Blocking USB Devices and Removable Media through User based GPO

  I have seem many people asking how to block the use of USB memory sticks so people can't use them to transfer files on or off of a PC This how-to will give you a simple effective and free way to block these as well as other forms of removable media on a windows computer.

Create a GPO

The first step is to open Group Policy Management and create a new GPO.

I typically like to create 2 GPO's One for blocking read access and one for blocking write access.

By Creating 2 separate policies I can apply each individually so I can allow read access for certain groups of users while blocking write access and I can apply both policies to other groups so I can block all access.

The policy we are about to create is user based This means that it will apply to the users and not the computer. This means we can block access as need for normal users on a computer while still allowing access for other users like say IT (ourselves) so we can still do our thing without any issues.

These policies apply to all forms of removable media not just USB based media. therefor you can use them to block other media access such as CD and DVD access as well.     

Set the Desired Policy Items

In your GPO browse to the following location.

User Configuration >> Policies >> Administrative Templates >> System >> Removable Storage Access

If you look through the list of options you will see 2 choices for each media type. One choice when enabled blocks write access and the other choice blocks read access.

In my attached image i show an example of blocking all read access.

Therefor to block read access to each of these media types simply enable the deny read access item for each.
If you want to block write access enable the block write access options.
If you want to block both the enable both options.

Its really that simple.

----------------------------------------------------------------
Note:
For some reason Digital cameras require both read and write access. So if you have users that need access to a digital camera directly through the camera's USB connection they will need read and write access. Even if all they want to do is read files from the camera. However if you remove the memory card from the camera and read it with a memory card reader it only needs read access as expected.                      

 Apply the GPO

Now that you have created your GPO Policy (or policies if you want more granular control like I did) all that you need to do is apply the GPO to the Users you wish to restrict removable media for by assigning it the correct OU's.

Once applied simply wait for the policy to update on the users computer or run "gpupdate /force" to speed things up and test it out.                               

Conclusion

This is a simple and reliable way to control user access to removable media for users with the bonus of still being able to allow yourself or other special users of your choice the ability to use that same removable media

How to take DNS server backup in an AD environment

If you are an Active direc­tory admin, there is no need to men­tion the impor­tance of DNS. A DNS sever is poten­tially the sin­gle point of fail­ure in an AD envi­ron­ment… where an inter­rup­tion of its ser­vice or cor­rup­tion of any DNS records can bring the whole ser­vice down. This demands the need for a proper backup strat­egy for DNS servers.

Most pre­ferred method for tak­ing back up of DNS server is to do a sys­tem state backup. But this can­not be use­ful in many cases as it requires you to restore AD, Reg­istry set­tings, DNS etc. while busi­ness require­ment only needs you to restore the DNS server.

Also there may be cases where the sys­tem state restore cat­a­log may be cor­rupted and you could not restore it. Per­son­ally, I have faced sit­u­a­tions where the clients are com­plain­ing about cor­rupt sys­tem state back­ups where the users are not able to restore the DNS data using it. So it is always best to keep an inde­pen­dent backup of DNS server along with your nor­mal sys­tem state backup.

Before men­tion­ing how these inde­pen­dent back­ups can be taken for DNS servers, it’s worth men­tion­ing about dif­fer­ent AD zones in an AD environment.

• Pri­mary and Sec­ondary zones.

• Active direc­tory inte­grated zone.

Microsoft rec­om­mends using Active direc­tory inte­grated zone in DNS servers on an AD envi­ron­ment.

Now let’s check how inde­pen­dent back­ups can be taken on DNS server.

Pri­mary and sec­ondary zones:

Here the zone infor­ma­tion will be stored in plain text files. The backup and restore process is pretty straight for­ward where you can take a copy of text file con­tain­ing the zone infor­ma­tion using XCOPY.

The below com­mand can be used to backup.

XCOPY %SYSTEMROOT%\system32\dns c:\backup\dns /y

To restore the pri­mary and sec­ondary zone infor­ma­tion, you only need to sim­ply copy the files from the

\backup\DNS folder to the %SYSTEMROOT%\system32\dns folder

Active Direc­tory inte­grated zones:

You may be aware that the zone infor­ma­tion for Active Direc­tory inte­grated zone will be stored in AD data­base rather than as a text file. So the first step in tak­ing the backup is to export the zone infor­ma­tion to a file.

DNSCMD /zoneexport test.com backup\test.com.dns.bak

The backup file will be placed in the %systemroot%\system32\dns\backup folder, and will be named test.com.dns.bak.

You can use the backup file just cre­ated to restore the AD inte­grated zone if needed. How­ever, the restore process is bit more complex.

The restora­tion is a 2 step process.

a. You need to cre­ate a pri­mary zone by using the backup file you have cre­ated ear­lier.

b. Converting the pri­mary zone to AD inte­grated zone.

Before per­form­ing the first step, you need to copy the backup file you had cre­ated to 

%systemroot%\system32\dns folder from the backup loca­tion. Now, exe­cute the fol­low­ing com­mand.

DNSCMD /zoneadd test.com /primary /file test.com.dns.bak /load

The above com­mand will setup a pri­mary zone in the DNS server using the zone infor­ma­tion in the file test.com.dns.bak

Now, you need to con­vert the pri­mary DNS zone you just cre­ated to an AD inte­grated zone. You can use the fol­low­ing com­mand for that.

DNSCMD /zoneresettype test.com /dsprimary

Done!!

Note: If you want to enable secure dynamic updates, then you must enter the fol­low­ing command:

DNSCMD /config test.com /allowupdate 2

As a gen­eral back up guide­line is always a best prac­tice to test the integrity of the backup files at reg­u­lar inter­vals by doing test restores on any test network.

Thanks

R.karthikeyan

How Do You FIX: The trust relationship between this workstation and the primary domain failed

If you Google “the trust relationship between this workstation and the primary domain failed”, you get plenty of information from support blogs and Microsoft articles; however, most of them ask you to rejoin your machine to the domain. That’s not always possible.

What’s the problem and how did I get here?

---

The underlying problem when you see this error is that the machine you are trying to access can no longer communicate securely with the Active Directory domain to which it is joined.  The machine’s private secret is not set to the same value store in the domain controller.  You can think of this secret as a password but really it’s some bits of cryptographic data called a Kerberos keytab stored in the local security authority.  When you try to access this machine using a domain account, it fails to verify the Kerberos ticket you receive from Active Directory against the private secret that it stores locally.  I think you can also come across this error if for some reason the system time on the machine is out of sync with the system time on the domain controller.  This solution also fixes that problem.

This problem can be caused by various circumstances, but I most commonly run into it when I reset a virtual machine to a system snapshot that I made months or even years before.  When the machine is reset, it is missing all of the automatic password changes that it executed against the domain controller during the intervening months.  The password changes are required to maintain the security integrity of the domain.

The standard fix

---

Support blogs and Microsoft will generally tell you to rejoin the domain to restore the trust relationship.  Another option they will give is to delete the computer object and recreate it without a password and rejoin.

Microsoft support article on the topic: http://support.microsoft.com/kb/162797

I’m not a fan of any of these options.  This seems heavy handed and sometimes they aren’t even possible.

Recently, when I ran into this problem, the virtual machine that reset was an enterprise certificate authority joined to my test domain.  Well, guess what, Microsoft will not allow you to rename or unjoin a computer that is a certificate authority—the button in the computer property page is greyed out.  There may be another way to unjoin but I wasn’t going to waste time on it when it isn’t even necessary.

A better fix

---

Just change your computer password using netdom.exe!

netdom.exe resetpwd /s:<server> /ud:<user> /pd:*

<server> = a domain controller in the joined domain

<user> = DOMAIN\User format with rights to change the computer password

Here are the full steps:

1. You need to be able to get onto the machine. I normally just log in with the local Administrator account by typing, ".\Administrator" in the logon window. I hope you remember the password. If you’re creative and resourceful you can hack your way in without the password. Another option is to unplug the machine from the network and log in with domain user. You will be able to do disconnected authentication, but in the case of a reset machine, remember that you may have to use an old password. Your domain user’s cached credential has the same problem as the machine’s private secret.
2. You need to make sure you have netdom.exe. Where you get netdom.exe depends on what version of Windows you’re running. Windows Server 2008 and Windows Server 2008 R2 ship with netdom.exe you just have to enable the Active Directory Domain Services role. On Windows Vista and Windows 7 you can get it from the Remote Server Administration Tools (RSAT). Google can help you get them. For other platforms see this link: http://technet.microsoft.com/en-us/library/ee649281(WS.10).aspx"
3. Extra steps if the machine is a domain controller. If the broken machine is a domain controller it is a little bit more complicated, but still possible to fix the problem. I haven’t done this for a while, but I think this works:
   1. Turn off the Kerberos Key Distribution Center service. You can do this in the Services MMC snap-in. Set the startup type to Manual. Reboot.
   2. Remove the Kerberos ticket cache. A reboot will do this for you, or you can remove them using KerbTray.exe. You can get that tool here: http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=17657
   3. Post change steps. Do these in conjunction with 5 below. Turn the Kerberos Key Distribution Center Service back on before rebooting. You should reboot the domain controller and then force replication in the Active Directory Sites and Services MMC snap-in.
4. Run netdom.exe to change the password.
   1. Open an administrative command prompt. On Windows platforms with UAC enabled, you will need to right-click on cmd.exe and select "run as Administrator".
   2. Type the following command: netdom.exe resetpwd /s:<server> /ud:<user> /pd:*
5. Reboot the machine.

Here is more information on netdom.exe: http://support.microsoft.com/kb/325850

I hope this is helpful.  This problem comes up every few months for me, so I wanted to document it for my own use.  It is difficult to find when you just search for the error you get in the login window.

How to add a Second Domain Controller in Windows 2008 domain

Domain controller as server for hosting your company Active Directory (AD) is very important part of your network infrastructure. In case of its failure logging users on AD is impossible. Because of that one of the main things in planning your network infrastructure is make plan for implementing redundant domain controller in network infrastructure. In case you have it, failure of one of them does not mean that user will be unable to log on the system. Since failed domain controller is up again, backup controller will be in function of users authentication or other functions which it can have (DNS server etc.). On this way your network can stay functional, reliable and more resistible to failures.

In this article I will describe process of adding additional domain controller in your Windows network infrastructure.

First step is start dcpromo program to create new domain controller. Go to Start and type dcpromo in run field:

Click on OK. Opens first window in process of new DC creating:

When you want to add new DC Use advanced mode installation option should be unchecked because it use for Read Only Domain controller creating. In this case we want new DC with all functionalists as primary DC and read only mode is not option in that case. Click on Next.

In this window some information about operating system compatibility are displayed. Click on Next to continue.

Next window offers choosing option for add new or additional domain controller:

There are two options: to create new forest or to add DC in existing forest. If we have to add additional DC which is option described in this article Existing forest option should be checked. When this option is checked you have possibility to add new domain controller in existing domain or create new domain in existing forest. Here we want to add new DC in existing domain which will backup DC for our primary DC which exists in network. Because of that Add a domain controller to existing domain should be checked. When appropriate option are checked click on Next.

In next window domain name and network credentials for adding new DC should be set:

First, type the name of domain for which you want to add additional DC (testdomain.com in this example). After that credentials for adding DC should be chased. Main thing is that the credentials with which you adding DC should have administrative privileges. In this case we will use credentials of user from domain administrators group.

In network credentials type username and password of user which you use for promoting new DC. Then click OK.

In next step you should choose domain for which your server will be domain controller. By default, your domain will be set:

Chose default option and click Next. Opens window for site selecting.

Leave default option and click Next.

Next window is window for additional domain controller options. These are Global catalog, DNS server and Read Only Domain Controller. For additional DC you should chose DNS server and Global catalog options as it is shown on next picture:

Check DNS server and Global catalog options and click Next. Opens windows for choosing locations for database, SYSVOL and NTDS files. It is recommended to leave default options for these parameters.

Click Next. Opens window for setting restore mode password:

Restore mode account in Active Directory is different then domain administrator account. If you start domain controller in restore mode this account is used. So type password for restore mode account and click Next. Appears window with summary information about options you chose during installation additional domain controller:

When installation process is finished appears last window on which you simple should click on Finish button to finish installation process:

Now you will be prompted for restart computer and then you can log in to your new domain controller computer.

In this article I described how to set additional domain controller in our network. On this way you will make your network more reliable and stable.

Thanks
R.karthikeyan