Open File Security Warning - Complete Resolution

This is one of the most popular topics on the web, its absolutely crazy how many people have been involved in discussions about it.

Welcome to our version on Thoughts of Primary School Tech, ironically with me, a college tech (and manager I might add), my my we have moved one since we first starting blogging on here.

Lets sort the questions out once and for all and get some pictures involved.  None of this, "just add it to gpo" generic responses, or "that is trusted zone, just add it there", nothing more annoying when someone posts up a solution in their own language and you have no clue how to solve the problem.

The Policies

First lets bring up a picture, we all understand pictures.

For those with visual difficulty, this picture shows a side by side comparison of the Server 2012 group policy which affects the 4 security zones found on the security tab in Explorer.

In Group Policy this is found in the following location:

Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Site to Zone Assignment List.

On the Client machine the security page is found by going to:

In go to Tools (Alt+X), then go to Internet Settings.  Choose the Security Tab.

Now even though we are playing within Internet explorer settings, you should know windows well enough to know that a window that shows your files is using the Explorer.exe process. Just because these settings live in internet explorer, doesn't mean they do not affect the settings within the rest of the operating system.  This is a big reason to why removing internet explorer is almost impossible without breaking something else, it is part of the operating system and the settings affect the system as well.

Drive Mappings

Right a mapped drive defined by either a script or preferences is just putting a friendly look on what would would be an UNC path which non technical folk, bless them, would never understand.

The mapped R:\ drive for example, would actually be the location \\Servername\sharename\resources but we cannot expect our users to know this, so we just say it's the R:\ drive.  Simple.

Now you can map this location in five potential (realistic) ways.

• You map it based on the NETBIOS name of the server, so lets say our server is called File-SVR-01, so the map would look like \\File-SVR-01\Sharename\resources.
• You can map it based on the server's IP address so: \\192.168.10.4\Sharename\resources
• You can map it based on an alias of your server so: \\Files\Sharename\resources
• You can map it based off a DFS namespace so: \\domain.local\NS\Sharename\resources
• You can map it based off the full FQDN of the file server so: \\File-SVR-01.domain.local\Sharename\resources

There are probably plenty of others, especially we get SANS involved, but I feel for the majority of us, these five should be the most common ways.

Now I know that stuff like using NETBIOS or the FQDN are essentially the same, and yes in all intensive purposes you would be correct, but for this file security warning we suffer on a daily basis it can matter in which method you used.  Consistency is important when mapping drives, if you use the FQDN, then you must use it for every share, do not cut corners here or you can get some unexpected results. 

Fix the problem

Lets fix the problem on one machine first, prove the fix and just get rid of that open file security warning once and for all. I do not want you to start deploying out policies you might not have full understanding of because whats the point if you do not learn anything from it.  

Get on a machine, login, ideally you need to be on an account that has permission to alter the internet explorer security settings, so domain administrator on a machine in a different OU unrestricted by policies. You need to have mapped drives however to test.

Find a .exe file in the mapped drive and attempt to use it.  It should not run immediately and you get the famous:

Open Security File Warning

Notice that even as an administrator, this still appears.

Notice at the bottom the warning you receive, this is important. 

"While files from the internet can be useful, this file type can potentially harm your computer.  Only run software from publishers you trust"

This is the error we would like to see, as this entire topic is based on this particular one.  The following two errors are different problems:

User Account Control Error

  

Fix found here: Turn off UAC via GPO

Digital Signature Error

Fix found here: Fix Digital Signature Security Warning

Now that you understand the differences between the three errors above, lets assume you have got the first error screen the one specifying it is a file from the internet and poses a security risk.

Now you know that the file is not from the internet and is from your local network, you know this because you know your mapped drive is a server location. So now you need to add your server to your intranet zone, not trusted zone, not restricted, not internet zone, your intranet zone. 

This is important as there are a lot of people out there that are all like, stick it in your trusted zones, this can actually cause you more headache sometimes. The reason being is because in all server versions with the exception of 2008R2 and above, the trusted zone would of actually worked.  

Weird right?  I never tested this theory but apparently after endless searches and realization of the pattern, everyone who has this problem on 2008 or lower, resolved it, yet those that have 2008R2 or higher, said it doesn't, so I have to make that connection there.  Might not be true, but I never said I was honest. 

The reason being is that trusted sites does not turn off prompts, intranet does. 

Before we even touch server side, lets make it work on one machine, then we know what to type in on the server, as the server does not have any validation of the information you type into it, meaning you might attempt to force incorrect keys onto your clients, which is not good and causes errors, these errors will be explained at the end of this post.

Go to: In IE ->  Tools (Alt+X) -> Internet Settings ->  Security Tab -> Local Intranet -> Sites -> Advanced

Type in *.domain.local  (filling in domain.local with the full name of your domain).

If you do not type it in correctly, you will be presented with this error:

This error explains the syntax that can be put in this setting.  If you do not meet the syntax requirements, it tells you about it. However, if you type the incorrect syntax on the sever, it will still accept it. This is why we do it on the client first, once we do it right here, we know exactly what to type on the server.

After you have typed in your wildcard domain, press ok and exit out of Internet explorer. 

Now try to open your .exe you tried before and hopefully the security file type will vanish.  You have successfully found the fix for the problem and can move to the Server Side Policies.  

Continue Only if the security file prompt still appears, if it has vanished, go to the server side settings.

If it is still not working, then continue.

Now go back to the same advanced menu and remove the *.domain.local setting, since we know it does not work with just this, there is no point in it now.  

Now the reason this wouldn't work is most likely because of the way you are mapping your drives, if your drives are not being mapped with a Netbios or FQDN name, then this would the reason for it.  If you map using IP Addresses, then this is a common reason for the failure.

So this time in the advanced menu you must put the IP Addresses of your file server(s) and if you want the entire scope to treat the entire domain as intranet. 

Remember the syntax and no /24 /23 subnets do not qualify.  

The trick now is trial and error and requires you to make some decisions.  I do not know your network and frankly would confused you if I started recommending some things.  Try different combinations.  The benefit however is that you know when you type something in, it is valid if it accepts it and is invalid if it doesn't, take advantage of this validation as the server does not give you this luxury.  

Eventually you will find that it accepts something and as you test the .exe from the mapped location, bang, the .exe starts to run without the warning, at this point cheer!  Remember the setting, the exact setting remember the syntax like it was your own name. Lets move to the server now.

IMPORTANT - Remember this setting, it is your fix and you need to type it in on the server. 

Server Side

• Go to your primary domain controller
• Open up group policy management.
• Go to: Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page

• In here I have manually enabled the following policies:
• Intranet Sites: Include all local (intranet) sites not listed in other zones
• Intranet Sites: Include all sites that bypass the proxy server
• Intranet Sites: Include all network paths (UNCs)
• I have disabled
• Turn on automatic detection of intranet

These polices affect the settings in the Local Intranet window found by going to:

In IE ->  Tools (Alt+X) -> Internet Settings ->  Security Tab -> Local Intranet -> Sites

Applying the policies above will grey out and prevent change in this area. 

Now Site to Zone Assignment policy (below) will affect everything within the Advanced menu from here, as you can see the "advanced" button above.

Site to Zone Assignment

This is the advanced menu where the settings will appear.

The setting will not appear if you do not specify the value of "1" to the value name (see next image)

Within this policy you can specify the security zones for your intranet.

Values are:

1. Intranet Zone
2. Trusted Site Zone
3. Internet Zone
4. Restricted Zone

To prevent file security windows appearing when opening up a certain file type from a mapped drive, you must know how your mapped drive is mapped first.  The setting you discovered by following this document will be the setting you need to deploy out.

So type in your setting e.g. *.domain.local in the Value name field and type in 1 in the value field.

Now remember that Validation error:

This will not happen if you make a mistake here, the server will accept it regardless of if it is right or not. This is bad and should not be done.

Gpupdate and RESTART your client machines once you have put in the setting and applied it in group policy.

Open up a client affected by the policy, go to the advanced menu in Internet explorer intranet settings and see if your policy has applied.

Try and open a .exe as a restricted user and by magic, your file security warnings now vanish as if they were never a problem.  Such a pain in the backside, but all this work is worth it, especially if you use software that when updated server side runs .exes when loading up client side.


Known Errors

If you find other errors that relate to this, please tell us in comments, the longer the list the easier it is for those struggling to find this blog.

Error 1
Windows failed to apply the Internet Explorer Zonemapping settings.  Internet Explorer Zonemapping settings might have its own log file. Please click on the "More information" link.

Cause
You've typed something in wrong in the Site-to-Zone Assignment policy that does not meet the requirements of the syntax.

Resolution
Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Site to Zone Assignment

Stick to the recommended syntax sequence, below is an image showing examples of the correct sequences supported by Windows.

Editing MDT 2012 Lite Touch Wizard Screens

At work we are still deploying Windows XP due to a need for our customers, we have automated the installation to a large extent however the biggest bugbear we have had is the need to select a task sequence and then to click next before giving the computer a name.

Here you can see where we are going from and to

Here is the original Task Sequence selection screen

Followed by the Name your computer screen

Followed by our modified screen which combines both Task Sequence and computer name into one pane.


We are aware that by prestaging machines we could avoid this issue however for our needs this would be overkill and an additional time overhead, what we wanted was the ability to unbox and name machines then walk away.

While poking around I found that the wizard you navigate around when using the Lite Touch Deployment is controlled using a collection of xml and vbs scripts, these are stored in the deploymentshare\scripts folder.

With a bit of copying and pasting between files I have been able to put the boxes for computer name and task sequence selection into a single pane, as we have used the deploymentshare rules settings to skip the other pages it means that we can pxe boot then simply enter a name and pick TS all in one page then walk away.
Apologies for this but this one is going to be a bit wordy

The files you will be modifying are

Deploywiz_Definition_ENU.xml
Deploywiz_SelectTS.xml
Deploywiz_ComputerName.xml

The files are named fairly well by Microsoft, the Definition file is the master file which guides you through the wizard, it calls the required files in turn. We will be making minor changes to this file but as always we should make a backup before we touch anything, just in case. The SelectTS file is the one which lists the task sequences available and allows us to choose one, the ComputerName file is self explanatory, however it also contains possibilities for you to enter domain join values, in our usage scenario we do not use these as the values are provided in the rules for the deploymentshare.

Open the ComputerName file and copy everything between the <body></body> tags, switch to the SelectTS file and paste all of this in just below the <body> tag and before the existing code, return to the ComputerName file and copy the <Initialization> and <Validation> section, again return to the SelectTS file and paste this in along with the existing values. Move to the top of the file and add the following as one line

<CustomScript>DeployWiz_ComputerName.vbs</CustomScript>

into the <global> section.

Change the <Pane id> values to something more appropriate such as

<Pane id="Name_Computer_and_SelectTaskSequence" title="Enter Name and pick a Task Sequence">

Save this file with your initials at the beginning and a more appropriate name, mine is called MHDeployWiz_Name_Computer_SelectTS.xml this will allow the deploymentshare files to be replaced in the future if an upgrade requires it but your files should remain in place.

You have now done the hard work.

Open the Definition file and edit the section 

<Pane id="SelectTaskSequence" reference="DeployWiz_SelectTS.xml">  <Condition><![CDATA[UCASE(Property("SkipTaskSequence"))<>"YES" ]]></Condition> </Pane>

to contain our newly made xml file so it should read 

<Pane id="SelectTaskSequence" reference="MHDeployWiz_Name_Computer_SelectTS.xml">  <Condition><![CDATA[UCASE(Property("SkipTaskSequence"))<>"YES" ]]></Condition> </Pane>

You can then remove completely the following section

<Pane id="ComputerName" reference="DeployWiz_ComputerName.xml">  <Condition><![CDATA[UCase(Property("SkipDomainMembership"))<>"YES" or UCase(Property("SkipComputerName"))<>"YES"]]></Condition>  <Condition><![CDATA[Property("DeploymentType")<>"REPLACE" and Property("DeploymentType")<>"CUSTOM" and Property("DeploymentType") <> "StateRestore" ]]></Condition> </Pane>

If you do not remove this then you will have another screen (which we are trying to remove) asking for the computer name, however its value will have been taken from the previous screen.

Save your file and test your deployment.

I have attached my modified files at the end of this post so you can see some which I have working in my test environment, feel free to play with them for your own use.I have used these modified files to deploy XP, "7 and W8 Consumer Preview,  I am sure that much more can be done with the xml files in MDT so there may be more posts to follow, but for now that’s it.

Good Luck

Reference Script Files

Windows XP SP3 DFS Network shares not refreshing

If you run a network where you connect Windows XP to DFS shares, you may encounter the issue whereby a user can create a new file/folder but not see it until they refresh the folder, this can lead to a large number of 'New Folder' entries if the user believes that they have not actually created a new folder.

The issue can also occur when moving or deleting items.

Microsoft list a fix which consists of a registry entry, apparently this was introduced in Windows XP SP2 but you can still get the issue with SP3.

The fix is a registry entry in the following path

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

It is a DWORD entry and is called 'NoSimpleNetIDList'

the value needs to be set to 1




Reference:

Microsoft Support Information

Network Font Installation

Do you constantly get requested by users to install fonts? Or would you like to give users the ability to install their own fonts?

Save the code below as a vbs file, and add it the the computer startup. All you or your users have to do then is put any fonts you/they want installing, into the shared server folder (\\server\share\fonts in the example).

It's built as a subroutine, so you can easily add it to an existing script or run it on its own.

If you ever want to add a new font, just copy it to the server; next time the machines reboot they'll install it. I've made the shared folder available to end users so they can add their own, obviously they need to be aware not to copy hundreds at a time, otherwise other users are not going to be too please next time they start their PCs.

Code:

Sub InstallFonts

   on error resume next

   Const FONTS = &H14

   dim oFSO,oShell,oFolder1,oFolder2,sRoot

   sRoot=\\server\share\fonts\

   set oShell = CreateObject("Shell.Application")

   set oFSO=createobject("scripting.filesystemobject")

   set oFolder1 = oShell.Namespace(FONTS)

   set oFolder2=ofso.getfolder(sRoot)  

   for each oFile in oFolder2.files

   sName=lcase(oFile.name)

      if right(sName,4)=".ttf" then

         if not ofso.fileexists(oFolder1.self.path & "\" & sName) then

            oFolder1.copyhere sRoot & sName

         end if    

      end if  

next  

on error goto 0

End Sub

InstallFonts

Original Source: http://www.edugeek.net/forums/scripts/4756-script-install-fonts-workstations.html#post370283 Thanks to Steve Rochford for this code.

Hide User Account on Welcome Screen in Windows

Windows operating system including Windows 7, Windows Vista and Windows XP allows multiple user accounts to be created on the computer, be it administrators or standard users. When there is more than one user accounts been defined and created on the PC, Windows will display Welcome Screen, with all available user accounts listed so that user can click and login.

However, showing and displaying of user accounts on the Welcome Screen is probably a weakness in the security point of view, more so if the user account is intended to be a hidden or backup user account. In fact, there is trick to make any user account or administrator account that normally been listed on the Welcome Screen to be hidden from view.
In order to hide a user account (which also means create a hidden user account) in Windows XP, Vista, or Windows 7, just go to Control Panel User module and create an additional user as usually do. If you already have an existing user that wants to be made hidden, invisible or disappeared from Welcome Screen, then go straight to guide below.

1. Run Registry Editor (RegEdit.exe).
2. Navigate to the following registry key:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
   Note: If SpecialAccounts and UserList is not found, create new sub-key and name them accordingly.
   
3. Select UserList, and in the right pane, right click on any blank space, and point to New -> DWORD (32-bit) Value.
4. Name the new DWORD registry value name as the exact same name that match the name of the user account to be hidden.For example, if the user ID of the user account is ITNut, the name the registry value as ITNut.
5. Double click on DWORD registry value, and set the value data to 0 in oder to hide the account from Welcome Screen.
   Tip: To display the user account on Welcome Screen again so that it’s visible again, delete the registry entry, or set the value data to 1.
6. Exit Registry Editor.
7. Log off or restart computer to make the change effective.

Tip: In order to login into Windows using an user account that has made hidden and invisible, just press Ctrl+Alt+Del to bring up Windows Logon dialog, and then type in the user name and password manually.

Dell Optiplex 390 fails to apply GPO settings

At work we have been deploying Dell Optiplex 390’s with XP using an MDT task sequence, the build works perfectly however once the machine attempts to apply group policy we have failures, this causes the machine to fail to install allocated msi packages. Obviously not a great situation to be in.
Following some research I have found that the issue appears to occur mostly in situations where a client is using a Gig speed network card and where network connections are teamed. The issue appears to be caused by the network card switching between speeds and full/half duplex to find the mode it can operate at. By adding a registry key we can prevent this checking from happening which will provide a more stable connection during the all important startup process.
This solution has been tested to work in our environment, obviously your mileage may vary and if you choose to make this change you do so at your own risk, playing with the networking settings in Windows may break more than it fixes however in our testing this has been an easy and successful workaround.

The key details are as follows
Key Location : HKLM\System\CurrentControlSet\Services\Tcpip\Parameters
Key Name : DisableDHCPMediaSense
Key Type : Reg_Dword
Key Value : 00000001

These settings can either be added using a reg entry or a command line as follows

reg add HKLM\System\CurrentControlSet\Services\Tcpip\Parameters /v DisableDHCPMediaSense /t REG_Dword /d 00000001

In our case we have added a command line near the end of our task sequence which we have filtered using WMI in a way similar to the one we used in a previous post. In this case the WMI filter we used is as follows

Select * from Win32_ComputerSystemProduct WHERE Name LIKE "%Optiplex 390%"

Again we are running this against the root\cimv2 namespace. This query could be repeated in the task sequence options filtering for additional hardware which exhibits this particular issue, thereby allowing you to keep a smaller number of task sequences in your deployment share.

Update : 29-06-2012

We have begun rolling out Samsung N200 laptops, these also exhibit the issue with needing DHCPMediaSense to be set, for ease of use here is the WMI code needed

Select * from Win32_ComputerSystemProduct WHERE Name LIKE "300V3A/300V4A/300V5A/200A4B/200A5B"

Reference:

Technet User Discussion

Serverfault Question

Dell Laptop freefall sensor driver kills MDT Win XP

 

We have been building a large number of Dell Latitude E5410 and E5420 laptops using an MDT task sequence to install Win XP. The task sequence does not use a wim file for xp but is effectively the same as running a RIS style setup process.

We downloaded the driver pack which Dell make available for the E5420, in theory this contains all drivers needed in a single cab file, however we encountered an issue in that during setup the installation WMI either got corrupted or failed to install. Since MDT needs to use WMI in order to run this left us with a partly installed XP machine which fails to complete the task sequence. This issue did not present itself when we ran a test build with Windows 7.

As part of our troubleshooting we manually downloaded the drivers individually and added them to MDT, we missed the ST Microelectronics Freefall sensor as it was wrapped up in an installshield exe file but the task sequence completed succesfully. Helpfully Dell included a readme with the exe file which explained that we could run the setup.exe with the /s switch and this would allow a silent install with no reboot when done.

Using this information we imported the setup file into the MDT Deploymentshare as an application then added it near the end of the task sequence. In order to not need an extra task sequence just for the laptops we edited the options for the application installation step and added the filtering options to only apply if true and used a WMI query to test for the model type. The WMI query used is as follows

WMI Namespace : root\cimv2

WQL Query : Select * from Win32_ComputerSystemProduct WHERE Name LIKE "%Latitude E54%"

 

Query entry dialog box

Completed query entry in task sequence options.

 

Using these settings will allow the installation of Windows to complete leaving you with a fully working WMI installation and all of the drivers to give you a nice clean Device Manager.

Deploying Drivers

Have you ever just finished building a load of PCs, to have someone come up and ask for some dodgy piece of hardware to be installed on all PCs, and the drivers required are unsigned, and aren't pre-packaged in an easily deployable silent package or MSI. Or you've been given some dodgy new hardware (you know the companies I'm talking of), to install.

Well its easier than you think to deploy drivers as either a script or as part of an MSI package. I am assuming that you, the reader, are capable of writing a script and/or creating a suitable MSI, so I will not insult your intelligence by giving you a completed script/msi. If you're anything like me (God help you if you are!) you'll learn better by doing, rather than seeing.

Anyway, by using a small executable provide by Microsoft, DPInst.exe, available as part of the Windows Driver Kit (WDK), Download available here, we can indeed make drivers available on any windows OS system, to be installed as and when needed.

Once you have download and installed the WDK (btw you only need to install the tools part), you can find different architectural/language versions of the DPInst.exe in C:\WinDDK\7600.16385.1\redist\DIFx\dpinst (assuming you install to the default location, and the version number hasn’t changed since writing).

Place the correct version of DPInst.exe in with your driver .inf files. If you were to run the dpinst.exe now, you would be presented with a wizard for installing the drivers onto the system. If you were to step through the wizard, it will complete, but it will only be successfully if the drivers are signed.

However, that’s not what we really want, we need no user interaction at all, and we need to be able to install unsigned driver*. To install any drivers without the end user noticing, call the DPInst.exe with the following commands:

/Q  - This is for quiet install with no user interaction,
/LM – This is for unsigned drivers.

Now the drivers are installed, or technically they are made available to be installed when the hardware is connected. Now if your drivers are signed that is the end of the story, however, if like me, you have been given a host of cheap hardware made in china, with unsigned drivers, you will need to adjust the following 2 Group Policies*:

Computer Configuration>Windows Settings>security Settings>Local Policies>User Rights Assignment:
Policy: “Load and unload device drivers”
Setting: DomainName\Domain Users

User Configuration>Admin Templates>System>Driver Installation:
Policy: “Code signing for device drivers”
Setting: Enabled – ignore

Click here for a full overview of DPInst, and here for a full list of command switches.

* Please note that installing unsigned drivers and/or modifying Group Policy is done at the readers own risk, and the writers of “Thoughts of a Primary School Tech” are in no way responsible/liable for any loss/damage caused to any system(s) by following the instructions provided here. Whilst every effort has been made to ensure this works correctly on any windows system, your milage may vary.

Using GParted to repair NTFS partition size

While using P.I.N.G. to make a backup of a machine I chose to shrink the partition before taking an image, this was necessary as I did not have either the space or time to wait for a 320Gb image to be created over a network connection.

P.I.N.G. uses the linux utility ntfsresize to work out how small the partition can be, resizes the partition then takes an image of it. Unfortunately in this instance when finished it did not resize the partition back to full size (I am unsure if it should by default)

This left me with the situation that Windows XP thought it had a 320Gb hard drive with an 11Gb partition, being unable to save any further data to the disk meant that windows was an unhappy bunny.


In theory I could use ntfsresize from the command line to expand the partition to fill the hard drive again, however when I tried this I was getting various error messages about not being able to access the drive.

Step in GParted and the ever useful Ubuntu bootable USB Stick, simply boot into the Ubuntu system, right click the disk you need to work on and select "Resize/Move" simply reduce the size by 1 meg and click apply, then click the green tick to apply the settings, close out of GParted and rebooth the machine back into windows, you should find that the partition is correctly showing as the full size minus 1 meg.