Posts

Script to Logout all Users Before Restarting RDS Servers

Multiple vendors have recommended logging out all users before restarting our RDS servers. Sadly I was never able to find a script that could do everything I wanted.

I created the script below for Server 2012 + servers. The script will do the following: Logout all active users (even console users)Write errors and information into the Application event log You can find the script here: https://github.com/andy2002a/PowerShell/blob/master/RDS/Disconnect-LoggedOnUsers.ps1

The script will not reboot the server, but you can always add a shutdown -r -t 0 at the end, or schedule your reboot script to run right after this one.

Enforce Office Add-ins

Image
This guide will show you how to force add-ins to load in Office every single time. We will also prevent users and office from disabling/enabling add-ins*.

*Outlook 2016* will sometimes disable add-ins any way, but we will apply a workaround for this.

At the end of the guide, the add-ins you configure will look like this:
Getting the ClassID of an add-in Find the ClassID of the Add-in. This is found in:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\AddinsHKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Office\application name\AddinsHKEY_CURRENT_USER\Software\WOW6432Node\Microsoft\Office\application name\Addins
It is usually in a format similar to Application.OutAddin
Enforcing add-ins  We will now create a GPO that will enable or disable the add-ins that we configure. Create a GPO called Office Enforced Add-ins*Depending on the importance(compliance, auditing, etc) of this Add-in it might be a good idea to Enforce the GPO(…

Fixing Office 365 Azure AD Sync issues

Image
Symptoms: You have synced the AD users, but you have duplicates or two of a similar user (reception@ and receptionist@). You try to edit the UPN of either user and you receive an error saying that the attribute must be unique.

On the sync service you get an error saying the attribute(usually the UPN) must be unique.
Background: UPN = username (and usually email address)

ImmutableID (anchor) = used to link an AD user to an Office 365 user (after UPN matching)

In AD there exists an account with a UPN: mailbox1@example.com

In Office 365 there exists an account with a UPN: mail1@example.com

These two accounts are the same user, but their O365 email address does not match up with their UPN (not usually a problem, but during the initial sync it is)
The problem: The AD sync service is started and AD users are synced with Office 365 users.

You log into Office 365 and see two users now: mailbox1@example.com(unlicensed) and mail1@example.com(licensed)

You try to un-sync mailbox1@example.com an…

Fixing Group Policy Replication issues

Image
I ran into an issue where GPUpdate kept returning the error below:

"Computer policy could not be updated successfully.  The following errors were encountered: The processing of Group Policy failed.  Windows attempted to read the file \\COMPANY.LOCAL\sysvol\<FQDN>\Policies\{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}\gpt.ini from a domain controller and was not successful.  Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.

To diagnose the failure, review the event log or invoke gpmc.msc to access information about Group Policy results."

In my case the DCs got out of sync and the fix was to complete an author…

Duplicate Printers Showing Up in Windows

Image
The Issue:You delete a printer, but it keeps coming back (and it probably doesn't work properly)There are multiple print queues for the same printer
You can't delete a printer This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.Cause I don't have a solid root cause for this issue, but here are some theories  Printers were deployed through GPO at one point and the policy didn't get removed properly.Printer spooler was restarted at the wrong timeIf you clear HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider and restart the spooler before restarting the computer there is a chance that printers will be duplicated.General printer corruptionSolutionThese steps will likely result in all users losing their printer preferences and default printers.
These are some preemptive things that will not solve the issue, but can help you have a better star…

Enabling Webcam on RDS

Image
This will show you what you need to do in order to enable webcam access on an RDS server.

NOTE: Using a webcam on RDS will result in significant CPU usage (30%+ in my case). This might be due to the raw USB data having to be transmitted through RDP. You should recommend that users instead use their webcams from their local computers.

The setup is actually easy but I ran into some issues that you'll see below.
My configuration:
Server 2016 RD gatewayServer 2016 RD Session hostWindows 10 1809 workstationVMware 5.5 hosting both VMsBuilt in laptop webcam and Logitech C270 webcam
Enabling:If you are using an RD Gateway, make sure that redirection is enabled for the collection (not 100% sure this is required). No further gateway config is required. On the workstations, or on a GPO applied to workstations, enable the setting below:Computer Configuration/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection Client/RemoteFX USB Device Redirection/Allow …

Set custom scaling option for Server 2012+ RDS

If you log into a Server 2012+ RDS from a Windows 7 machine you will find that you cannot change the scaling (Text Size, DPI, etc.) of the desktop. This is due to the fact that by default, Server 2012 RDS will use the scaling settings of your Windows 8+ machine. If you are on Windows 7 you will only have the option for the default resolution.

Thankfully, there are some reg keys that allow us to work around this.
For all users on a machine (this will break auto scaling for Win 8 machines): Create the following reg key on the RDS server
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\IgnoreClientDesktopScaleFactor
DWORD
Value: 1
For select users (if you only have a few Win 7 machines to deal with): HKEY_CURRENT_USER\Control Panel\Desktop\LogPixels
DWORD
Value: 78 (hex) for 120 DPI (you can find other values in the links below)

Referenceshttps://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/dpi-related-apis-and-registry-settings
https://supp…