DS3Circuit

Those registry entires are possible places to run update programs upon reboot if an application requires them. If you just wanted to replace explorer.exe with a hacked version...it would have been easier to say so in the beginning Just my $0.02

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run I imagine ..... if it is in the registry

Usually means that they dont have the correct permissions at either NTFS file permissions and/or registry keys 1. Try making those people Power Users 2. Try installing the Compatibility security template, though not in conjunction with Power Users cause that will nullify those efforts (in other words, one or the other) 3. Assign the correct permissions (such as read/write access) to those NTFS and/or registry permissions 4. Dont know where to change the permissions? Use the tools filemon and regmon from www.sysinternals.com HTH

http://www.appdeploy.com/tools/browse.asp?m=1

Well if you mean enterprise level migrations .... Symantec Enterprise Ghost 7.5 and Altiris each come with migration utilities to move users' documents, profiles, etc. And if you just mean a single user, I prefer the good ol' backup to a CDRW or network location.

Interesting .... A first thought I am thinking of modifying local ARP tables. APK you got me into doing a GOOGLE on this one. **EDIT** Wouldnt it be easier just to mail you a PIX firewall **EDIT2** Scratch the ARP notion .... was hoping mapping a particular IP to the local NIC MAC would work ....

Importing and Exporting Policies is seen here to save for a rainy day http://www.microsoft.com/technet/treevie...PSEC_export.asp And if you truly wished to have these installed automatically on the initial install of windows, you could use CMDLINES.TXT These are far easier to maintain, manage, and deploy in a domain environment *EDIT* LOL .... APK was typing the answers at the same time I was ... woah

Good glad to hear boss, and of course, feel free to add my name in lights anywhere you wish

Very Nice Jerry, that idea of using IPsec policies works .... and here's how you do it I will be using nd.edu as an example ... its a football thing Under Local Security Settings / IP Security Policies 1. Create a new IP Filter list 2. Source IP is My IP address 3. Destination (in this example) is 129.74.250.101 (nd.edu) 4. Protocol is any 5. Create a new IP Security Policy (use Kerberos 5 authentication) 6. Add an IP Security Rule (this rule is not a tunnel) (all network connections) 7. Add the new IP filter list that you just created. (require security) 8. Assign the new policy Upon doing this I CAN go to http://www.nd.edu but I CANNOT go to http://129.74.250.101 Scripting can be done with this tool: http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/ipsecpol-o.asp I imagine this is what you were looking for APK?

A tutorial on blocking direct IP internet access through windows http://www.pacificnet.net/~bbruce/route_intro.htm Is this what you wanted?

1. Make it a member server, so add it to the domain. 2. START / RUN / MMC 3. Add the Snap In ..... "Local Users and Groups" Manipulate the Users group.

The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load (these are the DLLs that need to load). There can be multiple instances of Svchost.exe running at the same time. Each Svchost.exe session can contain a grouping of services, so that separate services can be run depending on how and where Svchost.exe is started. This allows for better control and debugging. Svchost.exe groups are identified in the following registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost Each value under this key represents a separate Svchost group, and represents one instance of Svchost.exe. Each value is a REG_MULTI_SZ value and contains the services that run under that Svchost group. Each Svchost group can have more than one service_names extracted from the following registry key, whose Parameters key contains a ServiceDLL value: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ service (Windows XP) Once you have the command line up, type Tasklist /SVC From the listed applications, figure out the possible culprits and disable them. Examples would be Antivirus, Personal Firewalls, and/or poorly written TSRs. HTH

I'm with you APK ... I got the same speakers from circa 97 ... they turn on and sound comes out ... Guess I aint the biggest audiophile

Carefull on the cross-posting... http://www.ntcompatible.com/forums/viewtopic.php?t=23916

Group Policies for users Kixstart?

http://is-it-true.org/nt/registry/rtips87.shtml

NT 4 Server SP6a I imagine? Do you have DNS and WINS setup? IP on the client setup correctly? Look at the event viewer and share with us the error messages and ID numbers.

Clutch, as always, gave a very good explanation. I will now bore you with how to add additional email adresses to multiple users in Exchange 2000. Here the email address is primarily the UPN (universal principle name), which means your address is your RDN and the domain suffix. RDN being relative distinguished name (jdoe). Domain w/ suffix being mynetwork.com.(jdoe@mynetwork.com) And now you wanted to add johndoe@mynetwork.com to it as well as to your 400 other users. You would script it using ADSI using examples from ... www.swynk.com/ www.15seconds.com www.swinc.com The properties you would be modifying could be found using ADSI edit (from the win2k support tools) under the Domain Config Container and the attribute for those objects is called proxyAddresses. You would further add additional child domain listings and even IP address through the Recepient Policies running on the E2K server.

Been trying to get a windows 2000 installation to install the latest perc3 driver without the hardware being there .... basically trying to move an entire hard drive image to dissimilar hardware .... Ugh! ... basically I am playing janitor and cleaning up. PPTP is is pretty decent for most applicable needs. GRE 47 carries the payload and port 1723 does the authentication. That GRE 47 is actually protocol ID and not a port number for any I have confused. And yes, clutch is correct, there is IPSEC NAT transversal which allows it to pass through NAT as seen here ... http://www.microsoft.com/technet/treeview/default.asp?url=/technet/columns/cableguy/cg0802.asp So there ya go, another option for you to play with.

http://support.microsoft.com/default.aspx?scid=kb;[LN];Q138365

Well heres a link for 2000 and NT (towards the bottom) on configuring VPN access. I would suggest in reading those whitepapers. And from what I gather through your posts, these are my suggestions. http://www.microsoft.com/windows2000/technologies/communications/vpn/default.asp http://www.tek-tips.com/gviewthread.cfm/lev2/5/lev3/34/pid/463/qid/326646 http://www.wown.com/j_helmig/vpn.htm 1. If the 2 satellite sites just need to share resources with the domain, then all you need is to open PPTP (using NT as your RRAS) ports 1723 and Generic Routing Encapsulation.... GRE 47... on your DSL routers ... though most SOHO routers perform this rather poorly (get the latest firmware. Also install RRAS from the Option Pack on one of your NT DCs, unless of course you got a Win2k server that can handle RRAS. 2. If all 3 sites need to share resources equally then I suggest putting in a Radius server in each site to authenticate users who log in through PPTP. 3. I dont recommend using L2TP with IPSEC since NAT breaks this (correct me if I am mistaken) and since you have said your domain is NT 4 based. Though you may use L2TP/PPP. Clutch and APK please critique or add more info he might need. I am in the middle of cursing at some dell perc3 drivers

How to create a Microsoft Client boot disk http://service1.symantec.com/SUPPORT/ghost.nsf/pfdocs/1998081310484225?Open&dtype=corp How to create a Microsoft Network Client Boot Disk using Windows NT 4 Server's Network Client Administrator http://service1.symantec.com/SUPPORT/ghost.nsf/pfdocs/1999080407471425?Open&dtype=corp How to troubleshoot problems with Microsoft Client boot disks http://service1.symantec.com/SUPPORT/ghost.nsf/pfdocs/1998111212052525?Open&dtype=corp Could also be a resource thing .... you try another PCI slot?

ok well what version of ghost. I use ghost 7.5 enterprise edition for work. PCDOS or MSDOS being used. **Hands you a 3com nic**

Just a quick note. If you are working with primarily NT 4 servers (from what I have read) ... then create trusts and create PPTN VPN Connections using RRAS found in the OPTION PACK. That will allow secure connections for your networks with the internet used as the medium. VERY ROUGH EXPLANATION. Workgroups would be FAR easier to manage remotely if in a Domain security context. Principle is the same ... one machine seen as the bridgehead/proxy server. Quite an enourmous topic with numerous possibilities, combinations, and outcomes. IMHO, I would give US a lot more details to your setup so that the talented crew of NTcompatible could help you. www.labmice.net www.microsoft.com/technet

Clutch brought up an excellent point that I did not include about disabling the search for scheduled tasks. Gracias dood. Heres a link to show you WHO WHAT WHEN WHERE AND HOW http://www.windows2000faq.com/Articles/Index.cfm?ArticleID=20450