Category: Windows XP

Case of “catastrophic failure” and error 0x8000ffff with Group Policy Preferences mapping printers

Mapping printers using Group Policy Preferences is a really nice feature and it is supposed to be working much better than using traditional scripting technologies. Let me tell you about an interesting day troubleshooting why printers didn’t want to map using Group Policy Preferences. In the logs it just stated “catastrophic failure” which does not sound good at all nor makes much sense.

Log Name: Application
Source: Group Policy Printers
Event ID: 4098
Description: The user 'X' preference item in the 'Y {3EE4E80F-17CB-4E56-9237-4FC8B9FA090A}' Group Policy object did not apply because it failed with error code '0x8000ffff Catastrophic failure' This error was suppressed.

Logging in as the user on another machine did not produce the same problem and the mapping of printers work fine, as did mapping the printers when logging in using an administrator account.

This got me thinking that I should try mapping a printer manually as the standard user so I did. It got me a “You do not have permission to use the selected printer” which made me turn to the classic tool Process Monitor and to start a trace. It didn’t take long to see that after filtering all logs for a result of “denied” resulted in the following line:

Operation: CreateFile
Result: ACCESS DENIED
Path: \\printserver\print$\w32x86\3\OPLO_UM.dll
Desired access: Generic Read

Note that CreateFile does not necessarily mean to create a file, it can mean “read file” as documented by Microsoft for the CreateFile function. 

So the conclusion was that after investigating with the printer department the printer share “print$” security permissions did not match the user and the user actually did not have read permissions to read the driver which is an absolute requirement for the printer to be mapped (as the print driver is actually installed when the printer is mapped).

Also one setting that affected the behavior was that one have to set “Run in logged-on user’s security context” in the Common tab of the printer mapping Properties. This is an essential part of the solution…

Case closed!

Windows client security lockdown with nifty tool from Microsoft

It’s been around for some time and if you did not already know about it Microsoft provide the free tool called Security Compliance Manager. You can use it to very easily manage and export a set of pre-configured (or settings that you configure on your own) settings that improve security. You can then export these settings to for instance a group policy and import it into your domain.

There are templates with pre-configured security lockdowns for Windows XP, Windows Vista and of course also Windows 7. The tool works great for creating a security baseline for your client machines but the only downside is that you cannot import nor in a convenient way compare the settings in the templates with what you currently have.

New Remote Desktop Client 7.0 for Windows XP and Vista

Windows 7 already contain RDC version 7.0 but now Microsoft has released the 7.0 client for Windows XP and Windows Vista. Some of the benefits of using the RDC 7.0 connecting from Windows XP or Windows Vista are:

  • Windows Media Player Redirection.  This feature lets you play even a HD file on the remote machine without any lag as the video and audio is processed on the local machine.
  • True multi monitor support!
  • Performance improvements. This is alone a good reason to use the latest RDC 7.0 client.
  • Many more new features and improvements, read more at RDS blog.

Note that the above features only work when you connect from Windows XP or Windows Vista with RDC 7.0 to a Windows 7 or Windows Server 2008 R2 machine.

 Download and more information at http://support.microsoft.com/kb/969084

When to troubleshoot blue screen crashes

The other day I got an email from a blog reader which contained the information of a successful analyze of a memory dump file which is generated when an infamous blue screen of death occur. The reader wanted me to give him the solution or point him in the direction of a solution. This got me into thinking. When is it worth putting time on doing blue screen analyzes?

The content of the crash dump is maybe not that relevant after all. What is more important is how often and when the blue screen of death occurs. If the crash occurred just once or very seldom and randomly I would say that it might not be worth finding out exactly what caused the crash. Keep in mind that a blue screen could indicate a hardware failure, although driver problems are the most common cause for crashes.

However if the crashes occur often or at when doing specific tasks you have all the reasons in the world to get to the bottom of the problem. In these cases I recommend following the guide for troubleshooting blue screen crashes.

An interesting thing to note about blue screens that start occurring after for instance upgrading the OS from Windows XP to Windows Vista or Windows 7 is that the new memory management in the later operating systems might reveal problems in the memory modules that did not show when using Windows XP.

Finally, whenever having problem with blue screens of death I would recommend upgrading the machine BIOS. Often there are compatibility and stability fixes which solves problems with hardware which might be causing you the problems you are experiencing.

Install Windows client and server without product key

I just want to share a quick tip about something really smooth that many IT staff seems to be unaware of. Windows Vista and Windows Server 2008 introduced the fact that you can install it without entering a product key. This was later introduced in Windows XP (with service pack 3 slipstreamed) and also later Windows Server 2003 R2 media. Nothing about this changes for Windows 7 or Windows Server 2008 R2. So to sum it up you can install all current as well as coming operating systems without entering a product key and you will then have up to 30 days to enter it.

Add users to local groups on the Windows clients easily

If you want to add domain users or groups to a local group on a Windows client machine automatically, this can be done using group policies. One reason could be to easily put groups or users to the local group Remote Desktop Users to allow them to log on via RDP. To control which users or groups you want to add create a new GPO in the domain and go to Computer configuration > (Policies) > Windows settings > Security settings > Restricted groups.

Once there choose to add a group and in my example find the “Remote Desktop Users” group and after that add the user or group you want to add to the local machines which that particular group policy object applies to. More information about restricted groups can be found at http://support.microsoft.com/?id=810076

HOW TO: Clean out Windows\Installer folder correctly

When disk space is running out on a system disk, may it be on a server or a client, there are certain things to clean out. One of them being the %SYSTEMDRIVE%\Windows\Installer folder. You cannot under any circumstances delete files from this folder manually as this not only may but most likely will break software that is installed using MSI files, or Windows Installer files.

The %SYSTEMDRIVE%\Windows\Installer folder is a cache for installation files and patches (MSP files) and removing those will cause you to not being able to repair or uninstall applications, and in some cases not removing patches or applying new patches to software. In the event when you actually did delete this cache you can rebuild the files you need manually by extracting the files from original installation media, from patch packages etc but this is a time consuming and not that easy task to accomplish.

But let me get to the point. If you do want to free disk space you can clean out the %SYSTEMDRIVE%\Windows\Installer folder by downloading Windows Installer Cleanup Utility (NOTE: This tool has been retired and is no longer available from Microsoft) and then running the command

msizap.exe G!

When running this, the installer and patch packages are enumerated and unreferenced packages are considered to be safe to delete and are thereby also deleted. Depending on the age of the system and the number of applications installed, this action can free a significant amount of disk space.

Windows XP mode for Windows 7!

So it seams it isn’t a secret anymore that Windoyws 7 will get a feature (separate download) that using the latest Virtual PC technologies will make it possible to run applications in Windows XP directly integreated into the Windows 7  operating system. The feature is almost the same as MED-V which accomplishes basically the same thing, but The “Windows XP mode” has advantages like it is available for anyone running Windows 7 Professional, Enterprise or Ultimate SKUs.

With this Microsoft can guarantee compatilibty in a way no one could ever expect. This also makes the step from Windows XP to Windows 7 much easier and now there cannot be any apps holiding anyone back from upgrading the clients to Windows 7.

More information: Winsupersite

Troubleshoot and analyze Blue Screens of Death

TechRepublic has written a post on how to Extract troubleshooting info from Windows XP BSOD error messages. This is good, but I must say that extracting even more information from the memory crash dump file is even better. If you’ve missed my guide on how to do this you have it right here:

Troubleshoot and analyze Blue Screens of Death