RDP has a lot of issues, one is how to get the users to use the right settings for the .RDP file they use to connect. In the past, I’ve downloaded the .rdp from RDWeb, edited it and distributed the file to end-users manually – via email or group policy to put it on their desktop, etc. That was getting old, so now, I have found a way to manage it via the Registry on the RDP connection broker.

One thing I’d like to mention before getting into the code is another registry entry : Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\CentralPublishedResources\PublishedFarms\{TheNameOfYourCollection}\RemoteDesktops\{YourRemoteDesktop} and the entry ShowInPortal – set that to 1 to show, 0 to hide (which 0 is the default).

Now, on to editing the RDPFileContents – oh, you saw that in the image above? Same location in the registry. This entry has the whole RDP file contents in it – new lines and all – that is downloaded from RDWeb links. Sure, you could (carefully) edit the line in the registry – but if you accidentally take out a new line between entries, you can’t put it back in! So, the better way to do it is to download the file from RDWeb, Edit with Notepad++ (or similar, I guess plain ole notepad would work as well).

You can now edit the file – I suggest Session bpp:i:24, redirectsmartcards:i:0 (This can clear up performance issues!), and drivestoredirect:s:C:\; (note the ; after) at a minimum. See the whole list of settings at Microsoft. ( Note the Remote Desktop Services column )

Once you have the settings down – and have tested using the file you just edited – you can use the following Powershell (edit the variables, of course…) Oh, you do need to run this on your RD Web Server, if it is separate from your Gateway, Connection Broker, Host, etc., to set the .rdp file configuration in your RDWeb registry. For RemoteApps, change the RemoteDesktops to RemoteApps in the registry path.

##Powershell to create a multi-line registry entry from a file
#_RDP registry location is : Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\CentralPublishedResources\PublishedFarms
##_Gather the Variable Information
#_The file to import the information from
$FileToImport = "\\Path\to\your\saved\RDP-Desktop.rdp"
#_Set the entry type - for RDPFileContents, this is String.
$RegType = "string"  # For New-ItemProperty, but not used in Set-ItemProperty
#_Set the path to the Key (Folder) level of registry.
$RegPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Test\PublishedFarms\{YourRDPName}\RemoteDesktops\{YourRDPName}"
#_The Registry entry to Edit
$RegEntry = "RDPFileContents"
#_Import the file contents to a variable
$rContents = [system.string]::Join("`r`n",(Get-Content -Path $FileToImport))
# Assign the value
Set-ItemProperty -Path $RegPath -Name $RegEntry -Value $rContents -Force

Now your settings will be downloaded from RDWeb! No more distributing .rdp files with customized settings! With that set up and all user workstations set to not use UDP for RDP sessions, things should run smoothly!

I recently had a reason to need a solution to log off idle users from a workstation. “Group Policy!” was my first thought – but, no, the group policy idle logoff is only for Remote Desktop Sessions. Looking online, there were a lot of posts pointing this out – and decrying why Microsoft is so stupid as to not have this available. Its 2022 for crying out loud! I pieced together a script to log off idle users that actually works in a real company environment.

In my searching, however, I did find quser and powershell. You use quser, parse the output and log off idle users over an hour. Easy peasey, right? Nope. Not at all. For one thing, quser has some reality issues. ( I posted asking for help on sorting it out! )

The first thing about the quser output is how to properly put it in a good, powershell readable table. Some have suggested “convertfrom-string” – but that doesn’t handle the “Idle Time” and “Logon Time” very well, due to spaces.

The ‘original’ used :
Select-Object -Skip 1 | ForEach-Object {($_ -replace '\s{2,}', ',').Trim()} | ConvertFrom-Csv -Header $Header |

But that sometimes had issues as well, because if another user is logged on (switch user), the Session is empty, so you have a missing column and everything after ‘session’ gets shifted left by one.

Olaf (on the reality issues link above) helped me see how to use substring() to get what will work most, if not all, of the time. I haven’t seen an issue for it. I guess I may have been just too lazy to count it out. Either, way, it works.

The next thing is that “Idle Time” outputs a lot of different things – it can be ‘none’ or a ‘.’ or a measure of time ‘5’ minutes, ’14:54′ hours and minutes, or ‘1+13:33’ days plus hours and minutes. So, you have to, in a real-world situation, make allowances for such output and do your best to If/Then for all iterations.

The next thing is, that in Windows 10 and below, “Idle Time” doesn’t seem to actually be the individual user’s Idle Time. In testing, it seems more like ‘the time since any user last had a log on event.’
UserName SessionName ID State IdleTime
-------- ----------- -- ----- --------
bkearan console 1 Active 1+03:57
bktest 2 Disc 1+03:57

See how both users have the same ‘Idle Time?’ Even the Active user has an idle time. Now, in Windows 11, it appears to be closer to the user’s idle time (at least on my home, pc – my company laptop is 11, but has the same issue as 10) – but corporate environments haven’t all got to Windows 11. Some places still have Windows 7, but I digress. In Windows 10, you can’t use only idle time to log off a user – as it will log off an active user. … Yes, I got logged off as I was testing this theory. I clicked run in PowerShell ISE and got logged off immediately.

Now for the final kicker – a user is “Active” as long as they are the primary account logged on. Yep, the last logged on user NEVER goes to an Idle state. So far, I haven’t found a way around this last issue. However, if another user logs on after an hour – the Idle Time counter resets and the first user won’t be logged off for another hour.

I have the script set to run as a scheduled task on boot of the computers that need to log off users (so as not to get bogged down with multiple user sessions).

And I just added the Days as I was writing this. Just so much to parse! My Windows 11 laptop has been running the script for 3 days, 4 hours and 41 minutes – and I haven’t been near the laptop for two days, but my logged on user is still showing “Active.”

Then, I started looking for how to get the actual Idle time of the whole system. Now, I have added, as I write this, code to detect the time the system has not received any input whatsoever. So, here is the code that will log off ‘disconnected’ users and even the Console user if the whole system has been idle for over an hour: — and of course that doesn’t work. The Idle Console piece doesn’t get any input when tracking as the SYSTEM account – so logs off everything after an hour – even new logons. So I had to break it up into TWO scripts. The first script (below) is the one to run as a scheduled task on startup, run as SYSTEM.

#
# Complied from pieces of code and additions by Bobby Kearan with inspiration from
# https://www.reddit.com/r/PowerShell/comments/8r56tr/getting_idle_time_for_logged_on_domain_users/
# and Thanks to Olaf (https://forums.powershell.org/u/Olaf) for helping with parsing the output of quser properly


function Get-QUserInfo
    {
    [CmdletBinding()]
    Param (
        [Parameter ()]
            [string[]]
            $ComputerName = $env:COMPUTERNAME
        )

    begin
        {
        $Header = 'UserName','SessionName','ID','State','IdleTime','LogonTime'
        $No_Connection = '-- No Connection --'
        }

    process
        {
        foreach ($CN_Item in $ComputerName)
            {
            if (Test-Connection -ComputerName $CN_Item -Count 1 -Quiet)
                {
                $QuserOutput = quser /server:$CN_Item
                $QuserOutput -split "`n" | Select-Object -Skip 3
                $QuserOutput | Select-Object -Skip 1 |
                    ForEach-Object {
                    
						$IdleTime = $_.Substring(54, 11).trim()
						#Write-Host $IdleTime
						If (($IdleTime -eq 'none') -or ($IdleTime -eq '.') -or ($IdleTime -eq '$Null')) {
						$IdleTime = "Not Idle"
						}
						#Write-Host "Testing Idle Time " $IdleTime "for the + sign"
						IF ($IdleTime -like '*+*') {
                        $IdleTime = $IdleTime.replace("+",":")
                        #Write-Host $IdleTime " was the Plus sign replaced + ? "
						}
              
					If ($IdleTime -as [DateTime]) {
                        If ($IdleTime -match "\d\d\:\d\d"){
							#$IdleTime = [timespan]$IdleTime
							$Idleness = $IdleTime -split ":"
                        #Write-Host $Idleness.length
							If($Idleness.length -eq 2){
							$IdleTime = New-Object -TypeName PSObject
							$d = [ordered]@{Days=0;Hours=$Idleness[0];Minutes=$Idleness[1]}
							$IdleTime | Add-Member -NotePropertyMembers $d -TypeName Asset
							}
                        Else {
							$IdleTime = New-Object -TypeName PSObject
							$d = [ordered]@{Days=$Idleness[0];Hours=$Idleness[1];Minutes=$Idleness[2]}
							$IdleTime | Add-Member -NotePropertyMembers $d -TypeName Asset
							}
                        #Write-Host $Idleness[0] " = " $IdleTime.Hours
                        }
                        ELSE {
                          $IdleTime = New-TimeSpan -Start $IdleTime -End (Get-Date)
                          #Write-Host "IdleTime was a datetime-" $IdleTime
                          }
                       }
					   #Write-Host $IdleTime
						$final = $_.length - 65
						$Username = $_.Substring(1, 22).trim()
                    
						[PSCustomObject]@{
						UserName    = $_.Substring(1, 22).trim()
						SessionName = $_.Substring(23, 19).trim()
						ID          = $_.Substring(42, 3).trim()
						State       = $_.Substring(46, 8).trim()
						IdleTime    = $IdleTime
						LogonTime   = $_.Substring(65, $final).trim()
                        }
					}
                }
                else
                {
                [PSCustomObject]@{
                    ComputerName = $CN_Item
                    UserName = $No_Connection
                    SessionName = $No_Connection
                    ID = $No_Connection
                    State = $No_Connection
                    IdleTime = $No_Connection
                    LogonTime = $No_Connection
                    }                
                }
            } # end >> foreach ($CN_Item in $ComputerName)
        } # end >> process {}

    end {}

    } # end >> function Get-QUserInfo

    #$Info = Get-QUserInfo -ComputerName localhost

    $Logfile = "c:\scripts\LogOff.log"
    $oldLogFile = "c:\scripts\Logoff.old.log"
    $LogMessage = ""
    #If log file exists, copy to old log and start a new one
    if (Test-Path $Logfile) {
        Copy-Item $Logfile $oldLogFile -Force
        Remove-Item $LogFile
    }
    #Initalize Log file
    $LogMessage = "Log Start: " + (Get-Date)
    $LogMessage >> $Logfile

    $state = "Active"
    While($state = "Active"){
        $Info = Get-QUserInfo -ComputerName LocalHost
        ForEach ($user in $Info) {
			$IdleHou = $user.IdleTime.Hours
			$IdleMin = $user.IdleTime.Minutes
			$IdleDays = $user.IdleTime.Days
			#Write-Host $user.State " User " $user.UserName " has been idle " $IdleDays " Days " $IdleHou " hours, " $IdleMin " Minutes - Logged On Time =" $user.IdleTime
			If (($user.State.Trim() -ne "Active") -and ($IdleHou -ge 1)) {
				#Write-Host $user.UserName "Should be logged off"
				logoff $user.ID
                $LogMessage = Get-Date
                $LogMessage >> $Logfile
                $LogMessage = $user.State + " User " + $user.UserName + " has been idle " + $IdleDays + " Days " + $IdleHou + " hours, " + $IdleMin + " Minutes - Logged On Time =" + $user.IdleTime
                $LogMessage >> $Logfile
			}
			
        }
        $logsize = ((Get-Item $LogFile).length/1MB)
        if ($logsize -gt 5) {
            Copy-Item $Logfile $oldLogFile -Force
            Remove-Item $LogFile
            $LogMessage = Get-Date
            $LogMessage >> $Logfile
        }
        Sleep -Seconds 260
    }
    
    

I did add a couple things after posting. That would be adding in self-cleaning Logging. Now, the second one, runs as a link from the Startup folder for all users. ( C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp )

#
# Written by Bobby Kearan with inspiration and code from:
# https://stackoverflow.com/questions/15845508/get-idle-time-of-machine
#

Add-Type @'
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace PInvoke.Win32 {

    public static class UserInput {

        [DllImport("user32.dll", SetLastError=false)]
        private static extern bool GetLastInputInfo(ref LASTINPUTINFO plii);

        [StructLayout(LayoutKind.Sequential)]
        private struct LASTINPUTINFO {
            public uint cbSize;
            public int dwTime;
        }

        public static DateTime LastInput {
            get {
                DateTime bootTime = DateTime.UtcNow.AddMilliseconds(-Environment.TickCount);
                DateTime lastInput = bootTime.AddMilliseconds(LastInputTicks);
                return lastInput;
            }
        }

        public static TimeSpan IdleTime {
            get {
                return DateTime.UtcNow.Subtract(LastInput);
            }
        }

        public static int LastInputTicks {
            get {
                LASTINPUTINFO lii = new LASTINPUTINFO();
                lii.cbSize = (uint)Marshal.SizeOf(typeof(LASTINPUTINFO));
                GetLastInputInfo(ref lii);
                return lii.dwTime;
            }
        }
    }
}
'@

    $SysIdle = @('00','00')
    $Logfile = "c:\scripts\LogOff-console.log"
    $oldLogFile = "c:\scripts\Logoff-console.old.log"
    $LogMessage = ""
    #If log file exists, copy to old log and start a new one
    if (Test-Path $Logfile) {
        Copy-Item $Logfile $oldLogFile -Force
        Remove-Item $LogFile
    }
    #Initalize Log file
    $LogMessage = "Log Start: " + (Get-Date)
    $LogMessage >> $Logfile
       
    $state = "Active"

    While($state = "Active"){
	$SysIdle = [PInvoke.Win32.UserInput]::IdleTime
	$SysIdle = $SysIdle -split ":"
	#Write-Host $SysIdle[0] " " $SysIdle[1]
			
	If([int]$SysIdle[0] -ge 1){
		#Write-Host "System has been Idle for over an hour. Log everyone off"
		logoff $user.ID
        $LogMessage = Get-Date
        $LogMessage >> $Logfile
        $LogMessage = $user.State + " User " + $user.UserName + " has been idle " + $SysIdle[0] + " hours and " + $SysIdle[1] + " minutes."
        $LogMessage >> $Logfile
	    }
        Else {
        $SysIdle = @('00','00')
        }
        $logsize = ((Get-Item $LogFile).length/1MB)
        if ($logsize -gt 5) {
            Copy-Item $Logfile $oldLogFile -Force
            Remove-Item $LogFile
            $LogMessage = Get-Date
            $LogMessage >> $Logfile
            }
        Sleep -Seconds 260
    }

Moving a client from Server 2008 to Server 2019 Domain Controller. Which means adding the 2019 server to the domain as a domain controller, promoting it, etc. But the first step is to do DFSRMig – migrate from FRS to DFSR for Active Directory.

DFSRMig – Run this on the old DC

1# To see what state DFS is in
DFSRMig /GetGlobalState

2# Start the migration to DFSR with
DFSRMig /SetGlobalState 1

3# To check on the migration progress
DFSRMig /GetMigrationState – This will take some time: Run this command until it is in a consistent state.

4# Next step is to Redirect
DFSRMig /SetGlobalState 2

5# When that process is complete (check using /GetMigrationState), move to 3
DFSRMig /SetGlobalState 3

The idea is to get to “Eliminated” state – so you can promote the 2019 server to a DC. Well, I found out that when you get it to “Eliminating” – just after running Set Global State 3 – you can go ahead and promote. However… the old DC might get stuck in eliminating.

Now, the interwebs have plenty of suggestions and those should work in most cases – not mine, but most. I was completely baffled… but was restarting the service and looking at event logs… and seeing “access denied” messages. Which was totally weird. I eventually put 7 and 10 together and got 42…

I opened ADSIEdit (as admin) and went to Domain Controllers, expanded those…

And clicked on the Domain Controller names that was there and went to security… at first, nothing looked off… but eventually, I saw that somebody(!!) had set a Deny on the EVERYONE group so that nobody could delete anything under there – including the NTFSR (NTFRS?) folders! So, of course, it couldn’t eliminate it – access was, in fact, denied. I removed the deny from a couple ‘delete’ permissions and stopped the DFSR service and started it again – Boom! Eliminated!

Wow.

So, I copied some profiles over using Robocopy. The size of these profiles on the new server was staggering! I had to expand the drive to accommodate the bloat!
Then I started looking – the data on the original profiles was not anywhere close to that big.

What happened?

Well, this is my normal robocopy command :

Robocopy \\OldServer\c$\Users\username C:\users\username * /ZB /e /Copy:DATSO /dcopy:DAT /xo /r:0 /XD $Recycle.Bin DFSRPrivate /XF desktop.ini thumbs.db /Log:c:\temppath\username.log /np /tee

One profile got the glitch – and others were starting to before I added a little line in my command code:

Robocopy \denali-rds-s16\c$\Users\username C:\users\username * /ZB /e /Copy:DATSO /dcopy:DAT /xo /r:0 /XD $Recycle.Bin "Application Data" DFSRPrivate /XF desktop.ini thumbs.db /Log:c:\temppath\username.log /np /tee

The profile that had the problem – well, I am still deleting with the following code:

Robocopy c:\temppath\blank "C:\users\username\appdata\local\application data\application data" * /ZB /e /purge /Copy:DATSO /dcopy:DAT /xo /r:0 /XD $Recycle.Bin DFSRPrivate /XF desktop.ini thumbs.db /Log:c:\temppath\usernamePurge.log /np /tee

c:\temppath\blank is an empty folder. Robocopy will delete anything within the target thanks to the /purge switch. This also works for folder paths with more than 256 characters that windows can’t delete on it’s own.

Anyway – starting I had 190 GB free on the drive – I am at 400 GB free on the drive now. More than 200 GB in nested “Application Data” folders – replicated by robocopy over and over and over again.

24 nested folders – and this is after about 20 minutes of deleting! It is still going as I write this!

… and it just finished – 402 GB free –

Okay, I know what you’re thinking – what does copying a profile to a new system with Robocopy accomplish? It doesn’t really transfer the profile over!

That is where I have to give a shout out to the Genius team at ForensIT – Profile Wiz is a life safer!
http://www.forensit.com/products.html

You can use Profile Wiz to literally take over a profile! Lets say, for example, JohnSmith worked for the company for 5 years, and all his documents and such were in his profile. John gets hit by a bus and you get a new employee – Brad Cooper – well, you want Brad to have all of John’s information – you can use Profile Wiz to give c:\users\johnsmith to the BradCooper login. Concerned about the folder name? Change the folder name to BradCooper – and then use the “Unassigned Profiles” checkbox to assign it to Brad.

Absolutely worth the Profession Edition!

A lot of guides and how-to videos out there show you the basics and the bare-bones – this is real world, git’r’done right stuff!

The first step to setting up a new domain, or creating a new domain controller for an existing domain, is, of course, to install the OS. We’ll assume that has already been done.

If you are adding a 2019 DC to an existing Domain, you will probably need to migrate the domain to use DFSR instead of FRS for syncing Active Directory and DNS – see the DFSR Migration section.

In the video above, I may do things in a different order, but here are the first steps:

A. Set a static IP address and Public DNS servers. The DNS servers you set here will become the DNS Forwarders of your new Domain Controller.

B. Name the new server something those who come after you will understand. This means your organization name, year it was created and the server’s role should be in the name of the server. For a business named Kearan Company, our first domain controller could be Kearan-19-DC – created in 2019, acting as a Domain Controller. -DCFS, -RDS, -APP, -SQL, -Web, -Intranet are all possibly good role names to use. Just make sure that it is not a very long name – there are limits! 16 Characters for the server name should be fine. (Changing the name requires a reboot!) (Update:) It has come to my attention that Domain Controller In-Place-Upgrades are easier and more reliable than before, so maybe having the OS in the name is not a perfect idea, in case you update from 2012 to 2019 OS. If this is something you would be comfortable with, make a naming convention – Kearan-DC-001 ; Kearan-RDS-002 ; Kearan-RDS2-003 ; etc.

C. Use Server Manager to install the Active Directory Domain Services role and DNS Server – see the above video for a walk-thru on that process.

D. With the roles installed and the server rebooted, promote to a domain controller! Document the DSRM Password!

• Domain name is very important – keep it short and informative. For a company named Contoso Specialty Products Supply Company, a domain such as “Contoso” or “CSPSC” would be perfect. The dot-local (Contoso.local) is preferred, as it is the default. You can use another such as .corp or .main – I have even seen .private – but stay away from the major top level domain extensions such as .com, .net and .org as these can cause a conflict between local DNS and Public DNS. So, New info has come to light – .local and other ‘private’ extensions are being sold as a TLDs (Top Level Domains) now, so the new Best Practice is to make your domain a sub-domain of a domain you own. So, you own Contoso.net (but not .com), you would want to make your local domain something like ad.contoso.net or internal.contoso.net. This way, you can also get SSL certs for your local domain names.
• Document the DSRM password where it can be found in the future! Just in case.
• Netbios name is just a short version of the domain name – so if you’re using ad.contoso.com – make the netbios “contoso” – it has a 15 character limit, so be brief.
• Reboot and Log in to your new Domain!

E. Set some important DNS settings to squash problems before they happen

• Set Aging/Scavanging for all zones
• Apply to existing Active Directory-integrated zones
• Allow zone transfers to servers listed on the Name Servers tab
• Automatically notify the severs listed on the Name Servers tab
• Check and/or set forwarders

F. Open AD Users and Computers and create a good AD structure!

You will need to move newly added users and computers from their default “Users” and “Computers” containers into your structure, but it will make organization and group policy much easier to manage in the future.

(See below for an AD User Import powershell!)

G. Copy the Administrator user and create a domain admin user based on your company – such as KearanIT. Add the new admin to the Backup Operators group. Log off of Administrator and log in with the new domain admin account. Now, DISABLE ADMINISTRATOR!
Move the new Admin account into the Service Accounts OU created as part of the good structure.

H. Make the Domain Controller a Reliable Time Server using the commands below:

w32tm /config /manualpeerlist:"1.pool.ntp.org 2.pool.ntp.org 3.pool.ntp.org" /syncfromflags:manual /reliable:yes /update
w32tm /config /reliable:yes 
net stop w32time && net start w32time     
w32tm /query /peers   

Powershell, CMD Line and Troubleshooting for
Domain Controllers

DFSR Migration

First, raise the Forest functional level to as high as possible – must be at least 2008 R2. Now get the Global State:

DFSRMig /GetGlobalState

Start the migration –

DFSRMig /SetGlobalState 1

Check on progress –

DFSRMig /GetMigrationState

Once the migration state says all domain controllers are synced, then go to SetGlobalState 2 – GetMigrationState until that is synced, then SetGlobalState 3 until that is synced. 3 is the Final state – you are all on DFSR now!

Powershell to Move FSMO Roles

Run the following in an Admin Powershell window on the server you want to be the new FSMO role holder:

Move-ADDirectoryServerOperationMasterRole -Identity $env:computername -OperationMasterRole 0,1,2,3,4

Don’t forget to Move the Last Two FSMO Roles using ADSIEdit.

Powershell to Import Users from a CSV file

You will need to copy the powershell code below into a new Powershell ISE module, then save it as a .ps1 and edit it for your needs. Create the CSV file with the two lines after “format of file:”

# - Imports given CSV file
# format of file:
# Firstname,Lastname,SAM,OU,Password,Description,EmailAddress
# bobby,kearan,bkearan,"OU=Employees,OU=Users,OU=_Kearan,DC=kearan,DC=local",[email protected],Awesome IT Engineer,[email protected]
#
 $csvPath = "C:\KearanCode\ADUserImport.csv" # Read-Host -Prompt 'path to the csv file'
 $Servername = $env:computername # Read-Host -Prompt 'Name of the DC (servername)'
#
 $Users = Import-Csv -Path $csvPath        
 foreach ($User in $Users)            
 {            
     $Displayname = $User.'Firstname' + " " + $User.'Lastname'            
     $UserFirstname = $User.'Firstname'            
     $UserLastname = $User.'Lastname'            
     $OU = $User.'OU'            
     $SAM = $User.'SAM'                     
     $Description = $User.'Description'            
     $Password = $User.'Password'            
     $Email = $User.'EmailAddress'
     New-ADUser -Name "$Displayname" -DisplayName "$Displayname" -samaccountname $SAM -UserPrincipalName $SAM -GivenName "$UserFirstname" -Surname "$UserLastname" -Description "$Description" -Emailaddress "$Email" -AccountPassword (ConvertTo-SecureString $Password -AsPlainText -Force) -Enabled $true -Path "$OU" -ChangePasswordAtLogon $false –PasswordNeverExpires $false -server $Servername            
 } 

You will need to set them all to not need to change their password on first logon by using the following two commands:

Import-Module ActiveDirectory
Get-ADUser -Filter * -SearchBase "OU=_Kearan,DC=Kearan,DC=Local" | Set-ADUser -ChangePasswordAtLogon:$False 

DCDiag Commands

The following does a report and saves it in a txt file on the root of C:\ (adjust to your preferred file path)

DCDiag /c /v /f:c:\dcdiag.txt

The following does a report and attempts to fix any issues it found and puts the txt file in the root of C:\

DCDiag /fix /v /f:c:\dcdiag.txt

Force a Time Zone Change

For some reason, Windows has become a bit difficult about changing the time zone. Below is a command line to see the time zone and change it. Last line outputs a list of time zone names that can be used. Open the cmd window as admin to run this.

tzutil /g
tzutil /s "Central Standard Time"
tzutil /l

Group Policy Central Store

A central store for Group Policy is a good thing to implement.  This allows all domain controllers to access the same policies no matter what version of server they are running.  To set this up, follow the below steps:

1. Create the Central Store on a Domain Controller by creating the policy definitions folder: C:\Windows\SYSVOL\domain\Policies\PolicyDefinitions
2. Copy all of the contents of C:\Windows\PolicyDefinitions into the newly created folder.

You now have a Central Store – as this gets replicated to all domain controllers.

Now you can download more up to date .admx files – such as windows 10 and windows 11 policies – or Google Chrome templates.  Extract those and then copy over to the central store.  Put the .admx files with the rest of the .admx files, and copy the language files from the “en” folder to the “en” folder in the central store.  You do not need to copy all the other language files unless you will be using them.

— what would you like to see covered next? Comment below —

So, ran into a situation the other day where some printers were added to some computers they were not supposed to be on. When we went to remove them – nobody could. Access denied. Enterprise Admin could not remove the printer from the computer.
Why?
Group Policy.

There are a few ways to deploy printers via group policy.
1. Click “Deploy” on your print server. Unless you want everyone and every system in the entire domain to have that printer – do not do this. You won’t know which policy it uses to deploy the printers, you won’t know where it is applied. ( probably sets a “printer” policy on the root of the domain )
2. Create a group policy using Computer Configuration –> Policies –> Windows Settings –>Printer Connections (on older DCs)  ( Don’t do this! )
3. Create a group policy using Computer Configuration –>Preferences –> Control Panel Settings –> Printers (Nobody will be able to delete these printers)
4. Create a group policy using User Configuration –> Preferences –> Control Panel Settings –> Printers (You will be able to delete these printers – and they will show back up on next reboot, unless removed from the policy)