Group Policy Work with Citrix Published Applications - HOW TO

I came across an issue, whereby I needed to publish an app, which was basically launching an Intranet URL within IE from the Citrix servers for External citrix users.

The issue i was facing was that the trusted sites list from within IE specified USER GPO would not get applied.
Hence, users would not be able to access the intranet url.

After searching on the issue, it turns out to be a Microsoft Feature/Citrix Feature.

This link provides the solution and explanation:

https://www.conetrix.com/Blog/post/How-to-Make-Group-Policy-Work-with-Citrix-Published-Applications.aspx

Below is the extract from that post:

When a user with an empty roaming profile (new user) has their profile created as the result of running a published application, the user portion of the registry hive (ntuser.dat) is not created in its entirety. The users' hive can be loaded and a number of noticeable differences exist between it and the default user registry hive. If the user profile is created by logging on locally (console), via RDP to the same machine, or via Citrix published desktop on the same machine, the profile that is created is complete. I was unable to find any noticeable differences between the default user registry hive and that of the newly created roaming user profile when the profile was created in this way. Additionally, once an incomplete profile had been created via published application session, the profile could NOT be "fixed" by logging on via RDP or published desktop. Once the registry hive was created in an incomplete fashion, it seemed to be affected from then on. So why are we talking profiles...I thought this was about group policy? Well, it is...I'm getting there.
We found that users running published applications did not have group policy correctly applied. We were trying to set policies on Internet Explorer using Internet Control Panel settings in the user portion of the GPO. Specifically, IE security zone settings such as trusted and intranet sites would not apply. We also noticed that each security zone seemed to be locked. In the Security tab of the Internet Options dialog box, all the icons were the same....blue IE symbol with a lock next to it. The "Sites" button and the "Custom Level" button were also grayed out. So, here is the where the profile problem merges with the group policy problem. I found that by manually exporting certain keys from the default user profile registry hive under \Software\Microsoft\Windows\CurrentVersion\Internet Settings\ and importing them into in a incomplete user registry hive, I could fix the problem. That is, once the keys existed in the user registry hive that pertained to the settings I was trying to set via group policy, the policy was applied correctly...no issues. Makes sense right....if the group policy is setting registry keys in order to apply certain policies, it’s not going to work if the keys don't exist in the first place.
So things have come full circle. Group policy isn't working because the user profile is messed up. So why is the user profile not getting created correctly? Well, this is actually a Microsoft problem --> http://support.microsoft.com/kb/899270. And the script they provide doesn’t work…we tried it. Actually, there is more to the problem than that, but here is a summary of the information that we gathered. By design, Citrix published applications, remote applications in Windows 2008, and the "start this application on connection" functionality of RDP (mstsc.exe) running against Windows 2003 servers implement limited logon functionality so that the session footprint is smaller than a normal desktop session. Part of the "limited functionality" is that the user session does not start explorer.exe. So, any application that depends wholly or in part on explorer.exe could have issues. Some of the important pieces of functionality that explorer.exe implements are the following:

1. The run registry entry
2. The RunOne registry entry
3. Startup applications 

If you have ever noticed the small gray box that is displayed the first time you log on as a new user, you have seen the effects of explorer.exe running at session logon. It goes by fast, but it says something like "applying internet explorer customizations", "setting up windows media player..."...stuff like that. That little box is normally initiated by explorer.exe. It is called runonce.exe. What we found was that if we initiated runonce.exe in a logon script, the user was created correctly when running published application; thus, group policy was applied correctly as well. Testing also showed that this process could also fix a previously created broken user registry hive (ntuser.dat). All we had to do is add the following to our logon.bat file
start /MIN %windir%\system32\runonce.exe /AlternateShellStartup
Citrix has documented this problem in a support article (http://support.citrix.com/article/CTX104374) and they refer back to the previous MS KB listed above. Numerous forums threads exist on this issue and we were unable to find a resolution elsewhere that did not include scripting registry imports to the user profile at logon. This workaround seems to be a more flexible and reliable.


Eventually, for me. i  had to create a GPO with user loopback processing - merge, setup IE trusted list, and run the cmd in bat file at logon. apply the gpo to the citrix servers ou and filter it via Global groups.

Cheers

Rahul

Replicate Security Group membership from One Domain to Another.

Using powershell, and making lot of string customisations to get the output as desired....
Not the best of scripting.. but does the job i want it to do, with a bit scratchy error reporting...


++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


# connection variables for all AD

$SourceAD = Connect-QADService -Service SourceAD_DC.local -ca sourcedomain\admin -cp (convertTo-SecureString password123 -ASPlainText -force)
$DestAD = Connect-QADService -Service DestAD_DC.local -ca Destdomain\admin -cp (convertTo-SecureString password123 -ASPlainText -force)


#Gets group names from file C:\temp\GroupCopySource\GroupsA.txt (Source Domain1 Groups),
#which then gets all members in the group, string manipulation is done to get only username and groupname
#so that we can use them in Domain2 AD for comparing and adding group members

#

Get-Content C:\temp\GroupCopySource\GroupsA.txt | ForEach-Object -Process {$member=get-qadgroupmember $_ -connection $sourceAD | Select-Object -expandProperty SamAccountName;
$new = $_.split("\");
$groupname=$new[1];
$groupfinal = "GSG-sourcedomain-$groupname";
$member > C:\temp\GroupCopyTask\$groupfinal.txt;
    ForEach ($b in $member) {trap [Exception] { Add-Content c:\temp\GroupCopyJob\errors.txt $error" groupname = "$groupfinal"`n"; $error.clear(); Continue} Add-QADGroupMember -identity $groupfinal -member ("destdomain\$b") -connection $DestAD;
    Add-content C:\temp\GroupCopyDest\$groupfinal"_copyresult.txt" $b}} > C:\Temp\GroupCopyJob\scriptoutput.txt




#clear all variables before being used.

Clear-Variable member
Clear-Variable groupfinal
Clear-Variable groupname
Clear-Variable new

Windows domain controller without Windows...

Sounds good...
have to try it...

http://www.vmware.com/appliances/directory/393283

Ubuntu(windows) domain controller...

Resizing Disks used in a MSCS in VMWare

To take a backup of the VMDK:

Stop the cluster nodes.

Rename the VMDK that needs to be expanded with the command:

vmkfstools -E

Clone the VMDK to a thin volume using the original name with the command:

vmkfstools -I -d thin

Grow the clone with the command:

vmkfstools -X

Inflate the cloned VMDK with the command:

vmkfstools -j

Start the cluster.

Remove the old VMDK from the datastore.

------------

backup the vmdk

1. vmkfstools –E servervm.vmdk servervm_old.vmdk (this renames the vmdk)

2. vmkfstools –i servervm_old.vmdk servervm.vmdk –d thin (clones the renamed vmdk to original name in thin format)

3 vmkfstools –X 200G servervm.vmdk (expand the available size to 200 GB)

4. vmkfstools –j servervm.vmdk (inflates the vmdk in eargerzeroedthick format)

Conclusion: I think its just another way to redo the metadata on the VMDK files so it reads the new resized disk properly...

Exchange 2010 - hub Transport not accepting SMTP connections, ForeFront client security enabled

Need to make sure proper exclusions are in place such as the transport service in exch2010

http://technet.microsoft.com/en-us/library/bb332342.aspx

SCAN option not available at Right Click with Symantec Endpoint Protection

Found out that,

the Right Click - SCAN option is not available when logged in via RDP session on SEP clients.

May be you already knew that, i didnt...

Also, if there is a centralized exception to the folder you are trying to scan manually,
IT WILL STILL NOT SCAN the folder if it is part of the exceptions.

Cheers

Reset password while unlocking SQL

If you uncheck the enforce password policy then on the General screen then click ok then go back and recheck the enforce password policy after clicking ok the first time then the account will be unlocked w/o changing the password.