Group Policy Redirection - Stops Working - [Fix]

Scenarios

You had a user which worked fine before now redirection has stopped working.
You are convinced it is not permissions as it has worked before.

You deleted a local version of the profile due to corruption and redirection no longer works
You deleted the network version of the profile due to corruption and redirection no longer works.
You deleted the profile from the machine incorrectly, causing a corruption and temporary profile issues.
You have wiped the profile from the local machine completely, yet still folder redirection does not work.

You have deleted all temporary files.
You have deleted the temporary files from the disk usage are under manage offline files.

There are errors stating that redirection failed, error codes include:

Event ID 502: Failed to Redirect because directory is offline.
Event ID 1085: Windows failed to apply folder redirection settings. 


Stuff that can happen

The user logs in but with a temporary profile.
The user logs in successfully and all other preferences applied, but on the server none of the redirected folders have been created in your specified location. Instead they still remain in the profile, which for all intensive purposes seems to of built fine. 
The user logs in, the profile is made but the Music, Video and Pictures folders have not made themselves.
The Pictures, Video and Music folders have made themselves but the other profile redirections have not.
Only some redirected folders are made.
New redirected folders I have applied make themselves fine.
I know deep down on any other machine this will work fine, with the exception of this batch/few/one.


The Fix

This comes from a selection of sources, but if you have found this post then you don't need to spend the hour or two bouncing back from the same old fixes that do not seem to work.

Now bare with me, you'll be like, "i've done this", yeh, I know you have, but it can be a combination of incorrect settings on the client, so if we do all these fixes, in the correct order, it won't matter what scenario you have, it will hopefully fix it all.

The only thing I ask, is that if you never had redirection working to begin with, then this is not a fix or guide on how to set them up, I would expect you to know at least the basics of folder redirection.  This is a fix when you know that it is setup and it will work correctly and you are certain it is a client side issue.  

1. Login the machine with an administrative user.
2. Go to start menu, right click Computer and choose Properties.
3. Choose Advanced System Settings
4. Choose Settings under User Profile
5. Find your problem profile, highlight it and delete.
6. Don't worry about errors or crap you get here. 

7. Apply all, get out of this menu and go to start run and choose Regedit
8. Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
9. Find the key that is related to your problem profile, look in the keys on the right to find it. 
10. Take a note of the end number of the key and delete the key.
11. Now go to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileGuid
12. Delete the key that references your SID which you just deleted.  (hence why I asked you to note the last few numbers), go through each key and find that SID, delete that entire key.

13. Go to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Csc\Parameters
14. If parameters does not exist, create it.
15. Now in the Parameters node create a new registry value with the name FormatDatabase of typeREG_DWORD (i.e DWord 32-bit value)
16. Set the data in this new registry value to 1.  (THANKS TO http://offlinefiles.blogspot.co.uk) for this)
17. Close the regedit editor

18. On your server, delete the roaming profile if there is one. 
19. On the server, go to run and type gpupdate /force, (why not. eh, we got this far). 
19. On your client, go to run and type Gpupdate /force
20. Clear the C:\Windows\Temp Folder
21. Restart your client machine
22. Wait for a connection, ideally use a network cable and for god sake if you just plugged it in, turn the wireless off for 5 seconds then turn it back on to ensure it does use the wire.  Don't be a rookie.
23. Login as the troublesome user.


23. Say Thank you if it works, I appreciate it!


Now if this actually has not worked, then there must be a setting somewhere on your server.  You have essentially made that client machine complete forget about a certain user.  It was as if it was freshly imaged, a true first login.


Good luck!

"Documents.library-ms" is no longer working.

You may get a user complaining that when they open Windows Explorer they get a message  stating "Documents.library-ms" is no longer working. This library can be safely deleted from your computer.

This appears to be a corruption to one of the default library folders used to collate folder locations together in Windows 7 and 8. Happily it is easily fixed.

Open Windows Explorer, Right click on the Library in question, right click on Libraries and select restore default libraries.

You should find that the library has been repaired and you are up and running again.

How to reset the Open Directory administrator password in 10.9

Sometimes there are times when you will require access to Open Directory on your Apple 10.9 Server and because it has been so long since you last used it or because the original administrator decides to disappear without sharing the password, you will not know the password and will be stuck. However, if you follow these steps then you can reset the password to whatever you wish.

Go to the spotlight (magnifying glass in top right) and type Terminal and press Enter.

Within the terminal box type:

'ldapsearch -LLL -x -H ldap://127.0.0.1 -s base namingContexts'

Hit enter.

The output should look similar to above, look out for the dc= entries and make a note of it.

Next within the terminal box type:

'sudo ldappasswd -x -H ldapi://%2Fvar%2Frun%2Fldapi -S uid=diradmin,cn=users,dc=macmini,dc=private'

Replace the dc= entries with the entires that are applicable to your setup. Also if the administrators UID isn't diradmin, then change that to what is applicable to your setup.

Hit enter.

At the new password prompt, enter a new password and repeat when prompted again.

You then should be able to authenticate within Workgroup Manager.

Creating a Catalog from a custom x86 WIM file

If you create a custom WIM file with software pre-installed, Windows updates applied or any other modification you want to roll out to make your life easier you will find that the WIM file does not come with a .clg file. This is not normally a problem however if you are using MDT to deploy this image you may need to edit the unattended.xml file, this is done from the OS Info tab within the task sequence editor which will launch the Windows SIM tool, this will allow you to make your changes and save the file.

If you have no .clg file WSIM will attempt to create one for you, brilliant you think, until you get a nice red error line telling you that you cannot create an x86 catalog file on an x64 system. All server operating systems are now coming in x64 now so how do you get around it?

Well the answer is simple if annoying. You install an x86 operating system, install the relevant parts of the ADK and generate your catalog, then you place this file in the Deploymentshare folder with the WIM you are working with and away you go.

Pre-requisites

1. x86 Installation of Windows
2. Windows ADK
3. Custom WIM file


Launch the adksetup.exe file

Install to the default location, click Next

Decline joining the CEIP, click Next

Accept the license agreement

You will only need to select the Deployment tools and .Net Framework 4.0, click Install

When complete click close, we do not need to view the getting started guide.

Open the WSIM from Start > All Programs > Windows Kits > Windows ADK > Windows System Image Manager

Right click on the ‘Select a Windows image or catalog file’ text and choose, ‘Select Windows Image’

Browse to the location of your WIM file and click Open

As there is no .clg file available you will get the following message, click Yes to begin generating a catalog file.

The WSIM will mount the WIM file

And then examine it to generate the catalog

When finished you will have Components and Packages in the Windows Image box within WSIM. This means we are done.

Browse to the location of your WIM file and you should find a .clg file alongside your WIM If you have this file then you can close WSIM

If you loaded the WIM file directly from your Deployment share then you can return to the MDT workbench and change to the OS Info tab within your task sequence and you will find that WSIM will load and allow you to make your changes exactly the same as you could with an x64 WIM, if you created the .clg file from a copy of the WIM file then you will need to copy the .clg into the deployment share into the same folder that the WIM file is in.

Data Protection Manager - Unable to configure protection SQL Server 2012

So you use Data Protection Manager 2012 within System Center Configuration Manager 2012 and you try and setup the backup of Microsoft SQL Server 2012.

Well all the dates match, surely it will work?

Error:  Unable to Configure Protection.

When you Google or Bing this error you find that the most common answer (on Microsofts own website and on various forums) is: "You must explicitly add the system account NTAuthority\System to the Sysadmin group on SQL Server."

The reason this is such a common answer is because it does actually work to be fair, however simply saying this is not help.  It's too vague and sometimes you just want a step by step, do this and it'll work fix. 

I love how sometimes you are expected to know, oh yeh, everything. 

This is how you actually do this.

1. Login to your SQL Server and go to SQL Server Management Studio.

2. Connect to your server and instance.

3. In the folder structure (Image Above)) Choose Security -> Logins and expand logins.

4. In the massive list of users, find the NT Authority\System User.  Right click and choose properties.

5. On the left hand side under the "select a page" header, choose Server Roles. (Image Below)

6. Click on the Sysadmin tick box and press ok. (Image Above)

7. Do a consistency check on the DPM Server and as if by magic, you get green ticks all across DPM. (Image Below)

I hope this helps.  It seems to be quite a popular thread on many forums out there but no step by step no nonsense guide. If I find more of these "Just do that" situations with no actual help, i'll try and get more step by step guides done.

Thanks for reading,

ITMagician

Yellow Triangle - No Internet Connectivity but there is..

In the bottom right hand corner of your Windows Desktop i.e. the notification area is a great way to determine many problems to issues people come to you with.

"I haven't got mapped drives"
"The network printers say offline"

Silly things that all essentially can be addressed by seeing a red X on the wireless or network adapter.

Now when someone comes in and says "my internet isn't working" and you see the "no connectivity" indicator, you know deep down it means nothing because you can't trust it, especially if you are in an environment that uses a proxy.

So why does it say "no internet connectivity" even though you have it.

Essentially, the network adapter calls to Microsoft to find a file on the internet, if it finds it, it confirms internet connectivity.  Nice and easy.  If the file is blocked, it can't determine internet is working, even though it might be.

However via a proxy its a pain in the derriere, as for some reason it struggles to find this file.  When it struggles to find this file it struggles to activate windows via a KMS connection, the Windows 8 store fails to load and most of the Windows 8 apps fail to work correctly.


In Group Policy you can actually tell your clients what machine to look at to determine whether or not it has internet connection, when it pings the server it accepts that it has an internet connection and KMS and the Windows 8 store and apps start to behave.


The Group Policy is found here:

Computer Configuration -> Network -> Network Connectivity Status indicator -> Specific Corporate DNS Proble Host Address.

Enable this policy and specify the IP address of your router (or server of your choice), essentially if it can see the router you can safely assume, providing your network is working, the computer has internet connection.

It makes that lovely marker over your network adapter vanish and everything starts to work in the way you would expect.

GPO Software Deployment with DFS Shares Failing [Solved]

Applies to: Microsoft Server 2008R2, 2012

Problem

Deploying out software using group policy fails on client because it doesn't have the correct permissions to the DFS Share Source.


Fixes you've probably tried

You've given full everybody permissions to all shares in relation to where you store your MSIs.

You've played with the controls in DFS and both on the root files on your data drive.

You've tested the install when logged in and it works, yet the it still doesn't deploy out via GPO automatically

You've googled endlessly and everyone has different solutions to the problem and yet none apply to you.

You've considered throwing yourself off a bridge knowing that the only fix you can find is to specify the actual server path, making DFS pointless.


The Actual Fix

The cause is normally a combination of Windows Firewall and indeed the permissions on the DFS Share.

Windows firewall in its on state will not recognise your namespace as a safe destination and prevent your computer access to it, quick fix is to turn it off and give it a try. 

Never do both fixes without testing one before applying the other, don't want to over fix it.

If it still doesn't work.

Open up DFS Management

1. Click on the Namespace and expand it.
2. Click on the folder you use for your MSIs.
3. On the LEFT hand pane still, right click and choose properties.  Do not choose properties from the central pane in the DFS manager.
4. Click on the Advanced Tab
5. Click Set Explicit view permissions on the DFS Share
6. Click on configure view permissions
7. Set Read Permissions to Authenticated Users and SYSTEM.
8. Press Ok and give it another go.

Hopefully this works for you happily, if it does please say thank you.

After endless googling this resolution has never been published in this way before, need to bump this topic upwards to save the headaches of all technicians that have had this problem.

Thanks for reading,