Finally!!!
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=7d2f6ad7-656b-4313-a005-4e344e43997d
For those of you that manage Windows Server systems from a Windows 7 client, and who ran into the annoying problem of having installed Service Pack 1 on your Windows 7 client BEFORE trying to install RSAT, and found that didn't work so well, well…. the solution has finally come around.
It's a been a long time since I wrote anything about Group Policy. I'm sure some of you are happy about that, and maybe wish I'd take even longer, but oh well. You must endure the torture that my second-rate writing brings to unsuspecting eyeballs and those with challenged mouse clicking fingers.
Lot's of folks are skiddish (not Yiddish, an entirely different thing) about practicing and learning about Group Policy in a "safe" and protected environment. Some will simply create a few "test" OU's and test user and group accounts in their production Active Directory environment. That's risky. It can actually be downright "stupid-dangerous". Two words that go together like bacon and eggs, Tom and Jerry, politics and lying, and a few others. The key word is "tatooing", which can render your environment, in technical terms: fucked up beyond all repair (that's FUBAR).
The better, smarter, safer way to go is using a virtual environment. If you haven't used a virtual machine setup before, maybe you've just read and heard about the concept, it's very easy. VERY easy indeed. And not only cheap, but FREE. I have to assume that if you're working with Group Policy, then you have an Active Directory environment nearby. If you have Active Directory, then chances are you have Windows Server handy. You are ready to go.
As a standard practice, I recommend installing RSAT on one of your Windows 7 VM's so you can manage AD and Group Policy features from a desktop, rather than relying on logging into a DC every time. This is usually more realistic. It's not usually recommended to constantly log into a DC to do daily check-ups and modifications unless you have to. This is especially true if the DC has other roles on it like File/Print, Web services and so on.
Even though you are in a VM environment, it is still a good idea to create test OU's and test user accounts, test groups, test computers, shares, and so on. This offers you additional layers of safety. It's easier to blow off a bad GPO configuration against a test OU and test accounts, than it is to recover the entire VM environment.
The scope and scale of your virtual environment is only limited by two things: disk space and memory. Those are both limited by budget. If you have the budget to expand your disk storage capacity (and redundancy) and add memory, do it. It's worth it if you intend on making this a serious project. There is no such thing as too much memory or storage capacity. The more you have available, the more you will consume. That's a fact of nature.
If you have enough resources available you can expand your environment and your testing to include things like sub-domains, multiple forests, multiple sites and site link replication, DNS configurations, DHCP scopes and options, VLAN's and so on. You can also add other products to your environment such as Sharepoint/MOSS, System Center products like Config Mgr, SCOM, DPM, as well as Exchange, WSUS, and other products (not to mention scripting and non-Microsoft products). It's also perfect for practicing those topics for your upcoming certification exam that you may not even have in your production environment.
But I digress.
The point of this article was to help with building a virtual lab to work with Group Policy. I got a little sidetracked, but hopefully in a good way. I hear from people all the time that say they are hesitant to practice with Group Policy settings for fear of breaking their environment or creating a mess they might have to dig their way out of (adding yet more work to their already busy day). Having a virtual environment allows you to try things and not impact your real environment, so you can move ahead without the worries. Take an afternoon, stay after work, or a weekend morning, and build your virtual lab. It'll pay off for you, I promise.
These are not ordered by “importance” or “value” or anything, just a flat list of ten productivity booster applications for most Windows 7 users. They are all FREE. Enjoy!
| Paint.NET | Edit and enhance pictures and image files with a variety of effects and filters. Basic drawing and touch-up features as well. Free |
| Windows Live Writer | Part of the Windows Live package, this provides a robust blog editor with support for plug-ins, multiple blog engines and multiple blog accounts. Free |
| TweetDeck | Twitter desktop client with sorting, filtering, multiple account management, and links to Facebook and MySpace. Free |
| 7-Zip | Alternative to WinZip and WinRAR for opening, extracting and creating a wide variety of archive formats including CAB, ZIP, RAR and many more. Free |
| Microsoft SharedView | Remote desktop connectivity over the web using your Live ID account. Sort of NetMeeting on steroids but updated for Windows Vista/7 UI. Free |
| DivX Player | Provides CODEC for playing most popular DivX AVI encoded movies. Free |
| BitTorrent | The de facto standard of desktop torrent clients. Need I say more? Free |
| RSAT | Remote Server Administration Tools, replaces the older “Administration Tools Pack” for Windows Server 2003 management. RSAT is for managing Windows Server 2008 as well as 2003 from a Windows 7 client. Free |
| WireShark | Powerful network monitoring and logging utility. Free |
| Windows Easy Transfer (XP to Windows 7) | Simple utility for backing up everything you need or want from your XP box before wiping and reloading it with Windows 7 (the way you should do it). Available for 32 or 64-bit clients. Free |
Log Name: Application
Source: Group Policy Drive Maps
Date: 5/17/2009 8:55:57 AM
Event ID: 4098
Task Category: (2)
Level: Warning
Keywords: Classic
User: SYSTEM
Computer: Desktop4.acme.local
Description: The user 'V:' preference item in the 'Drive Mappings {3B6D54F2-E7DC-45A5-A66E-59C16CE2CB1A}' Group Policy object did not apply because it failed with error code '0x80070035 The network path was not found.' This error was suppressed.
Log Name: Application
Source: Group Policy Printers
Date: 5/17/2009 8:56:41 AM
Event ID: 4098
Task Category: (2)
Level: Warning
Keywords: Classic
User: SYSTEM
Computer: Desktop4.acme.local
Description: The user 'HP Deskjet F4200 series' preference item in the 'Drive Mappings {3B6D54F2-E7DC-45A5-A66E-59C16CE2CB1A}' Group Policy object did not apply because it failed with error code '0x80070709 The printer name is invalid.' This error was suppressed.
It was Group Policy Preferences which were tripping up, because the "network path" it mentions indeed changed. The V: drive (among other drive mappings) specified in the GPP setting was pointing to a UNC path that no longer existed. The UNC path was for the previous DC server name. While I moved the data and shares over to the new DC and it worked fine, the GPP was not updated. The net result was that each client was trying to find the share to reconnect the local drives and causing it to wait during logins.
The printer mapping failed to resolve because the client from which it was shared happened to have been reloaded with the same operating system but someone forgot to share out the printer again. Once the printer was shared and listed in the directory, everything synched up fine. But next up, I had to update the GPP settings for the drive mappings.
Right-click on each of the drive mappings to the right, and select "Properties". From there, I simply replaced the old server name component of the UNC path with the new server name (e.g. "Dragon"):
Once I updated all of them, I simply closed the GPM console, opened a CMD console on the client and typed GPUPDATE and hit Enter. After a few seconds the Group Policy settings were refreshed and I type NET USE to list all the drive mappings. They were all present and accounted for. To verify UNC resolution, I simply enter a drive letter to list a directory...
C:> V: (press Enter)
V:> DIR (press Enter)
All is good.
Conclusion
In the past, I would have used a login script to manage drive mappings, but there are some logistical issues with that method which are better served with GP Preferences. It still amazes me that admins are still using scripts to map drives, printers, make registry changes, add or remove shortcuts, edit environment variables, modify INI files, add files and folders, and so on.
Don't get me wrong. Being a script developer, I still insist scripts are the way to go for many tasks, but for these types of issues you're way better off using GP Preferences. In this particular scenario, GP Preferences saved me at least a few hours of work and having the built-in integration with Event logging, it was much faster and easier to diagnose the problem and take the appropriate action to resolve it.
I'm seeing a strange pattern with respect to RSAT lately. I have no idea why, but today I had the third person in two weeks e-mail me about how to get it to work on their Vista or Win7 computers. In all three cases, they installed the RSAT MSU patch file and then went looking for the RSAT tools immediately, but none were to be found.
