GPOs don't work on the VPN?

Problem:  

Branch office or managed laptops are missing group policies.

Definition:  Group Policy Slow Link Detection

Slow-link detection identifies slow connections:  Slow transfer rates or high latency.  This process can trigger applications to scale back feature and function.  For example, slow link detection may interfere with distributed file systems (DFS).   In other situations, slow link detection can prevent remote workstations from receiving GPO updates.

Background:  

Wide-spread high-speed Internet connections (e.g., 100 Mbps) were uncommon before c. 2009.  Older network protocols were less efficient (e.g., SMB2 vs SMB3).  Slow-link detection was designed to compensate for poor connections.  This legacy process continues to impact modern network services (e.g., Windows 2019). 

Group Policy Slow Link Detection:

Connection rates are measured between the domain controllers and the client.  Group policy changes are not distributed when this transfer rate is less than 500 kbps. 

500 kbps may seem reasonable -but it's not. 

Solution:

Disable slow link detection:

   GPO:  Policies\Administrative Templates\System\Group Policy\Slow Link Detection

Options:  Enable this policy.

• Enter 0 to disable slow-link detection.
• Alternately, set high connection speed rate (e.g., 10000 Kbps is ~10 Mbps).

That's it!

References:

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc978717(v=technet.10)

How to Assign Active Network Location with PowerShell.

Step 1:  Identify networks and associated NICs.

Get-NetConnectionProfile

Name             : domain.com

InterfaceAlias   : Ethernet (Domain)

InterfaceIndex   : 1

NetworkCategory  : DomainAuthenticated

IPv4Connectivity : Internet

IPv6Connectivity : NoTraffic



Name             : Unidentified network

InterfaceAlias   : RDMA

InterfaceIndex   : 2

NetworkCategory  : Public

IPv4Connectivity : NoTraffic

IPv6Connectivity : NoTraffic

The above examples shows two NICs that belong to two different networks.

Step 2.  Change the NetworkCategory:

This example changes the active network for the NIC named RDMA.  The network location changed from Public to Private.  Confirm with Get-NetConnectionProfile.

That't It!

References:

https://docs.microsoft.com/en-us/powershell/module/netconnection/get-netconnectionprofile?view=win10-ps

Problem:  

How to use PowerShell commands to transfer FISMO roles?

Solution: 

Active Directory PowerShell module.

Assumptions:  

FISMO PowerShell management requires Active Directory PowerShell module.

  Import-Module ActiveDirectory

Example 1.  Show forest FSMO roles (forest):

PS> Get-ADForest contoso.com| ft DomainNamingMaster, SchemaMaster

Example 2.  Show domain FSMO roles (domain): 

PS> Get-ADDomain contoso.com | ft InfrastructureMaster, PDCEmulator, RIDMaster

Example 3. Transfer single role to a domain controller.  

PS>; Move-ADDirectoryServerOperationMasterRole -Identity "DCX" PDCEmulator

#N.B., PowerShell FISMO role names:

0= PDCEmulator      
1= RIDMaster      
2= InfrastructureMaster
3= SchemaMaster
4= DomainNamingMaster

Example 4.  Transfer multiple roles.

Move-ADDirectoryServerOperationMasterRole -Identity “DCX” –OperationMasterRole DomainNamingMaster,PDCEmulator,RIDMaster,SchemaMaster,InfrastructureMaster



Example 5: Transfer all roles with numbers: 

Move-ADDirectoryServerOperationMasterRole “DCX” –OperationMasterRole 0,1,2,3,4

Example 6.  Transfer FSMO roles between domain controllers:

Move-ADDirectoryServerOperationMasterRole

That's It!

References:

https://docs.microsoft.com/en-us/powershell/module/addsadministration/move-addirectoryserveroperationmasterrole?view=win10-ps
https://blogs.technet.microsoft.com/canitpro/2017/05/24/step-by-step-migrating-active-directory-fsmo-roles-from-windows-server-2012-r2-to-2016/

Outline:

Problem: 

Solution:

Assumptions:

Domain Controller Priority within a Site

• ·     DC-X with a priority of 0 (i.e., preferred).
•        DC-Y with a priority of 2.

Domain Controller Weights

Table 1
Determine domain controller preference based on weights.

Domain Controller	Priority  (Default)	Weight	Formula	Connection Odds
DC10	0	10	10/(10+20+30)  = 10/60  = 1/6	17%
DC20	0	20	20/(10+20+30)  = 20/60  = 2/6	33%
DC30	0	30	30/(10+20+30)  = 30/60  = 1/2	50%

DC Preference Configuration

1. Set priority and weight via the registry:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
2. Create new 32-bit DWORDs:
   LdapSrvWeight
   LdapSrvPriority
3. Assign DC priority and weight values.
4. Restart the NETLOGON service to publish to SRV records

Subnet Prioritization

Clients prefer to connect to DCs on the same IP subnet.  For example, let’s say we have a single AD site.  This site consists of one Windows 10 client and two DCs (Table2):
Table2
Subnet Prioritization

Host	Priority	Weight	IP address	Preferred DC
WIN-10			192.168.1.1/24
DC-X	0	100	192.168.1.100/24	Yes
DC-Y	0	100	192.168.2.100/24	No

Additional Thoughts:

References:

Problem:

How to disable the unexpected shutdown prompt for remote desktop users.  The remote desktop server (RDS) displays the shutdown tracker warning after patching updates.  This shutdown error causes confusion and unnecessary help desk calls.

Solution:

Remove local\Users group permissions from shutdown.exe:  c:\windows\system32\shutdown.exe

 

Both local administrators and local users, have read and execute permissions, on this system file.  Remove the local user group in order to hide unwanted shutdown messages.  Also note, this change may require ownership changes from the Trusted Installer to the local administrator group.


That's It!