GPOs don't work on the VPN?

Problem:  

Definition:  Group Policy Slow Link Detection

Background:  

Group Policy Slow Link Detection:

Solution:

• Enter 0 to disable slow-link detection.
• Alternately, set high connection speed rate (e.g., 10000 Kbps is ~10 Mbps).

References:

How to Assign Active Network Location with PowerShell.

Step 1:  Identify networks and associated NICs.

Get-NetConnectionProfile

Name             : domain.com

InterfaceAlias   : Ethernet (Domain)

InterfaceIndex   : 1

NetworkCategory  : DomainAuthenticated

IPv4Connectivity : Internet

IPv6Connectivity : NoTraffic



Name             : Unidentified network

InterfaceAlias   : RDMA

InterfaceIndex   : 2

NetworkCategory  : Public

IPv4Connectivity : NoTraffic

IPv6Connectivity : NoTraffic

Step 2.  Change the NetworkCategory:

References:

Problem:  

Solution: 

Assumptions:  

Example 1.  Show forest FSMO roles (forest):

Example 2.  Show domain FSMO roles (domain): 

Example 3. Transfer single role to a domain controller.  

Example 4.  Transfer multiple roles.

Example 5: Transfer all roles with numbers: 

References:

Problem:  

Solution:  

Background: 

Enable NAT-T 

1.   Edit Registry or create GPO:

2.   Create new DWORD value:   AssumeUDPEncapsulationContextOnSendRule

3.   Modify DWORD value:  2

S4B:  Bypass Split-Tunnel VPNs.

Take Away:  

Problem:  

• Local S4B/ Lync clients cannot host conference calls for external clients.
• All clients (external and DCA) can connect to conference calls hosted at at the company headquarters (JFK).  
• Local S4B/ Lync clients cannot share multimedia content (e.g., screen-sharing, video, etc.) between external clients.  
• All clients can share multimedia content when connected to conference calls hosted at JFK HQ.
• Audio and video quality is poor (e.g., choppy or static) between DCA and JFK locations.

Topology:  

• A site-to-site IPsec VPN tunnel connects the DCA and JFK offices.  
• DCA uses split-tunneling to forward all corporate data.
• DCA uses its default gateway to forward all other traffic to the Internet.  
• JKF hosts all Lync servers:  Front End, Access Edge, and Reverse Proxy servers.
• Both DCA and JFK use Active Directory (AD) integrated DNS servers.
• External clients allow staff to work from home.

Figure 1.  Example of  Lync and organization topology.

ICE Framework:  

Split-Tunnel Problems:  

Figure 2.  Lync directional mismatch.

Figure 3.  Bypass the split-tunnel VPN.

Resolution:  

1. Forward all domain name requests for Lync services to external DNS servers.
2. Use client DNS settings (i.e. internal)  for all other DNS resolution.

1. Create new GPO:  Computer Configuration → Policies → Windows Settings → Name Resolution Policy.
   
   
   
2. Configure the Advanced Global Policy Settings: 
   
   

   Figure 4.  NTRP GPO to bypass split-tunneling.

   
   
3. Change the Query Resolution settings.  Enable "Configure query resolution options".  Enable Resolve both IPv4 and IPv6 addresses for names.
   
   
4. Create rules that forward Lync FQDNs to external DNS servers.
   
   a.  To which part of the namespace does this rule apply?  Choose FQDN.
   b.  Click on the Generic DNS Server tab.
   c.  Toggle the Enable DNS settings check box
   d.  Click the Add button
   e.  DNS server:   Enter an external recursive DNS server; or the authoritative public (i.e., Internet facing) DNS server for your organization's sip-domain.
   f.  Click Apply.
   
   

Problem:

Background:

Solution:

PowerShell:

References:

Problem:  

Figure 1.  Win IKEv2 authenticates with ALL root CAs.  Yikes!

Figure 2.  Confirm IKEv2 authentication with Get-VPNAuthProtocl.

PS C:\Windows\system32> $cert1 = ( Get-ChildItem -Path cert:LocalMachine\root | Where-Object -FilterScript { $_.Subject-Like "*THWATE*" } )

PS C:\Windows\system32> Set-VpnAuthProtocol -RootCertificateNameToAccept $cert1 -PassThru

WARNING: Configuration parameters will be modified after the Remote Access service is restarted.

Successful execution always provides output that specifies the associated root certificate (Figure 3):

Figure 3.  Set-VPNAuthProtocol secures our VPN.

Please note, this script does not provide errors if the variable doesn't match a subject a certificate in the Trusted Root store. The Root Certificate field simply remains empty (e.g., Figure 2).
 
Step 3:  Restart the RRAS service.

Additional Thoughts:

Consider additional PowerShell safeguards for certificate authentication:

• Define the server certificate sent to clients:
  Set-VpnAuthProtocol –CertificateAdvertised
• Only accept certificates issued for client authentication:
  Set-VpnAuthProtocol –CertificateEKUsToAccept 1.3.6.1.5.5.7.3.2

Consider implementing both certificate and EAP authentication.  This may not be a good fit for all devices because of different types of clients.  However, if every client is Windows 10 we may be better off with SSTP.

Alternately, S2S VPNs can serve as a work-around for this public CA free-for-all.  We can assign specific client authentication certificates to individual S2S interfaces.  The system works but it creates administrative overhead.  I’ll write more about this in a future article.

Finally, it’s OK to implement both solutions:  Remove all public CAs from the Trusted Root Store; and only authenticate clients from our private CA (i.e., PowerShell).

That’s It!

References:

Task:  

Use master
GO

SELECT 
name AS [LogicalName]
,physical_name AS [Location]
,state_desc AS [Status]
FROM sys.master_files
WHERE database_id = DB_ID(N'tempdb');
GO

tempdev C:\Program Files\Microsoft DPM\SQL\MSSQL10.MSDPM2010\MSSQL\DATA\tempdb.mdf
templog C:\Program Files\Microsoft DPM\SQL\MSSQL10.MSDPM2010\MSSQL\DATA\templog.ldf

USE master;
GO

ALTER DATABASE tempdb 
MODIFY FILE (NAME = tempdev, FILENAME = 'X:\SQL\Data\tempdb.mdf');
GO

ALTER DATABASE tempdb 
MODIFY FILE (NAME = templog, FILENAME = 'X:\SQL\Data\templog.ldf');
GO

The file "tempdev" has been modified in the system catalog. The new path will be used the next time the database is started.
The file "templog" has been modified in the system catalog. The new path will be used the next time the database is started.

How To:  

Problem:  

• DH2-3DES-SHA1.   

Solution:  

• IKEv2 DH14-AES256-SHA256

Step 1:  Regedit:

Step 2:  Create new key:

Step 3:  Create new DWORDs (Table 1):

Problem:

Solution:

1. Open any Microsoft Office 2016 program.
2. Click on the File menu item.
3. Click on Options.
4.  Click on the Save tab located on the left menu.
5. Toggle the check box field that reads “Save to computer by default”.  Click OK.

Repair Windows installation licensing errors.

Problem:

Background:

Solution:

Problem: 

 Solution: 

Network Name:  

• Outbound:  Most outbound traffic permitted.
• Inbound:  Unsolicited SMB (e.g., file and print sharing). 

Problem:

Versions:  

Solution:  

1. Run Windows Updates on a regular basis.    
2. Enable Microsoft Office File Block Policy to block RTF documents.

Disable RTF in Office 2007:  

Disable RTF in Office 2010:  

1. Launch Registry Editor with regedit.
2. Locate the following hive:  HKEY_LOCAL_MACHINE -> SOFTWARE -> Microsoft
3. Create a new key in the above hive:  Name the key:  Workspaces.
4. Create a new key in the newly created Workspaces hive.  Name the key:  ResourceType.
5. Restart.

Problem:  

Solution:  

Background:   

Convert:

1. Download MVMC.  The Microsoft download sites lists MVMC as 3.0.  N.B., the file installs version 3.1.
2. Install MVMC on Hyper-V host.
3. Uninstall VMTools from VMDK VM.
4. Copy VMDK to Hyper-V host.
5. Open PowerShell.  Import MVMC PowerShell library.
   
   Import-Module "C:\Program Files\Microsoft Virtual Machine Converter\MvmcCmdlet.psd1"
6. Use PowerShell to convert VMDK to VHD.  N.B., Do not use VMDK_Flat file!
   
   PS D:\TMP> ConvertTo-MvmcVirtualHardDisk -SourceLiteralPath "D:\VMS\DEV.vmdk" -DestinationLiteralPath "S:\VMS" -VhdType DynamicHardDisk
7. Create new VM in Hyper-V.  Add newly created (i.e., system) disk to IDE adapter.  Additional disks can use the SCSI adapter.  This is the time to configure dynamic memory or add additional CPUs.
   N.B., Do not resize the disk until after the VM starts at least once in Hyper-V!
8. Start-up VM.  Install Hyper-V tools.  Restart.
9. Optional:  New NIC "hardware" causes problems with retaining preexisting static IPs.  Resolve problem by deleting the network adapter and restating.  Windows creates a new network adapter upon start-up.  Manually add IP addresses into new adapter.