Lockdown Internet Explorer 7 Address Bar, Print, and Menu options.

The following screenshot shows that the address bar is disabled, navigation is also disabled, as well as the print buttons and file menu item. These settings are applied by using a custom ADM file in Group Policy.

The following group policy settings should be applied to the servers. These policies will disable any workaround that the user may use to gain access to another website.

Users\Administrative\Templates\Internet Explorer

\Internet Control Panel

\Browser Menus

\Toolbars

ADM file to be added.

CLASS Machine
CATEGORY InternetExplorer7Lockdown
POLICY "IE7 Lockdown Settings"
EXPLAIN !!Help
KEYNAME "Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions"
PART !!Addressbar_title DROPDOWNLIST REQUIRED
VALUENAME "NoAddressBar"
ITEMLIST
NAME !!Addressbar_enable VALUE NUMERIC 0 DEFAULT
NAME !!Addressbar_disable VALUE NUMERIC 1
END ITEMLIST
END PART
PART !!NavButtons_title DROPDOWNLIST REQUIRED
VALUENAME "NoNavBar"
ITEMLIST
NAME !!NavButtons_enable VALUE NUMERIC 0 DEFAULT
NAME !!NavButtons_disable VALUE NUMERIC 1
END ITEMLIST
END PART
END POLICY
POLICY "Disable: Printing"
Explain !!Help2
KEYNAME "SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"
PART !!PrintButton DROPDOWNLIST REQUIRED
VALUENAME "Btn_print"
ITEMLIST
NAME !!PrintShow VALUE NUMERIC 1 DEFAULT
NAME !!PrintHide VALUE NUMERIC 2
END ITEMLIST
END PART
END POLICY
POLICY "Disable: File Menu"
Explain !!Help3
KEYNAME "SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"
PART !!FileMenu DROPDOWNLIST REQUIRED
VALUENAME "NoFileMenu"
ITEMLIST
NAME !!FileShow VALUE NUMERIC 1 DEFAULT
NAME !!FileHide VALUE NUMERIC 2
END ITEMLIST
END PART
END POLICY
END CATEGORY 
[strings]
InternetExplorer7Lockdown="IE7 Settings"
Addressbar_title="Set the IE7 Address bar to: 
Addressbar_enable="Enabled"
Addressbar_disable="Disabled" 
NavButtons_title="Set the IE7 Navagation buttons to: 
NavButtons_enable="Enabled"
NavButtons_disable="Disabled" 
PrintButton="Hide Printer button?"
PrintShow="No"
PrintHide="Yes"
FileMenu="Hide File menu?"
Fileshow="No"
Filehide="Yes"
; explains
Help="Enabled: This policy will change registry settings to disable the address bar and navigation buttons IE7." 
Help2="Enabled: This policy will allow you to Hide or Show the print button in IE7." 
Help3="Enabled: This policy will allow you to Hide or Show the File menu item in IE7."

Issues:

Users will still be able to press CTRL+P to print – I am unable to find a way around this.

APP-V Server install

Found a very helpful write-up on how to get app-v installed on a Server 2k8r2 box.

They tech net articles are a little convoluted, while all the information is there, you have to find about 10 articles to get things set up.

http://social.technet.microsoft.com/wiki/contents/articles/how-to-install-and-configure-the-app-v-management-server.aspx

Also, one of the things that I had issues with was the fact that .net 4 was installed on the servers. Make sure to uninstall .net 4 framework before trying to install app-v, unless you like scratching your head.

Remember to reinstall .net 4 after though

Cheers!

Domain Controller Assessment

I really wish Microsoft would release a single product that would be able to assess the health of the overall domain controller.

Server 2008 does come with built in Best Practice Analyzers and they are very helpful.

This is really nice because you are able to click on anything that gives you a warning or error and open up the properties of that error.

As you can see, Microsoft even suggests how to fix the issue.

This is all fine and good and you can run these BPA on any of the roles you have installed, however, some times you run into a server that is so broken that these BPAs won’t run. That is when you have to use a basket full of commands. I have added in few that I use and just put them into a batch file that I can run on the servers.

Example:

mkdir c:\<Folder> dnscmd /info > c:\<Folder>\dnsinfo.txt dnscmd <SERVERNAME> /directorypartitioninfo DomainDnsZones.<DOMAIN> > c:\<Folder>\dnspartitioninfoDomain.txt dnscmd <SERVERNAME> /directorypartitioninfo forestDnsZones.<DOMAIN>> c:\<FOLDER>\dnspartitioninfoForest.txt repadmin /showreps > c:\<FOLDER>\replog.txt repadmin /replsum /errorsonly > c:\<FOLDER>\replogerror.txt route print > c:\<FOLDER>\routes.txt copy c:\windows\system32\drivers\etc\* c:\<FOLDER>\

I grab the routes as well as all the files in the etc folder because I have run across issues before where someone had gone in and put static routes on the servers or static entries in the hosts file or protocols file that had me scratching my head for a few hours until I figured it out. It’s best to just grab these files and make sure they are clean.

I would like to know what other commands people use and why they use them, maybe we can get a super script that will take 2 seconds to run and generate a nice report with useful information.

EDIT: I left DCDIAG and NETDIAG.. not sure why.. I just did

Windows Deployment Services

Currently I am working on getting an all inclusive guide for Windows Deployment Services. There are a lot of guides online, however, none address the whole process of deploying custom images to client machines.

Look for a complete guide and video walk through soon!