Open File Security Warning - Complete Resolution

This is one of the most popular topics on the web, its absolutely crazy how many people have been involved in discussions about it.

Welcome to our version on Thoughts of Primary School Tech, ironically with me, a college tech (and manager I might add), my my we have moved one since we first starting blogging on here.

Lets sort the questions out once and for all and get some pictures involved.  None of this, "just add it to gpo" generic responses, or "that is trusted zone, just add it there", nothing more annoying when someone posts up a solution in their own language and you have no clue how to solve the problem.

The Policies

First lets bring up a picture, we all understand pictures.

For those with visual difficulty, this picture shows a side by side comparison of the Server 2012 group policy which affects the 4 security zones found on the security tab in Explorer.

In Group Policy this is found in the following location:

Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Site to Zone Assignment List.

On the Client machine the security page is found by going to:

In go to Tools (Alt+X), then go to Internet Settings.  Choose the Security Tab.

Now even though we are playing within Internet explorer settings, you should know windows well enough to know that a window that shows your files is using the Explorer.exe process. Just because these settings live in internet explorer, doesn't mean they do not affect the settings within the rest of the operating system.  This is a big reason to why removing internet explorer is almost impossible without breaking something else, it is part of the operating system and the settings affect the system as well.

Drive Mappings

Right a mapped drive defined by either a script or preferences is just putting a friendly look on what would would be an UNC path which non technical folk, bless them, would never understand.

The mapped R:\ drive for example, would actually be the location \\Servername\sharename\resources but we cannot expect our users to know this, so we just say it's the R:\ drive.  Simple.

Now you can map this location in five potential (realistic) ways.

• You map it based on the NETBIOS name of the server, so lets say our server is called File-SVR-01, so the map would look like \\File-SVR-01\Sharename\resources.
• You can map it based on the server's IP address so: \\192.168.10.4\Sharename\resources
• You can map it based on an alias of your server so: \\Files\Sharename\resources
• You can map it based off a DFS namespace so: \\domain.local\NS\Sharename\resources
• You can map it based off the full FQDN of the file server so: \\File-SVR-01.domain.local\Sharename\resources

There are probably plenty of others, especially we get SANS involved, but I feel for the majority of us, these five should be the most common ways.

Now I know that stuff like using NETBIOS or the FQDN are essentially the same, and yes in all intensive purposes you would be correct, but for this file security warning we suffer on a daily basis it can matter in which method you used.  Consistency is important when mapping drives, if you use the FQDN, then you must use it for every share, do not cut corners here or you can get some unexpected results. 

Fix the problem

Lets fix the problem on one machine first, prove the fix and just get rid of that open file security warning once and for all. I do not want you to start deploying out policies you might not have full understanding of because whats the point if you do not learn anything from it.  

Get on a machine, login, ideally you need to be on an account that has permission to alter the internet explorer security settings, so domain administrator on a machine in a different OU unrestricted by policies. You need to have mapped drives however to test.

Find a .exe file in the mapped drive and attempt to use it.  It should not run immediately and you get the famous:

Open Security File Warning

Notice that even as an administrator, this still appears.

Notice at the bottom the warning you receive, this is important. 

"While files from the internet can be useful, this file type can potentially harm your computer.  Only run software from publishers you trust"

This is the error we would like to see, as this entire topic is based on this particular one.  The following two errors are different problems:

User Account Control Error

  

Fix found here: Turn off UAC via GPO

Digital Signature Error

Fix found here: Fix Digital Signature Security Warning

Now that you understand the differences between the three errors above, lets assume you have got the first error screen the one specifying it is a file from the internet and poses a security risk.

Now you know that the file is not from the internet and is from your local network, you know this because you know your mapped drive is a server location. So now you need to add your server to your intranet zone, not trusted zone, not restricted, not internet zone, your intranet zone. 

This is important as there are a lot of people out there that are all like, stick it in your trusted zones, this can actually cause you more headache sometimes. The reason being is because in all server versions with the exception of 2008R2 and above, the trusted zone would of actually worked.  

Weird right?  I never tested this theory but apparently after endless searches and realization of the pattern, everyone who has this problem on 2008 or lower, resolved it, yet those that have 2008R2 or higher, said it doesn't, so I have to make that connection there.  Might not be true, but I never said I was honest. 

The reason being is that trusted sites does not turn off prompts, intranet does. 

Before we even touch server side, lets make it work on one machine, then we know what to type in on the server, as the server does not have any validation of the information you type into it, meaning you might attempt to force incorrect keys onto your clients, which is not good and causes errors, these errors will be explained at the end of this post.

Go to: In IE ->  Tools (Alt+X) -> Internet Settings ->  Security Tab -> Local Intranet -> Sites -> Advanced

Type in *.domain.local  (filling in domain.local with the full name of your domain).

If you do not type it in correctly, you will be presented with this error:

This error explains the syntax that can be put in this setting.  If you do not meet the syntax requirements, it tells you about it. However, if you type the incorrect syntax on the sever, it will still accept it. This is why we do it on the client first, once we do it right here, we know exactly what to type on the server.

After you have typed in your wildcard domain, press ok and exit out of Internet explorer. 

Now try to open your .exe you tried before and hopefully the security file type will vanish.  You have successfully found the fix for the problem and can move to the Server Side Policies.  

Continue Only if the security file prompt still appears, if it has vanished, go to the server side settings.

If it is still not working, then continue.

Now go back to the same advanced menu and remove the *.domain.local setting, since we know it does not work with just this, there is no point in it now.  

Now the reason this wouldn't work is most likely because of the way you are mapping your drives, if your drives are not being mapped with a Netbios or FQDN name, then this would the reason for it.  If you map using IP Addresses, then this is a common reason for the failure.

So this time in the advanced menu you must put the IP Addresses of your file server(s) and if you want the entire scope to treat the entire domain as intranet. 

Remember the syntax and no /24 /23 subnets do not qualify.  

The trick now is trial and error and requires you to make some decisions.  I do not know your network and frankly would confused you if I started recommending some things.  Try different combinations.  The benefit however is that you know when you type something in, it is valid if it accepts it and is invalid if it doesn't, take advantage of this validation as the server does not give you this luxury.  

Eventually you will find that it accepts something and as you test the .exe from the mapped location, bang, the .exe starts to run without the warning, at this point cheer!  Remember the setting, the exact setting remember the syntax like it was your own name. Lets move to the server now.

IMPORTANT - Remember this setting, it is your fix and you need to type it in on the server. 

Server Side

• Go to your primary domain controller
• Open up group policy management.
• Go to: Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page

• In here I have manually enabled the following policies:
• Intranet Sites: Include all local (intranet) sites not listed in other zones
• Intranet Sites: Include all sites that bypass the proxy server
• Intranet Sites: Include all network paths (UNCs)
• I have disabled
• Turn on automatic detection of intranet

These polices affect the settings in the Local Intranet window found by going to:

In IE ->  Tools (Alt+X) -> Internet Settings ->  Security Tab -> Local Intranet -> Sites

Applying the policies above will grey out and prevent change in this area. 

Now Site to Zone Assignment policy (below) will affect everything within the Advanced menu from here, as you can see the "advanced" button above.

Site to Zone Assignment

This is the advanced menu where the settings will appear.

The setting will not appear if you do not specify the value of "1" to the value name (see next image)

Within this policy you can specify the security zones for your intranet.

Values are:

1. Intranet Zone
2. Trusted Site Zone
3. Internet Zone
4. Restricted Zone

To prevent file security windows appearing when opening up a certain file type from a mapped drive, you must know how your mapped drive is mapped first.  The setting you discovered by following this document will be the setting you need to deploy out.

So type in your setting e.g. *.domain.local in the Value name field and type in 1 in the value field.

Now remember that Validation error:

This will not happen if you make a mistake here, the server will accept it regardless of if it is right or not. This is bad and should not be done.

Gpupdate and RESTART your client machines once you have put in the setting and applied it in group policy.

Open up a client affected by the policy, go to the advanced menu in Internet explorer intranet settings and see if your policy has applied.

Try and open a .exe as a restricted user and by magic, your file security warnings now vanish as if they were never a problem.  Such a pain in the backside, but all this work is worth it, especially if you use software that when updated server side runs .exes when loading up client side.


Known Errors

If you find other errors that relate to this, please tell us in comments, the longer the list the easier it is for those struggling to find this blog.

Error 1
Windows failed to apply the Internet Explorer Zonemapping settings.  Internet Explorer Zonemapping settings might have its own log file. Please click on the "More information" link.

Cause
You've typed something in wrong in the Site-to-Zone Assignment policy that does not meet the requirements of the syntax.

Resolution
Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Site to Zone Assignment

Stick to the recommended syntax sequence, below is an image showing examples of the correct sequences supported by Windows.

"Documents.library-ms" is no longer working.

You may get a user complaining that when they open Windows Explorer they get a message  stating "Documents.library-ms" is no longer working. This library can be safely deleted from your computer.

This appears to be a corruption to one of the default library folders used to collate folder locations together in Windows 7 and 8. Happily it is easily fixed.

Open Windows Explorer, Right click on the Library in question, right click on Libraries and select restore default libraries.

You should find that the library has been repaired and you are up and running again.

C:\windows\Panther\unattend.xml [SOLVED] MDT 2012 Deployment, Windows 7

Problem Explanation

You've created a new image, captured it and attempted deployment and received the error: 

"Windows could not parse or process unattend answer file [C:\windows\Panther\unattend.xml] for pass [specialize]. A component or setting specified in the answer file does not exist."

Alternatively, you've just made a new MDT Task Sequence and slipstreamed updates into it and received the same error.

Symptoms

• Infinitely looping on first boot
• Windows has encountered a problem, press ok to restart.
• C:\Windows\Panther\Unattend.xml Error (described above)

Reasons

The cause of this is simple, it's internet explorer 10.0 which you have installed either within the image or slipstreamed into the image.

Fix [SOLVED]

Actually simple, but only if you know where to look and since you've probably scrolled down and ignored everything I said above, I'll get to the point, follow these instructions:

1. In your MDT Deployment Workbench, go to your list of task sequences.
2. Right click the task sequence you are using to deploy out your new image with IE 10.
3. Go to the properties of this task sequence.
4. Choose the OSInfo tab and click "Edit Unattend.xml"
5. Wait about a year for it to load up the catalogue.... (depending on your machine speed, this can take quite a while, this opens the Windows System Image Manager (WSIM)
6. Go to Unattend -> Components -> Specialize
7. Choose the Microsoft-Windows-IE-InternetExplorer-Neutral from the list
8. Find IE-WelcomeMessage
9. The Status should say false, if it doesn't make sure it does.
10. Right click this value and in the context menu (the right click menu) UNTICK "write image value" (See Image for a visual aid)

11. Save the Unattend.xml and to be on the safe side update your deployment share (though I don't believe this is needed but it makes you feel better inside)

Reinstall your image onto your client and it should work fine for you now :D

EDIT [17-11-2013 - MDT 2013] 

Having spoken with some of my colleagues I have ascertained that by using MDT 2013 they have not encountered this issue, however if you need to maintain support to deploy Windows XP images then you will not be able to upgrade.

Migrating Wireless settings between Windows 7/8 Machines

 

I have recently been given a new laptop from work, as part of the setup process I needed to copy over the large number of wireless networks that I connect to as part of my job.Windows provides an export using the netsh command

netsh wlan export profile folder=. key=clear

The code above will export all networks as individual xml files into the current working directory which is great, however the netsh command does not to my knowledge allow the import of all definition files in a directory in one go, so how to solve this problem? Our old friend PowerShell, after all we are batching a command and PowerShell is pretty good at not giving a damn about file names or how many items are in a folder.

 

So this post is going to be all about a PowerShell script which allows you to export your wireless settings and import them again elsewhere. The script itself is split into several functions and a few loops and is pretty simple and can probably be made much more elegant, however it does work

 

Code:

We start by declaring or resetting our variables, always a good idea if we are running the code in the PowerShell ISE or PowerGui (My preference) in case any values remain from a previous run through

1 $path="D:\Wireless"
2 $menuanswer=$null
3 $pathready=$null

$path is the path we want to use to store the wireless xml files in, this can be edited to any folder we like (useful if you don’t have a d: drive like I do)

Now we need a few functions, the first will export our wireless connections to xml files

Export Profiles

1 function export_wifi_profiles{
2  #check for folder path
3  $pathready = Test-Path $path
4  if ($pathready -eq $false){
5   mkdir $path
6  }
7  cd $path
8  netsh wlan export profile folder=. key=clear
9 }

Line 3 is used to check whether the path we have specified earlier as available, if the path does not exist then the folder specified will be created before moving on, if it exists then the netsh command will be run which will dump all wireless networks as individual files into the path.

 

Import WIFI Profiles

 1 function import_wifi_profiles{
 2  #check default path, if not found prompt for location
 3  do {
 4   $pathready = Test-Path $path
 5   if ($pathready -eq $false){
 6    $path=Read-Host "Default import path not found, please enter the path your profiles are stored in"
 7   }
 8  } until ($pathready -eq $true)
 9 
10  $path | Get-ChildItem | ForEach-Object{
11   $filepath=$_.FullName
12   netsh wlan add profile filename=$filepath user=all
13  }
14 }

As with the export this function checks for the existence of the folder stated in the $path variable, if it does not exist then the user is prompted to enter the path to their network profiles, once a valid file path is provided the script collects all of the items found within (Get-ChildItem), it then copies the full file path and name into the $filepath variable, this is then used in the netsh command to do the actual import of the wireless profile.

The beauty of the Get-ChildItem | ForEach-Object code is that it doesn’t care whether you have 1 or 100 wireless profiles in the folder, it will work its way through each of them until it is done.

 

Create a Menu

 1 function menu{
 2  cls
 3  Write-Host "1 Export Wireless Profiles"
 4  Write-Host
 5  Write-Host "2 Import Wireless Profiles"
 6  Write-Host
 7  Write-Host "0 Exit"
 8  Write-Host
 9  $menuanswer=Read-Host "Please make Your selection"
10  if ($menuanswer -eq 1){export_wifi_profiles}
11  if ($menuanswer -eq 2){import_wifi_profiles}
12  if ($menuanswer -eq 0){exit}
13 }

The code above create a simple menu with options 1,2 and 0 to exit, the users entry is saved into the $menuanswer variable and evaluated against the options in lines 10,11, and 12, if the entry matches any of the options then that function is called, the {exit} command will terminate the script and completely exit PowerShell.

 

Call the Menu until exit command used (0 Key)

1 do {menu} until ($menuanswer -eq 0)

This code will simply repeat the Menu function until the user enters 0, this allows the user to export and re-import the wireless profiles for testing purposes if that is required. It is the only real line of code which is run when you launch the script, the functions are called as needed.

 

Putting it all together

 

Copy and paste the contents of the next box and edit the $path variable at line 2 to suit your own needs, as I have said this is a basic script and can be made much more elegant but for my needs it was suitable, good luck.

 1 #declare variables
 2 $path="D:\Wireless"
 3 $menuanswer=$null
 4 $pathready=$null
 5 
 6 #Declare functions
 7 function export_wifi_profiles{
 8  #check for folder path
 9  $pathready = Test-Path $path
10  if ($pathready -eq $false){
11   mkdir $path
12  }
13  cd $path
14  netsh wlan export profile folder=. key=clear
15 }
16 
17 function import_wifi_profiles{
18  #check default path, if not found prompt for location
19  do {
20   $pathready = Test-Path $path
21   if ($pathready -eq $false){
22    $path=Read-Host "Default import path not found, please enter the path your profiles are stored in"
23   }
24  } until ($pathready -eq $true)
25  $path | Get-ChildItem | ForEach-Object{
26   $filepath=$_.FullName
27   netsh wlan add profile filename=$filepath user=all
28  }
29 }
30 
31 function menu{
32  cls
33  Write-Host "1 Export Wireless Profiles"
34  Write-Host
35  Write-Host "2 Import Wireless Profiles"
36  Write-Host
37  Write-Host "0 Exit"
38  Write-Host
39  $menuanswer=Read-Host "Please make Your selection"
40  if ($menuanswer -eq 1){export_wifi_profiles}
41  if ($menuanswer -eq 2){import_wifi_profiles}
42  if ($menuanswer -eq 0){exit}
43 }
44 #End Functions
45 
46 #Begin main Program Block
47 do {menu} until ($menuanswer -eq 0) 
48 #End main program block

No Policies Applying, Temporary Login, Windows 7

No Policies Applying, Temporary Login, Windows 7 x64/x86

You have been logged in with a temporary profile..  even though the user in Active Directory (AD) is setup correctly and the NTFS/Share permissions are also.. setup correctly.

Whats going on? Hopefully this post will help.

Applies to: Windows 7 x86/x64, Windows 2008R2 Domain

Symptoms

• No Group Policies have applied to the profile
• No Mapped Drives/Printers
• No Preferences Applying
• Admin (like) control of the machine, no restrictions set
• An explanation mark (!) in a blue circle appears in the system tray
• A balloon appears/tries to appear notifying the user that they are logged in with a temporary profile
• The login is way too quick.
• If you log out and log back in sometimes the profile works fine, sometimes it logs back in again as a temporary profile. 
• The issue is intermittent with little/no pattern, sometimes does it, sometimes it does not. Not machine specific, not user specific.
• If you wait for a few seconds before logging in, the chances of the profile working correctly improves.
• Occurs more often on wireless devices than wired, but isn't limited to wireless.

Reasons

When Windows 7 was the new big thing, Microsoft had a page about all the cool new features of their brand new operating system.  There was one feature (which unfortunately I have forgotten the name of) but it boasted about priority, fast logins.  Essentially, it meant that if Windows 7 noticed there would be a delay in the logging in, it chose to prioritise just getting the user to the desktop rather than waiting to ensure the login was correctly done.

This is what you are encountering.  Some networks, particularily wireless ones take that little bit longer to establish a new IP address, down to poor signal strength or just generally the type of wireless card you have in your device.

So when a typical user, types in their username and password within seconds of the machine first booting, the chances are the computer hasn't yet got an IP address or stable connection with the server but still attempts to log them in regardless.  Windows 7, realising that there is a networking issue, rather than saying to the user, "Please wait a sec, I haven't fully established a trust with the server", it simply goes, "oh who needs a server, I know your credentials are correct, thats all I basically need, heres a desktop", perfect if you are a home user, really annoying if they are domain user.

Resolutions

Nice and Easy, theres a group policy for it.  Inside that needle in a haystack database there is a policy that ensures the computer (regardless of whether its wireless or not) will make sure the user will not be able to login until a stable connection is first established.

Located Here

Windows Server 2008R2
Computer Configuration -- Policies -- Administrative Templates -- System --  Logon

Windows Server 2003R2
Computer Configuration -- Administrative Templates -- System -- Logon

Policy Name

Always Wait For The Network At Computer Startup And Logon

Set to: Enable

How it works

This is a brilliant policy when applied as it ensures that when a computer is loading up and a user attempts to login the second they can type, it overrides the client operating system's decision to prioritise getting the user to the desktop. 

All policies will therefore come down to the client and apply to the user and computer, thus ensuring that their logins are correctly redirected and their resources (shared areas and Printers) are correctly applied in accordence to your ICT policy.



I hope this helps you all out, I understand that Windows 8 is out soon but for those looking to upgrade to Windows 7, this is a small bug i'm sure you will come across.

It is easy to ignore when testing as when it happens you log off and you log back in and it all seems fine, but bear in mind, you are a technician, you use computers in the way they should be used.  True testing comes from the end user and not the ICT department.

I'm happy to help out anyone with any more issues in relation to this, just leave a comment below.  Additionally, any other fancy features you may of found in the GPO Needle in a haystack database, which you feel will help optimise Windows 7's logging in speed and/or reliability, never hesitate to post a comment, we are all on the same team here, all help is much appreciated.

Speak to you all soon,

The ITMagician

Editing MDT 2012 Lite Touch Wizard Screens

At work we are still deploying Windows XP due to a need for our customers, we have automated the installation to a large extent however the biggest bugbear we have had is the need to select a task sequence and then to click next before giving the computer a name.

Here you can see where we are going from and to

Here is the original Task Sequence selection screen

Followed by the Name your computer screen

Followed by our modified screen which combines both Task Sequence and computer name into one pane.


We are aware that by prestaging machines we could avoid this issue however for our needs this would be overkill and an additional time overhead, what we wanted was the ability to unbox and name machines then walk away.

While poking around I found that the wizard you navigate around when using the Lite Touch Deployment is controlled using a collection of xml and vbs scripts, these are stored in the deploymentshare\scripts folder.

With a bit of copying and pasting between files I have been able to put the boxes for computer name and task sequence selection into a single pane, as we have used the deploymentshare rules settings to skip the other pages it means that we can pxe boot then simply enter a name and pick TS all in one page then walk away.
Apologies for this but this one is going to be a bit wordy

The files you will be modifying are

Deploywiz_Definition_ENU.xml
Deploywiz_SelectTS.xml
Deploywiz_ComputerName.xml

The files are named fairly well by Microsoft, the Definition file is the master file which guides you through the wizard, it calls the required files in turn. We will be making minor changes to this file but as always we should make a backup before we touch anything, just in case. The SelectTS file is the one which lists the task sequences available and allows us to choose one, the ComputerName file is self explanatory, however it also contains possibilities for you to enter domain join values, in our usage scenario we do not use these as the values are provided in the rules for the deploymentshare.

Open the ComputerName file and copy everything between the <body></body> tags, switch to the SelectTS file and paste all of this in just below the <body> tag and before the existing code, return to the ComputerName file and copy the <Initialization> and <Validation> section, again return to the SelectTS file and paste this in along with the existing values. Move to the top of the file and add the following as one line

<CustomScript>DeployWiz_ComputerName.vbs</CustomScript>

into the <global> section.

Change the <Pane id> values to something more appropriate such as

<Pane id="Name_Computer_and_SelectTaskSequence" title="Enter Name and pick a Task Sequence">

Save this file with your initials at the beginning and a more appropriate name, mine is called MHDeployWiz_Name_Computer_SelectTS.xml this will allow the deploymentshare files to be replaced in the future if an upgrade requires it but your files should remain in place.

You have now done the hard work.

Open the Definition file and edit the section 

<Pane id="SelectTaskSequence" reference="DeployWiz_SelectTS.xml">  <Condition><![CDATA[UCASE(Property("SkipTaskSequence"))<>"YES" ]]></Condition> </Pane>

to contain our newly made xml file so it should read 

<Pane id="SelectTaskSequence" reference="MHDeployWiz_Name_Computer_SelectTS.xml">  <Condition><![CDATA[UCASE(Property("SkipTaskSequence"))<>"YES" ]]></Condition> </Pane>

You can then remove completely the following section

<Pane id="ComputerName" reference="DeployWiz_ComputerName.xml">  <Condition><![CDATA[UCase(Property("SkipDomainMembership"))<>"YES" or UCase(Property("SkipComputerName"))<>"YES"]]></Condition>  <Condition><![CDATA[Property("DeploymentType")<>"REPLACE" and Property("DeploymentType")<>"CUSTOM" and Property("DeploymentType") <> "StateRestore" ]]></Condition> </Pane>

If you do not remove this then you will have another screen (which we are trying to remove) asking for the computer name, however its value will have been taken from the previous screen.

Save your file and test your deployment.

I have attached my modified files at the end of this post so you can see some which I have working in my test environment, feel free to play with them for your own use.I have used these modified files to deploy XP, "7 and W8 Consumer Preview,  I am sure that much more can be done with the xml files in MDT so there may be more posts to follow, but for now that’s it.

Good Luck

Reference Script Files

Network Font Installation

Do you constantly get requested by users to install fonts? Or would you like to give users the ability to install their own fonts?

Save the code below as a vbs file, and add it the the computer startup. All you or your users have to do then is put any fonts you/they want installing, into the shared server folder (\\server\share\fonts in the example).

It's built as a subroutine, so you can easily add it to an existing script or run it on its own.

If you ever want to add a new font, just copy it to the server; next time the machines reboot they'll install it. I've made the shared folder available to end users so they can add their own, obviously they need to be aware not to copy hundreds at a time, otherwise other users are not going to be too please next time they start their PCs.

Code:

Sub InstallFonts

   on error resume next

   Const FONTS = &H14

   dim oFSO,oShell,oFolder1,oFolder2,sRoot

   sRoot=\\server\share\fonts\

   set oShell = CreateObject("Shell.Application")

   set oFSO=createobject("scripting.filesystemobject")

   set oFolder1 = oShell.Namespace(FONTS)

   set oFolder2=ofso.getfolder(sRoot)  

   for each oFile in oFolder2.files

   sName=lcase(oFile.name)

      if right(sName,4)=".ttf" then

         if not ofso.fileexists(oFolder1.self.path & "\" & sName) then

            oFolder1.copyhere sRoot & sName

         end if    

      end if  

next  

on error goto 0

End Sub

InstallFonts

Original Source: http://www.edugeek.net/forums/scripts/4756-script-install-fonts-workstations.html#post370283 Thanks to Steve Rochford for this code.

Hide User Account on Welcome Screen in Windows

Windows operating system including Windows 7, Windows Vista and Windows XP allows multiple user accounts to be created on the computer, be it administrators or standard users. When there is more than one user accounts been defined and created on the PC, Windows will display Welcome Screen, with all available user accounts listed so that user can click and login.

However, showing and displaying of user accounts on the Welcome Screen is probably a weakness in the security point of view, more so if the user account is intended to be a hidden or backup user account. In fact, there is trick to make any user account or administrator account that normally been listed on the Welcome Screen to be hidden from view.
In order to hide a user account (which also means create a hidden user account) in Windows XP, Vista, or Windows 7, just go to Control Panel User module and create an additional user as usually do. If you already have an existing user that wants to be made hidden, invisible or disappeared from Welcome Screen, then go straight to guide below.

1. Run Registry Editor (RegEdit.exe).
2. Navigate to the following registry key:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
   Note: If SpecialAccounts and UserList is not found, create new sub-key and name them accordingly.
   
3. Select UserList, and in the right pane, right click on any blank space, and point to New -> DWORD (32-bit) Value.
4. Name the new DWORD registry value name as the exact same name that match the name of the user account to be hidden.For example, if the user ID of the user account is ITNut, the name the registry value as ITNut.
5. Double click on DWORD registry value, and set the value data to 0 in oder to hide the account from Welcome Screen.
   Tip: To display the user account on Welcome Screen again so that it’s visible again, delete the registry entry, or set the value data to 1.
6. Exit Registry Editor.
7. Log off or restart computer to make the change effective.

Tip: In order to login into Windows using an user account that has made hidden and invisible, just press Ctrl+Alt+Del to bring up Windows Logon dialog, and then type in the user name and password manually.

Sending out Wireless Settings via GPO with Key

Microsoft are an interesting bunch. When it comes to wireless settings deployment they tend to forget that wireless networks have a passphrase required in order to connect. They provide you with tools to setup wireless profiles on machines yet don't allow you to deploy the wireless key via group policy.
You can sort of understand it from a security point of view, it is probably against some form of policy to dish out wireless keys to your users but it does mean its us poor buggers that need to manually type the key into each machine before allocating them out to members of staff or putting them in trollies for the pupils. (That is if you don't use imaging, such as Ghost/MDT/Ping)
Now after a hell of a lot of Group Policy searches via Google, there doesn't seem to be anyone who has bothered to write out a step by step guide on how to send out a wireless setting with the key pre-installed. So here I go, finally solving this damn issue that has tormented god knows how many people. The beauty of this method, is that it is Microsoft Approved, as you don't need any third party tools to do this. :)
Here we go.

1. First you need a machine, ideally freshly built, no crap on it. Windows 7 of course.

2. You need to set this machine up connected to the desired wireless connection you want, in this example we are going to say the SSID of the school is: ITMagic_WPA.

So join your network and type in the wireless key, in this example we shall say the wireless key is: NoWires12345

3. Once connected to the wireless, if you want to play around with certain settings like Infrastructure only etc, do it now. This method being taught will also allow for these customisations to be exported to :)

4. So now we have a fresh Windows 7 machine, connected to our wireless network ITMagic_WPA with the network key NoWires12345 correctly implemented.

5. Now we export it using Microsofts own NetSh Command line.

(You might be turning away now, thinking i've tried this route and didn't succeed, but if you are like me, you probably didn't have time to play with it enough to understand it. Well I found time and with a little scripting experience behind me, I figured it out. I still haven't found a website that tells you this part.)

Go to Start, type Cmd and open that black window of power. - (just open command line)

6. Type in
Netsh Wlan Show Profiles
You will be presented with a list of all the "Wireless Profiles" stored on your machine, if you have only connected to one network, you will have a massive list of.. one.

Nine times out of ten, this profile name is identical to your wireless SSID. So lets say I did it with my example profile, the command line would come back with the result:

User Profiles
===========

all user profiles : ITMagic_WPA

Well now I know the name of my profile, I can export it. Of course I don't just export the name, I export everything, the name, the key and any extra settings I might of set.

7. To export type in:
Netsh Wlan Export Profile Name="ITMagic_WPA" key=clear

Remember to obviously replace my example with your profile name.

8. By default, this command will save this file to the ".\WirelessConnectionName" , basically, this location is found in C:\Users\YourLoggedInUser\ folder.

9. You will find an xml file named something like Wireless Network Connection - SSID.xml, so mine would be Wireless Network Connection-ITMagic_WPA.xml. Or something like that, depends if your machine is untouched and fresh.

Save the xml file to a shared area where people have access to, lets say the netlogon folder just to keep things simple, I mean if you have a designated Scripts Share on your server, by all means stick it in there, but remember to change the below script to suit your network.

14. Right, so i've saved my XML file as a shorter name called "WirelessConnect.xml" and saved it to the
\\dc-01\netlogon folder

15. In the netlogon folder, create a txt document and type in the following script:

IF EXIST C:\WirelessSet.txt GOTO _ENDNetsh wlan add profile filename="\\dc-01\netlogon\WirelessConnect.xml" user=all >>C:\WirelessSet.txt:_END

Just make sure your UNC path, points at the xml file in your share.

16. Save this file as Win7Wireless.bat or something like that

17. Go to group policy, and set this wireless script to run at start up for all the wireless 7 machines on your network, once run, it won't rerun providing there is a file called WirelessSet.txt on the C:\ on that computer.

Your wireless is now deployed, with a key.

Hope this helps a few people!!

Deploying Drivers

Have you ever just finished building a load of PCs, to have someone come up and ask for some dodgy piece of hardware to be installed on all PCs, and the drivers required are unsigned, and aren't pre-packaged in an easily deployable silent package or MSI. Or you've been given some dodgy new hardware (you know the companies I'm talking of), to install.

Well its easier than you think to deploy drivers as either a script or as part of an MSI package. I am assuming that you, the reader, are capable of writing a script and/or creating a suitable MSI, so I will not insult your intelligence by giving you a completed script/msi. If you're anything like me (God help you if you are!) you'll learn better by doing, rather than seeing.

Anyway, by using a small executable provide by Microsoft, DPInst.exe, available as part of the Windows Driver Kit (WDK), Download available here, we can indeed make drivers available on any windows OS system, to be installed as and when needed.

Once you have download and installed the WDK (btw you only need to install the tools part), you can find different architectural/language versions of the DPInst.exe in C:\WinDDK\7600.16385.1\redist\DIFx\dpinst (assuming you install to the default location, and the version number hasn’t changed since writing).

Place the correct version of DPInst.exe in with your driver .inf files. If you were to run the dpinst.exe now, you would be presented with a wizard for installing the drivers onto the system. If you were to step through the wizard, it will complete, but it will only be successfully if the drivers are signed.

However, that’s not what we really want, we need no user interaction at all, and we need to be able to install unsigned driver*. To install any drivers without the end user noticing, call the DPInst.exe with the following commands:

/Q  - This is for quiet install with no user interaction,
/LM – This is for unsigned drivers.

Now the drivers are installed, or technically they are made available to be installed when the hardware is connected. Now if your drivers are signed that is the end of the story, however, if like me, you have been given a host of cheap hardware made in china, with unsigned drivers, you will need to adjust the following 2 Group Policies*:

Computer Configuration>Windows Settings>security Settings>Local Policies>User Rights Assignment:
Policy: “Load and unload device drivers”
Setting: DomainName\Domain Users

User Configuration>Admin Templates>System>Driver Installation:
Policy: “Code signing for device drivers”
Setting: Enabled – ignore

Click here for a full overview of DPInst, and here for a full list of command switches.

* Please note that installing unsigned drivers and/or modifying Group Policy is done at the readers own risk, and the writers of “Thoughts of a Primary School Tech” are in no way responsible/liable for any loss/damage caused to any system(s) by following the instructions provided here. Whilst every effort has been made to ensure this works correctly on any windows system, your milage may vary.

Group Policy Setting - Verbose vs normal status messages

During a major roll out of software using Group Policy on a Windows 7 Client System, I had cause to want to know what was happening during the roll out, to see if any software was sticking. To enable more detailed messages on screen (other than "Please Wait") enable the following in an appropriate GPO:

Computer > Policies > Administrative Templates > System > Verbose vs normal status message

This setting displays a number of extra status messages during the start up and shutdown of the computer and when the user is logging on and off. Some of the verbose status messages you will see are (but not limited to):

Software Deployment
Mapping Drives
Playing Logon Sound
Mapping Printers
Applying Power Settings
Stopping Services

You will still see your Applying Computer settings and Preparing Desktop messages however these will be shown for a lot shorter time.

Also by enabling this option end users think that their PC is faster, due the reduced time each message is displayed. It certainly seems to speed it up for me anyway. This is still a handy setting to enable as at the very least will help your IT support troubleshoot log on performance issues.

This setting will work on Windows 2000 and above and it will also show the processing of newer Group Policy Preferences.

Original Source:
http://www.grouppolicy.biz/2009/11/group-policy-setting-of-the-week-2-verbose-vs-normal-status-messages/

Removing Items from Navigation Pane.

The other week I happened to be testing the pupil lockdown of Windows 7, and realised that users could access things in the navigation bar that I didn't want them to access. Things like computers on the network, favourites (not IE favourites), Homegroup (which is empty, so is pointless being there) and Libraries.

No problem I thought, it must be a Group Policy I've overlooked...Nope. It seems that microsoft don't want Network administrators to be able to remove these from the end users. Not easily anyway. So I turn to my tried and trusted friend, Bing (You were expecting Google, right?), and found the answers. I provide a quick explaination here, mainly for my own benefit, and the original source is linked at the bottom, there you will also find a way of removing computer from the Navigation Pane, and the pane itself if you wish to go down that route.

To modify items in the navigation pane, you must first give administrator full control to the following registry keys:

For x32 and x64 Systems.
Favourites: HKEY_CLASSES_ROOT\CLSID\{323CA680-C24D-4099-B94D-446DD2D7249E}\ShellFolder
Libraries: HKEY_CLASSES_ROOT\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\ShellFolder
Homegroup: HKEY_CLASSES_ROOT\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\ShellFolder
Network: HKEY_CLASSES_ROOT\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\ShellFolder

Additional for x64 Systems Only.
Favourites: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{323CA680-C24D-4099-B94D-446DD2D7249E}\ShellFolder
Libraries: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\ShellFolder
Homegroup: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\ShellFolder
Network: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\ShellFolder

Theoretically administrator accounts should already have full control to these keys, but I found that without doing the above, the items were not modified. It may also turn out that you do not need to add the first set of registry keys for a x64 system, but I have not tested that yet, if I ever get around to it I will update this post accordingly.

Now for adding/removing the items. Please modify the Attribute Values below the above keys as required below:

Favourites On: a0900100 (Default Setting)
Favourites Off: a9400100
Libraries On: b080010d (Default Setting)
Libraries Off: b090010d
Homegroup On: b084010c (Default Setting)
Homegroup Off: b94010c
Network On: b0040064 (Default Setting)
Network Off: b0940064

I made the necessary modifications using a combination of Group Policy (for the registry permissions) and Preferences (for modifying the value), but feel free to make the changes how you feel most comfortable.

The original information found at:
http://www.sevenforums.com/tutorials/38933-favorites-add-remove-navigation-pane.html
http://www.sevenforums.com/tutorials/35627-libraries-folder-add-remove-navigation-pane.html
http://www.sevenforums.com/tutorials/39670-homegroup-add-remove-navigation-pane.html
http://www.sevenforums.com/tutorials/39699-network-add-remove-navigation-pane.html

Windows 7 Godmode

I thought I'd better introduce myself, I'm The IT Nut, a colleague of the Primary School Tech, and I will be dropping a few posts on here from time to time.

I'll be specialising in Powershell Tips and creating MSI packages for group policy rollout, along with links to a few projects of my own.

To start with though, I thought I begin with GodMode! I found out about this feature and thought it was rather neat.

GodMode is a hidden feature in Windows 7 as well as windows vista. By enabling this feature allows you to access all windows settings in a single place. It is a single folder that collects all of the control panel functions,interface customization,accessibility options etc..

Steps:
•Create a new folder
•Name the folder: GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}
•Then open it to show the GodMode window.

GodMode enabled.