Imaging and the McAfee Agent

When deploying machines using images, the McAfee agent will no longer communicate with the ePO Server.
This is because the GUID relating to the McAfee Agent needs to be reset.

Running SysPrep on a Windows machine will NOT reset the McAfee GUID, this should be done manually.

To accomplish this, delete the "AgentGUID" from the following location in the registry:
32-Bit:  [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent\]
64-Bit:  [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Network Associates\ePolicy Orchestrator\Agent\]

Once the registry entry has been deleted, restart the McAfee Framework Service.  The McAfee Agent should now communicate with the ePO server.

Note: If you are prepping a machine for imaging, the registry key should be deleted immediately before imaging takes place.

Converting a VMware Virtual Machine to Hyper-V

Occasionally the need arises to convert a VMware virtual machine (vmdk) to work in a Hyper-V environment (vhdx).  There are a number of third-party tools available to accomplish this task, some better than others.  However, wherever possible, I like to use tools built into an Operating System, or made directly by the same company.  Enter Microsoft Virtual Machine Converter.

This tool enables the direct conversion of a vmdk file with PowerShell, and can be downloaded from here: https://www.microsoft.com/en-us/download/details.aspx?id=42497

Download and install to the default location.  Then open a PowerShell window with elevated privilages, and run the following command:
     Import-Module 'C:\Program Files\Microsoft Virtual Machine Converter\MvmcCmdlet.psd1

This cmdlet contains a number of commands that can be used to perform various conversion tasks.  However the simplest is "ConvertTo-MvmcVirtualHardDisk".

Remaining in the elevated PowerShell window, enter the following command (obvioulsy you will need to change both the "SourceLiteralPath" (source) and "Destination" arguments:
     ConvertTo-MvmcVirtualHardDisk -SourceLiteralPath C:\TEMP\Disk1.vmdk -VhdType DynamicHardDisk -VhdFormat vhdx -destination C:\Temp\Disk1

That's it.  Wait for the command to complete, and you will have a fully functioning vhdx file you can use with your shiny new Hyper-V virtual machine.

Debugging Group Policy

Not entirely sure what is happening with the preferences you are setting in Group Policy?  You can enable Group Policy "Logging and Tracing" which should give you a better idea.

The settings can be found in Group Policy Editor, under:
Computer Configuration\Policies\Administrative Templates\System\Group Policy

Enable whichever policy settings you require

Reboot the machine and log on

Logs can be found in the following locations:
User trace %COMMONAPPDATA%\GroupPolicy\Preference\Trace\User.log
Computer trace %COMMONAPPDATA%\GroupPolicy\Preference\Trace\Computer.log
Planning trace %COMMONAPPDATA%\GroupPolicy\Preference\Trace\Planning.log

Domain Controller Replication

When setting up a domain, you really should check that all domain controllers are replicating successfully.  It is also useful to check this when troubleshooting domain related problems too, just in case a DC is out of sync.

At the command prompt, on the DC you are checking, type:
    repadmin /showrepl

That's it!
Obviously there is a bit more to this command.  For instance, to check the replication status of a different domain controller, you would use:
    repadmin /showrepl <servername> /u:<domain name>\<username> /pw:*

Mounting Windows Shares in Ubuntu

In a mixed Windows/Ubuntu environment, it is often the case the you need to mount a Windows a share from within Ubuntu.  This can be done on an ad-hoc basis, or at every log on.

Whilst it is possible to use one line to mount a share: (//servername/sharename  /media/windowsshare  cifs  username=msusername,password=mspassword,iocharset=utf8,sec=ntlm  0  0), this is not recommended, since the username and password are available for all to view.  This may not be a problem for you, but this post will take the extra steps of masking those details.

1. Install the CIFS Utilities
       sudo apt-get install cifs-utils
   
2. Create a directory where the share will be mounted.  I personally like to create this mount in my home directory, but you can create it pretty much where ever you like:
       sudo mkdir /home/<UbuntuUserName>/Server
   
3. Create a smbcredentials file:
       sudo gedit ~/.smbcredentials
   
4. Add lines for the username and password (for the destination where the share is located):
       username=<Username>
       password=<Password>
   
5. Edit the smbcredentials file to prevent changes:
       chmod 600 ~/.smbcredentials
   
6. Edit the /etc/fstab file with root privileges and add the following line:
       //<Servername>/<Sharename> /home/<UbuntuUserName>\Server cifs credentials=/home/<UbuntuUserName>/.smbcredentials,iocharset=utf8,sec=ntlm 0 0
   Don't forget to save the file!
   
7. This can then be tested by typing the following command:
       sudo mount -a
   If this correctly mounts the share, it should work the next time you log on.
   
8. Note: In the latest versions of most file managers, these mounted shares are only available read only by default.  If like me, you are used to a Windows environment, this can be a little annoying.
   However, it is much more secure.  To write to the mounted share, simply open the file manager as root (e.g. sudo pcmanfm)

Note: the following "variables" are used in the above steps:

<Username>
    Username for accessing the remote share

<Password>
    Password for accessing remote share
<UbuntuUserName>
    Local Ubuntu username

<Servername>
    Server name or IP address of the server housing the remote share

<Sharename>
    Share name on the remote server

Installing Wireless in Ubuntu

When installing Ubuntu (and it's many variants) on older hardware, it is often the case that the wireless drivers do not work without some tinkering.  There are too many different cards out there to write a set of instructions on how to install every card, therefore I will focus on the steps required to install network cards on my old Dell laptops, all running a Broadcom network cards.

The steps below show the steps required to install Broadcom drivers on Ubuntu:

1. Identify the installed hardware, by typing:
       lspci -vnn | grep Network
2. On my Dell D620, this returned the following:
       Broadcom Corporation BCM4311 802.11b/g WLAN [14e4:4311] (rev 01)
   It is the BCM4311 part we are interested in.
3. Remove the currently installed Broadcom drivers:
       sudo apt-get remove --purge bcmwl-kernel-source
4. Update the software list:
       sudo apt-get update
5. Install the correct firmware.  Since, the output in step #2 reported "BCM4311", I require the "b43" version of the firmware:
       sudo apt-get install firmware-b43-installer
6. Reboot

Upon starting the machine, a list of available wireless networks should be available.

Adding Services to Group Policies

By default, when you load up the services list in Group Policy editor, only the services running on that particular server are shown.  If you want to control services running on other machines, you need to add them.  Any service at all can be added, including ones from third party vendors.

Step 1: Export Settings

1. Log on to the machine that runs the service you require
2. Run secpol.msc
3. Create a new template
4. Within that template, navigate to "System Services" and all the services currently on that machine will be listed.
5. Edit the service(s) that you require (note: ONLY edit there services)
6. Save the template
7. Copy that file to the machine where you run the GP Editor (usually a DC)

Step 2: Import Settings

1. Load Group Policy Editor, and edit the policy that controls services you require
2. Navigate to the ‘Security’ node, right-click, choose import and select the file exported above
3. The service(s) should now appear in the policy, and can be modified just like any other service