How to enable/disable Windows Test Mode and also get rid of the desktop watermark afterwards

I've been working on a case with Microsoft for the past year and we finally might have found the underlying issue. In trying to verify whether the issue was correctly identified Microsoft created a private fix for us.

To install this fix you have to jump through a few hoops but it is pretty straight forward.

And while getting your system out of the test mode is just as easy as getting it into test mode - removing the desktop watermark seems to be a different story. Until you know how to.

But lets begin at the top.

"Interactive logon: Machine inactivity limit" policy gets triggered by disabled screensaver's timeout

This is just a quick post about how Microsoft managed to keep me busy for a couple hours on what should have been a simple 5-minute job.

After months and years I have finally managed to get the higher-ups to agree on implementing the "Interactive logon: Machine inactivity limit" local security policy after I proved to them that we have a number of users who do not lock their machines even over night or even the weekend.

Previously all we did was enable the power saving option for the monitor but let the user disable that if they had any kind of issue with it or "simply do not like it".

Anyway, I finally got the green light and enabled the policy with a 1200 seconds timeout on inactivity. And that is were most of my workday suddenly got a lot busier than I had it expected to be.

Windows 10 upgrade fails with error 0x8007001F - 0x20006 ... and a number of other errors

What better pastime on a weekend than trying to upgrade a laptop with Windows 10 1809 installed on it that refuses to let itself get upgraded or install any Windows updates for that matter? I really cannot think of anything ...

But lets start from the top: This laptop has Windows 10 1809 Education installed on it. With an UBR value of 253, which puts its update status on January 8th 2019 ... more than 2 years since the last Windows update was installed.

Every attempt to install a newer Windows 10 version would always fail with the error 0x8007001F - 0x20006, accompanied with the error message "The installation failed in the SAFE_OS phase with an error during REPLICATE_OC operation." (in German: "Die Installation war nicht erfolgreich. In der Phase SAFE_OS ist während des Vorgangs REPLICATE_OC ein Fehler aufgetreten.")

And every attempt to install any regular Windows updates would throw an "This Update is not Applicable to your Computer." error (in German: "Das Update ist nicht für Ihren Computer geeignet.")

But this is just where it all starts ...

msra.exe (remote assistance) refuses to connect - for non-admins

Last week one of our admins in a remote location came across an odd issue. They were not able to send a remote assistance request (msra.exe /offerra <pcname>) to an employee that needed some help. They tried other computers and everything was working. They tried it again with a different account that has admin permissions on the target (first) machine and that worked too.

Our helpdesk checked all the permissions but was not able to find any faults. A coworker of mine checked everything again but also was not able to find any configuration issues. Everything looked like it was supposed to.

[Powershell] How to annoy your users to restart their computers more often

A few days ago someone on /r/sysadmin asked how others are making their users restart the computer more often.

Since I wrote a little Powershell script for exactly this purpose back in march I thought I'd share it here.

Sending Wake-on-LAN packets from a Wi-Fi device or "why you should disable Windows 10 quick boot"

Recently one of my co-workers signed up for doing home office a few days every week. Being the exemplary user he should be (working in IT and all) he tried waking up his office machine using his notebook a few days before he was going to do home office. And against all expectations ... nothing happened.

Java usage tracking or "How to figure out what Java is used for in your environment"

UPDATE 2018-10-17: The release notes of Java 8u191/192 indicate that the location of the usagetracker.properties file has been changed. The guide below has been updated accordingly.

Oracle announced the end of Java 8 and that they will no longer provide free updates for Java 8 for enterprises after January 2019 here and here. And while Mozilla, Google and even Microsoft already removed Java support from their respective flagship browsers Oracle also announced that they will drop the browser plugin completely in upcoming releases.

[Guest Post] Restoring a Windows System Image from a backup on a network location

This post will explain to you how to perform a full system restore from a backup made with Windows Server Backup (WSB) on Windows 2012R2/2016. The only two things you will need are a backup made with Windows Server Backup and an ISO file of the corresponding Windows version that you want to restore.

Office 2016 toast notifications after upgrading to Windows 10 1709

After the upgrade of 70 computers from Windows 10 1607 to Windows 10 1709 discussed in the previous post people started complaining about a lack of toast notifications coming from Outlook 2016.

And indeed. When checking the Settings app under "System -> Notifications & Actions" there were entries for all kinds of applications but no trace of Outlook 2016 anywhere. And checking a Windows 10 1607 machine showed that it had been there before the upgrade. So something broke with the upgrade to 1709, again ...

Upgrading Windows 10 Enterprise 1607 to 1709 - And why useful error messages are important

As mentioned in previous posts we have about 3500 client computers and at this point somewhere around 600 of them are running Windows 10 Enterprise 1607 (the Anniversary Edition). Updates are handled through SCCM (System Center Configuration Manager) and so are the Windows 10 feature upgrades (going to be).

We had already run some test with the Creators Update 1703 but only rolled that out to a handful of machines, mostly internally in the IT department. So last Friday it was finally time to test the deployment of the Fall Creators Update 1709 to about 70 clients all at the same time. We wanted to see what kind of impact this would have on the network. The 70 machines were located on two different floors and supplied by two different switches. I will not go into detail about the numbers here but one switch showed a throughput of about 500Mbit/s for around 20 minutes supplying 40 or so machines. (Later I did another upgrade and 1 machine caused a peak network usage of 180Mbit/s for about 2 minutes.) But this is not the point of this post.

[BUG] Windows 10 default user profile oddity - Free folders for everyone

Remember my post from July 2017 about how the default user profile under Windows 10 was writeable by any user (no admin rights required) if you had 1607 installed at any point in time?

 

Well, here we are again with a new oddity.

 

[Powershell] Installing fonts - the hard way

This post is more of a guide than me finding weird bugs and the documention of my adventures trying to figure out what is actually going on. But even then I came across something new that kind of tripped me up.


A number of departments in the company I work for use various special fonts, which are part of the "Corporate Identity". Whenever a machine in one of those departments gets replaced we needed to install these special fonts on the new machine. And since we have been replacing a couple hundred machines over the last half year and will continue to replace a couple hundred machines every year on a regular basis from now on I decided to take a look at how to automate the deployment of fonts.

As I have mentioned in previous posts we are using Microsoft's SCCM (System Center Configuration Manager) for Windows/Office update and general software deployment. So the tool of choice for the task was of course that. All I needed now was a script that could properly install the fonts and hand that script over to the guy in charge of the SCCM server so he could deploy it to the machines in question.

Windows folder redirection not working - The Reckoning

As already written in the "Windows folder redirection not working ... sometimes" article we are making use of the Windows folder redirection group policies to redirect folders like "Documents", "Desktop" and "Favorites" to a server share in order to save space on the local harddisks/SSDs and of course make that data available to the user no matter what workstations he logs onto. For the redirection we use the environment variable %HOMESHARE% which basically contains the value of the AD field "HomeDirectory".

Until now the folder structure we were using for the home directories was a little odd. The home directories resided in "\\server\users\home\<department>\<accountname>" which means that whenever a user changes department his/her entire home directory had to be moved to a new location.

The server department started moving the first departments' users' home directories to a new structure (and updated the "homedirectory" value in the AD for the affected users accordingly). The new locations for the home directories are five DFSs under "\\server\users\home0[1-5]\<accountname>" hosted on a NetApp server. The split into "home01" to "home05" is done so that they do not have to restore a giant 10TB share and instead only have to deal with smaller 2TB portions when things go south.

And even though the people in charge claimed that they tested everything thoroughly things did go south when they migrated the home directories of the first hundred or so users ...

Spying on your boss made easy ... courtesy of Microsoft SCCM

Update 30.08.: A decision was made as to what to do about this issue. The SCCM client will be monitoring the registry keys, as a form of a watchdog service, and will report any machines where modifications are made to a group of administrators via mail.

---

Update 29.08.: Apparently "mstsc.exe" offers the same functionality, I was told. Add a DWORD called "shadow" under "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" and set the value to "2". After that you should be able to use the following command: mstsc.exe /shadow:<session ID> /control /noConsentPrompt /v:<remote machine>

Like this the user will not even see a flickering mouse cursor. The only way to tell someone is watching you like this is by checking the task manager and looking for the RDP processes.

---

Ever wanted to know what your boss is doing all day long? Are you using Microsoft SCCM for operating system and software deployment and do you have local admin privileges on your boss' computer? Then you are in luck!

This basically is a direct continuation of the "Unusual Microsoft remote assistance slowdown" story and even ties into the "VNC Heisenbug" to a degree.

But from the start ...

The VNC Heisenbug

Update 16.07.: Apparently the VNC viewer also works when I copy the executable to a folder on the local system, rather than executing it from the desktop which is located on a network share. It will also work while on the desktop when I give the user full access to the entire home share (\\<server>\benutzer\home\). Giving him full access rights to just his own home directory (\\<server>\benutzer\home\<department>\<user>) results in the VNC viewer still failing with the "getaddinfo" error.

---

Two of our departments recently got a new system for their number ticket system. You press a button on a touch panel and get a ticket with a number on it. When that number is called, you proceed to the counter.

The company who delivered the new system pre-installed VNC (at this point I only knew it was *some-kind-of* VNC, later I found out it was a TightVNC server) on the machines responsible for displaying the button to request a new ticket and print the ticket, and the machines responsible for showing which numbers are up next.

Unusual Microsoft remote assistance slowdown

Back in March 2017 our department was getting increasing numbers of complaints about abnormally slow remote assistance connections ... but not from our users but from co-workers of the other IT sub-departments. We are using the Microsoft Windows Remote Assistance tool (msra.exe) for when we need to help a user with a problem.

And when I say "slow", I mean _slow_. The lag between input and output easily reached over 1 minute, which made working like that impossible.

To proxy or not to proxy

Today I was asked to update the EGVP (Elektronisches Gerichts- und Verwaltungspostfach) software on a client. The software is used to send an receive encrypted emails and to verify that the senders are who they claim to be. [official site] [wikipedia]

After I found out that the old client was never installed on the system I found out that until version 2.9 the whole thing was also available as Java WebStart. After 2.9 only an installable msi-version is offered. Ok then, lets hope the new version is smart enough to import all the old settings from the WebStart version I thought ...

Windows folder redirection not working ... sometimes

We are making use of the Windows folder redirection group policies to redirect folders like "Documents", "Desktop" and "Favorites" to a server share in order to save space on the local harddisks/SSDs and of course make that data available to the user no matter what workstations he logs onto.

Our home directories are a little odd in regards to the folder structure we are using. The home directories reside in "\\server\users\home\<department>\<accountname>" which means that whenever a user changes department his/her entire home directory must be moved to a new location.

[BUG] Windows 10 default user profile is potentially writable by everyone

This is the story how I found out (by proxy) that the default user profile in Windows 10 is potentially writable by any user and the odyssey of trying to get this security bug fixed ... and failing to do so in the end.

For those who do not want to read the full story I posted a TL;DR version at the bottom. ;)


2017-05-19 19:55 - I got contacted by a friend who asked me for my input on an issue he (or rather his company) was having for weeks and months already and had not been able to figure out yet. Even Microsoft Germany, who they contacted themselves about this issue on 2017-03-28, did not have a solution for them.

Some background: His company is selling servers and support for them. So far, there are over 1.800 of their servers with over 100.000 connected clients and over 1.000.000 users out there and they had a problem with newly deployed Windows 10 systems they were not able to figure out.