y
start %dest%\office\setup.exe
xcopy /Q /E /I Source DEST\%date%–%time%:~-11,9%%time:~-8,-6%%time:~-5,-3%
Backup med 7-zip
”c:\program files\7-zip\7z.exe” a backup.7z >nul
copy backup.7z I:\backup%date%–%time:~-11,-9%%time:~-8,-6%%time:~-5,-3%.7z
del /q backup.7z
TS Servern fungerar bäst om ingen är inloggad när detta sker..
1. Logga in som admin på Servern
2. Leta reda på filen ”flash10e.ocx”
Sök vägen brukar vara: C:/Windows/System32/Macromed/Flash/Flash10e.ocx
OM inte kolla var den finns alt installera om.
4. Start kör cmd.exe
5. Sätt TS servern i install mode med
Change user / install
6. Kör kommandot nedan för att omregistrera OCXerna :
RegSvr32 C:/Windows/System32/Macromed/Flash/Flash10e.ocx
7. Sätt TS Servern i execute mode igen:
Change user / install
PAP2 Firmware Update
Easiest way to do this is via the ”upgrade URL,” the syntax for which is https://IPofPAP2/admin/upgrade?protocol://IPofServer/pathto.bin where [protocol] is http or tftp.
So, pasting ”https://192.168.2.20/admin/upgrade?https://192.168.2.10/spa.bin” into your browser would tell the PAP2 at 192.168.2.20 to download and install the firmware bin file located at https://192.168.2.10/spa.bin.
Please note binx is evidently NOT supported name syntax…. just rename it to bin…
As mentioned previously, many legacy Windows applications were created so you could access parts of the file system and registry that are now locked in Windows Vista, and many of these applications are not being immediately updated. However, Microsoft has devised an interesting solution within Windows Vista to provide backward compatibility so that legacy software still works.
If legacy applications attempt to access protected portions of the file system and registry without the proper permissions, UAC virtualization services silently redirect read and write operations from protected portions of the file system and registry to unprotected user-specific locations. This process is transparent to legacy software and occurs automatically.
For example, take a legacy software application that attempts to write to a configuration INI file located in:
C:\Program Files\<application>\Setup.ini
Windows Vista automatically detects that you do not have permission to save to that location. Windows Vista then copies the file (if it already exists) to:
C:\Users\<your_account>\AppData\Local\VirtualStore\Program Files\<application>\Setup.ini
Windows Vista then allows the write operation to succeed at the new file in the VirtualStore folder. Subsequent read and write operations for that file will always use the file copy located in the VirtualStore folder. However, the application will continue to believe that it is accessing the Program Files directory
For most cases this solution is sufficient, but it is not perfect. Data that the application thinks is globally accessible now becomes private to the user and almost invisible to other applications unless they also have virtualization enabled (typically only other legacy applications). Some applications will see one file, and some the other. If the application later tries to delete the INI file, the delete will appear to succeed, yet the file will still exist in the Program Files directory and remain visible to the application. If it retries the delete, an access denied exception will be thrown.
Although the majority of legacy applications run with virtualization, it is a short-term measure, not a long-term solution. Microsoft has already warned that you should not depend on virtualization being a part of future Windows releases after Windows Vista.
Use Active Directory Users and Computers to create a new organizational unit (OU). Right-click the OU, click Properties, and then on the Group Policy tab, click New Policy. Edit this policy with the following settings:
[Computer Configuration\Admin Templates\System\Group Policy]
Enable the following setting:
User Group Policy loopback processing mode
[Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options]
Enable the following settings:
Do not display last user name in logon screen
Restrict CD-ROM access to locally logged-on user only
Restrict floppy access to locally logged-on user only
[Computer Configuration\Administrative Templates\Windows Components\Windows Installer]
Enable the following setting, and set it to Always:
Disable Windows Installer
Note The default setting for Disable Windows Installer prevents any non-managed applications from being installed by a non-administrator. Setting Disable Windows Installer to Always may prevent some of the newer updates from Windows Update from being applied. Therefore, we recommend that you only set Disable Windows Installer to Always if there is a specific need or an identified threat that you must address.
[User Configuration\Windows Settings\Folder Redirection]
Enable the following settings:
Application Data
Desktop
My Documents
Start Menu
[User Configuration\Administrative Templates\Windows Components\Windows Explorer]
Enable the following settings:
Remove Map Network Drive and Disconnect Network Drive
Remove Search button from Windows Explorer
Disable Windows Explorer’s default context menu
Hides the Manage item on the Windows Explorer context menu
Hide these specified drives in My Computer (Enable this setting for A through D.)
Prevent access to drives from My Computer (Enable this setting for A through D.)
Hide Hardware Tab
[User Configuration\Administrative Templates\Windows Components\Task Scheduler]
Enable the following settings:
Prevent Task Run or End
Disable New Task Creation
[User Configuration\Administrative Templates\Start Menu & Taskbar]
Enable the following settings:
Disable and remove links to Windows Update
Remove common program groups from Start Menu
Disable programs on Settings Menu
Remove Network & Dial-up Connections from Start Menu
Remove Search menu from Start Menu
Remove Help menu from Start Menu
Remove Run menu from Start Menu
Add Logoff to Start Menu
Disable changes to Taskbar and Start Menu Settings
Disable and remove the Shut Down command or Remove and prevent access to the Shut Down command
Note In Windows 2000, this setting is named Disable and remove the Shut Down command. In Windows Server 2003, this setting is named Remove and prevent access to the Shut Down command.
[User Configuration\Administrative Templates\Desktop]
Enable the following settings:
Hide My Network Places icon on desktop
Prohibit user from changing My Documents path
[User Configuration\Administrative Templates\Control Panel]
Enable the following setting:
Disable Control Panel
Important When you enable this setting, you prevent administrators from installing any MSI package on to the Terminal Server, even if the explicit Deny is set for the Administrator account.
[User Configuration\Administrative Templates\System]
Enable the following settings:
Disable the command prompt (Set Disable scripts to No)
Disable registry editing tools
[User Configuration\Administrative Templates\System\Logon/Logoff]
Enable the following settings:
Disable Task Manager
Disable Lock Computer
For more information about how to lock down Windows Server 2003 Terminal Server Sessions, visit the following Web site:
https://www.microsoft.com/downloads/details.aspx?FamilyID=7f272fff-9a6e-40c7-b64e-7920e6ae6a0d&DisplayLang=en (https://www.microsoft.com/downloads/details.aspx?FamilyID=7f272fff-9a6e-40c7-b64e-7920e6ae6a0d&DisplayLang=en)
The Dsacls.exe tool
Dsacls.exe is a command-line tool that you can use to query the security attributes and to change permissions and security attributes of Active Directory objects. It is the command-line equivalent of the Security tab in the Windows Active Directory snap-in tools such as Active Directory Users and Computers and Active Directory Sites and Services. You can use Dsacls.exe to lock out Terminal Services end-users from files and folders on a Windows Server 2003-based computer or a Microsoft Windows 2000-based computer.
For more information about how to use the Dsacls.exe tool (Dsacls.exe) to manage access control lists (ACLs) for directory services in Windows Server 2003 and Microsoft Windows 2000 Server, click the following article number to view the article in the Microsoft Knowledge Base:
281146 (https://support.microsoft.com/kb/281146/ ) How to use Dsacls.exe in Windows Server 2003 and Windows 2000